aws_msk_cluster resource doesn't save arn to state when available

[Tzrlk]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform CLI and Terraform AWS Provider Version

Terraform 1.0.9
Aws provider: 3.63.0

Affected Resource(s)

• aws_msk_cluster

Terraform Configuration Files

Please include all Terraform configurations required to reproduce the bug. Bug reports without a functional reproduction may be closed without investigation.

resource "aws_msk_cluster" "Kafka" {
  timeouts {
    create = "5min"
  }
  #...etc
}

Debug Output

Panic Output

Expected Behavior

While my specific timeout was due to AWS session token expiry, when creation of a new msk cluster resource is triggered, it should store the resulting ARN in the state as soon as it's available. If there's an error during the process, the resource can be tainted, but can later be refreshed if re-attempted or manually fixed.

Actual Behavior

When the timeout stops the creation process, it doesn't store the arn, so terraform is unaware that it has actually created the resource. Subsequent apply operations complain about a name conflict.

Steps to Reproduce

1. Take a working msk creation configuration.
2. Either set the create timeout or aws session duration to something impossible.
3. terraform apply
4. Observe the timeout error, and that the resource is in a "Creating" state in the console.
5. terraform apply
6. Observe the name conflict

Important Factoids

non-automatically renewable AWS session duration

References

• Updating MSK configuration creates new one instead -> name collision #15795

[Tzrlk]

Able to work-around the issue by using terraform import aws_msk_cluster.Kafka <arn> after the failure.

[bflad]

Related: hashicorp/terraform-plugin-sdk#330 -- essentially Terraform does not provide provider resources the ability to not taint a resource on creation error. If the resource is tainted due to an error after the creation, but while waiting for the creation to complete, the resource can be untainted via the terraform untaint command to prevent the need to import it.

I'm not aware off the top of my head if saving Computed attribute values in the response will be preserved in state in this situation (attempting to reference the id attribute instead of the arn attribute can determine what happens in this failure mode since the id attribute is set before raising the error), however the provider developers can consider a d.Set("arn", output.ClusterArn) near

terraform-provider-aws/internal/service/kafka/cluster.go

Line 533 in 037b561

d.SetId(aws.StringValue(output.ClusterArn))

if setting computed attributes does happen to work.

[github-actions]

Marking this issue as stale due to inactivity. This helps our maintainers find and focus on the active issues. If this issue receives no comments in the next 30 days it will automatically be closed. Maintainers can also remove the stale label.

If this issue was automatically closed and you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thank you!