Error when updating aws_ssm_document resource name when name is being referenced in an aws_ssm_association resource.

[mjcmtb]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform Version

Terraform v0.11.11

• provider.aws v1.56.0

Affected Resource(s)

• aws_ssm_document
• aws_ssm_association

Terraform Configuration Files

Initial Configuration

provider "aws" {
  region = "us-east-2"
}

resource "aws_ssm_document" "my_test_ssm_doc" {
  name            = "My_Test_SSM_Doc_11111"
  document_type   = "Command"
  document_format = "JSON"
  content         = "${file("mydoc.json")}"
}

resource "aws_ssm_association" "my_test_ssm_assoc" {
  name                = "${aws_ssm_document.my_test_ssm_doc.name}"
  schedule_expression = "rate(1 day)"

  targets {
    key    = "InstanceIds"
    values = ["i-0f460c650dc13674d"]
  }

  depends_on = ["aws_ssm_document.my_test_ssm_doc"]
}

Updated Configuration

provider "aws" {
  region = "us-east-2"
}

resource "aws_ssm_document" "my_test_ssm_doc" {
  name            = "My_Test_SSM_Doc_22222"
  document_type   = "Command"
  document_format = "JSON"
  content         = "${file("mydoc.json")}"
}

resource "aws_ssm_association" "my_test_ssm_assoc" {
  name                = "${aws_ssm_document.my_test_ssm_doc.name}"
  schedule_expression = "rate(1 day)"

  targets {
    key    = "InstanceIds"
    values = ["i-0f460c650dc13674d"]
  }

  depends_on = ["aws_ssm_document.my_test_ssm_doc"]
}

Expected Behavior

Changing the name used for the aws_ssm_document resource should result into a resource replacement (destroy, add) as opposed to an update.

Actual Behavior

Plan

An execution plan has been generated and is shown below.
Resource actions are indicated with the following symbols:
  ~ update in-place
-/+ destroy and then create replacement

Terraform will perform the following actions:

-/+ aws_ssm_association.my_test_ssm_assoc (new resource required)
      id:                  "6e3bb30f-3b69-4164-8545-02de400d1385" => <computed> (forces new resource)
      association_id:      "6e3bb30f-3b69-4164-8545-02de400d1385" => <computed>
      document_version:    "$DEFAULT" => <computed>
      name:                "My_Test_SSM_Doc_111111" => "My_Test_SSM_Doc_222222" (forces new resource)
      parameters.%:        "0" => <computed>
      schedule_expression: "rate(1 day)" => "rate(1 day)"
      targets.#:           "1" => "1"
      targets.0.key:       "InstanceIds" => "InstanceIds"
      targets.0.values.#:  "1" => "1"
      targets.0.values.0:  "i-0f460c650dc13674d" => "i-0f460c650dc13674d"

  ~ aws_ssm_document.my_test_ssm_doc
      name:                "My_Test_SSM_Doc_111111" => "My_Test_SSM_Doc_222222"


Plan: 1 to add, 1 to change, 1 to destroy.

Error on Apply

Error: Error applying plan:

1 error(s) occurred:

* aws_ssm_association.my_test_ssm_assoc: 1 error(s) occurred:

* aws_ssm_association.my_test_ssm_assoc: Error creating SSM association: InvalidDocument: Document with name My_Test_SSM_Doc_222222 does not exist.
	status code: 400, request id: b7828b79-711d-40bb-8b23-8bebf84e00c2

Terraform does not automatically rollback in the face of errors.
Instead, your Terraform state file has been partially updated with
any resources that successfully completed. Please address the error
above and apply again to incrementally change your infrastructure.

Steps to Reproduce

1. Execute terraform init, terraform plan, terraform apply on the configuration "Initial Configuration" above.
2. After a successful apply, update name for aws_ssm_document resource to a SSM document name that has not been previously used in the AWS account before (e.g. "Updated Configuration" above)
3. Execute terraform plan and apply. An error should result as described above. This only seems to occur when the aws_ssm_document name is updated to a name which has not been used before.
4. If another plan and apply is issued, without any changes, the update seems to succeed.
5. The error does not seem to occur if the name is updated to one which has been previously used.

[AndrewVertex]

Is there any news on this bug?

I am encountering the very same issue.

Any work-arounds would also be helpful.

[murthyanish]

I'm facing this issue as well. Is there any plan to fix the same?
No work-arounds seem to be working too.

[AndrewVertex]

I figured out a work around.

1. Create a new document with the name that you want. Update all resources to reference that
2. apply (deploy) your terraform.
3. At some point before the next deploy, remove the old doc from your terraform and all references to it
4. apply (deploy) removing old document

good luck

[murthyanish]

Thanks for the workaround. I would like to use it, but it doesn't scale. I can't be manually changing the document and all references every time.

[AndrewVertex]

murthyanish,

It is a work around so it wont be perfect.

You can minimize your re work by isolating the documents in their own module.

Then make sure your module exports the valid arn or document name.

Since the references would only care about the exported arn, changes are limited to the module itself.

divide and conquer

[bflad]

The fix (requiring aws_ssm_document resource replacement when changing the name argument) has been merged and will release with version 3.29.0 of the Terraform AWS Provider, likely later today.

[ghost]

This has been released in version 3.29.0 of the Terraform AWS provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template for triage. Thanks!

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thanks!