Tags should be passed to SSM PutParameter

[rymancl]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform CLI and Terraform AWS Provider Version

Affected Resource(s)

• aws_ssm_parameter

Terraform Configuration Files

Please include all Terraform configurations required to reproduce the bug. Bug reports without a functional reproduction may be closed without investigation.

locals {
  tags = {
    Team = "MyTeam"
  }
}

resource "aws_ssm_parameter" "foo" {
  name   = "foo"
  type   = "SecureString"
  value  = "bar"
  tags   = local.tags
}

The assumed role "myrole" has an ABAC policy to give access to SSM Parameter Store. Something like this:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ssm:AddTagsToResource",
                "ssm:PutParameter"
            ],
            "Resource": "*",
            "Condition": {
                "StringLikeIfExists": {
                    "aws:RequestTag/Team": [
                        "MyTeam"
                    ]
                },
                "ForAnyValue:StringEquals": {
                    "aws:TagKeys": [
                        "Team"
                    ]
                }
            }
        }
    ]
}

The PutParameter API call supports passing tags in the request. The IAM PutParameter action supports passing aws:RequestTag.

If you use the CLI, this works as expected:

aws ssm put-parameter --name foo --value "bar" --type SecureString
An error occurred (AccessDeniedException) when calling the PutParameter operation: User: arn:aws:sts::<acct>:assumed-role/myrole/mysession is not authorized to perform: ssm:PutParameter on resource: arn:aws:ssm:<region>:<acct>parameter/foo

aws ssm put-parameter --name foo --value "bar" --type SecureString --tags Key=Team,Value=MyTeam
{
    "Version": 1
}

But if you use Terraform you get the following error...

Error: error creating SSM parameter: AccessDeniedException: User: arn:aws:sts:::assumed-role/myrole/mysession is not authorized to perform: ssm:PutParameter on resource: arn:aws:ssm:::parameter/foo

The AWS Go SDK supports passing tags in the PutParameterInput object, yet the code doesn't do it until after the parameter is created.

Expected Behavior

Tags should be passed as part of the request to follow AWS documentation on the SSM PutParameter API request.

Actual Behavior

SSM parameter tags are passed after the parameter is created, which breaks IAM policy documentation from AWS.

Steps to Reproduce

1. Use role with policy as described
2. terraform apply

[ghost]

This has been released in version 3.35.0 of the Terraform AWS provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template for triage. Thanks!

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thanks!