aws_opensearch_domain ebs_options throughput attribute populated for non-gp3 volume types? [Bug]:

[bkjones]

Terraform Core Version

1.3.3

AWS Provider Version

4.36.1

Affected Resource(s)

• aws_opensearch_domain

Expected Behavior

• When I add the volume_type attribute to aws_opensearch_domain.ebs_options, and set it to standard, no errors related to throughput arise, since the throughput attribute is only applicable to the gp3 volume type.

Actual Behavior

When I add the volume_type attribute to aws_opensearch_domain.ebs_options.volume_type, and set it to standard(or gp2), I get the error:

Error: ValidationException: Throughput is only valid when volume type is GP3.

I get the same error if I explicitly set throughput to null. I searched existing issues, and google for anything useful but came up dry & this issue did not seem to exist in this system.

Relevant Error/Panic Output Snippet

No response

Terraform Configuration Files

Here's the relevant config. Note that this started because I changed the value of the incoming instance_type variable from a t3-class instance to an m4.xlarge.search instance type. At that time, ebs_options only had ebs_enabled and volume_size attributes, and I got the error Error: ValidationException: EBS volume-types :[standard, io1, gp2] must be selected for m4.xlarge.search. So I added a volume_type attribute and that's when I got the error I'm reporting about here: Error: ValidationException: Throughput is only valid when volume type is GP3..

This config will generate the error Error: ValidationException: Throughput is only valid when volume type is GP3. if the instance_type is set to m4.xlarge.search.

resource "aws_opensearch_domain" "opensearch" {
  domain_name    = "opensearch-${var.environment}"
  engine_version = "OpenSearch_1.3"

  cluster_config {
    instance_type            = var.opensearch_instance_type
    instance_count           = var.opensearch_instance_count
    dedicated_master_enabled = var.opensearch_dedicated_master_enabled
    warm_enabled             = var.opensearch_warm_enabled
    zone_awareness_enabled = false
  }

  ebs_options {
    ebs_enabled = true
    volume_size = 10
    volume_type = "standard"
  }

  log_publishing_options {
    cloudwatch_log_group_arn = aws_cloudwatch_log_group.opensearch_logs.arn
    log_type                 = "INDEX_SLOW_LOGS"
  }

  vpc_options {
    subnet_ids = toset(var.opensearch_vpc_options_subnet_ids)
    security_group_ids = [
      aws_security_group.opensearch.id,
      var.sg_1,
      var.sg_2
    ]
  }
}

Steps to Reproduce

• Configure aws_opensearch_domain.cluster_config.instance_type to m4.xlarge.search
• Configure ebs_options.volume_type = "standard"
• Run terraform apply

Debug Output

If I don't add the volume_type attribute, but my instance type is m4.xlarge.search, I get the error Error: ValidationException: EBS volume-types :[standard, io1, gp2] must be selected for m4.xlarge.search, and the debug log shows the following:

22759             "ebs_options": [
22760               {
22761                 "ebs_enabled": true,
22762                 "iops": 3000,
22763                 "throughput": 125,
22764                 "volume_size": 10,
22765                 "volume_type": "standard"
22766               }
22767             ],

When I add volume_type and set it to standard and don't add a throughput attribute, or explicitly set throughput to null, the debug log shows this:

22775             "ebs_options": [
22776               {
22777                 "ebs_enabled": true,
22778                 "iops": 3000,
22779                 "throughput": 125,
22780                 "volume_size": 10,
22781                 "volume_type": "standard"
22782               }

It appears that throughput is set to 125 as a default and cannot be overridden by a null, and is applied to volume_types for which that option is not appropriate.

Panic Output

No response

Important Factoids

I'm new to tf, but I don't think I'm doing anything exotic here.

References

Both the tf provider docs & the AWS docs say that throughput is only applicable to gp3 volume type. It is not an option for any other volume_type.
https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/opensearch_domain#throughput
https://docs.aws.amazon.com/opensearch-service/latest/developerguide/configuration-api.html

Would you like to implement a fix?

No response

[github-actions]

Community Note

Voting for Prioritization

• Please vote on this issue by adding a 👍 reaction to the original post to help the community and maintainers prioritize this request.
• Please see our prioritization guide for information on how we prioritize.
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request.

Volunteering to Work on This Issue

• If you are interested in working on this issue, please leave a comment.
• If this would be your first contribution, please review the contribution guide.

[jar-b]

I was able to reproduce this by:

1. Creating an OpenSearch domain with a gp3 EBS volume type
2. Switching to the standard volume type

I believe is caused by the computed iops and throughput values being stored in state after the initial apply, then passed into the EBS configuration of the Update API call here:

terraform-provider-aws/internal/service/opensearch/flex.go

Lines 72 to 95 in 165566e

	func expandEBSOptions(m map[string]interface{}) *opensearchservice.EBSOptions {
	options := opensearchservice.EBSOptions{}
	if ebsEnabled, ok := m["ebs_enabled"]; ok {
	options.EBSEnabled = aws.Bool(ebsEnabled.(bool))
	if ebsEnabled.(bool) {
	if v, ok := m["iops"]; ok && v.(int) > 0 {
	options.Iops = aws.Int64(int64(v.(int)))
	}
	if v, ok := m["throughput"]; ok && v.(int) > 0 {
	options.Throughput = aws.Int64(int64(v.(int)))
	}
	if v, ok := m["volume_size"]; ok && v.(int) > 0 {
	options.VolumeSize = aws.Int64(int64(v.(int)))
	}
	if v, ok := m["volume_type"]; ok && v.(string) != "" {
	options.VolumeType = aws.String(v.(string))
	}
	}
	}
	return &options
	}

One option is to conditionally set the Throughput and Iops fields based on the volume type, but hardcoding these conditions could cause future bugs if volume types are added that permit these inputs. Since the tradeoff is the current inability to change from gp3 volume types, this may be a reasonable approach.

[github-actions]

This functionality has been released in v4.51.0 of the Terraform AWS Provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template. Thank you!

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.