terraform-provider-aws: `aws_grafana_role_association` fails to associate AWS SSO user/group IDs

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave “+1” or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform CLI and Terraform AWS Provider Version

Terraform v1.1.4
on linux_amd64
+ provider registry.terraform.io/hashicorp/aws v4.9.0

Your version of Terraform is out of date! The latest version
is 1.1.8. You can update by downloading from https://www.terraform.io/downloads.html

Affected Resource(s)

• aws_grafana_role_association

Terraform Configuration Files

resource "aws_grafana_role_association" "example" {
  role         = "ADMIN"
  group_ids     = ["<AWS SSO group ID>"]
  workspace_id = aws_grafana_workspace.example.id
}

resource "aws_grafana_workspace" "example" {
  account_access_type      = "CURRENT_ACCOUNT"
  authentication_providers = ["AWS_SSO"]
  permission_type          = "SERVICE_MANAGED"
  role_arn                 = aws_iam_role.assume.arn
}

resource "aws_iam_role" "assume" {
  name = "grafana-assume"
  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = "sts:AssumeRole"
        Effect = "Allow"
        Sid    = ""
        Principal = {
          Service = "grafana.amazonaws.com"
        }
      },
    ]
  })
}

Debug Output

N/A

Panic Output

N/A

Expected Behavior

• AWS SSO group ID that is specified in role association is associated with the workspace

Actual Behavior

• After a successful apply, no additional diffs in a plan, there are no groups associate with the workspace in the console and group members cannot access the workspace. Manually adding the group through the console does work however; no diff shown in state after adding manually though.

Steps to Reproduce

1. terraform apply
2. Navigate to Grafana workspace in console
3. Check athentication tab and you will see this error message that no AWS SSO users/groups are associated

Important Factoids

• No, pretty vanilla AWS organization with AWS SSO

References

• #23791
• #23665