terraform-provider-aws: Breaking change for several resources from 2.51.0 → 2.52.0

Hi,

I’m also seeing an issue with how grant is calculated for the plan. Tested on 2.63.

1. Create a bucket with grant:

   resource "aws_s3_bucket" "my-example-terraform-grant" {
       bucket = "my-example-terraform-grant"
   
       grant {
           id          = data.aws_canonical_user_id.current_user.id
           type        = "CanonicalUser"
           permissions = ["FULL_CONTROL"]
       }
   }
   

2. terraform apply.

3. terraform plan yields an in-place update to add the grant.

   Output of terraform plan

     # aws_s3_bucket.my-example-terraform-grant will be updated in-place
     ~ resource "aws_s3_bucket" "my-example-terraform-grant" {
           acl                         = "private"
           arn                         = "arn:aws:s3:::my-example-terraform-grant"
           bucket                      = "my-example-terraform-grant"
           bucket_domain_name          = "my-example-terraform-grant.s3.amazonaws.com"
           bucket_regional_domain_name = "my-example-terraform-grant.s3.eu-west-1.amazonaws.com"
           force_destroy               = false
           hosted_zone_id              = "XXXXXXXXXXXXXX"
           id                          = "my-example-terraform-grant"
           region                      = "eu-west-1"
           request_payer               = "BucketOwner"
           tags                        = {}
   
         + grant {
             + id          = "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
             + permissions = [
                 + "FULL_CONTROL",
               ]
             + type        = "CanonicalUser"
           }
   
           versioning {
               enabled    = false
               mfa_delete = false
           }
       }
   
   Plan: 0 to add, 1 to change, 0 to destroy.
   

At this point I could terraform apply forever, it will always see a change.

{
  "mode": "managed",
  "type": "aws_s3_bucket",
  "name": "my-example-terraform-grant",
  "provider": "provider.aws",
  "instances": [
    {
      "schema_version": 0,
      "attributes": {
        "acceleration_status": "",
        "acl": "private",
        "arn": "arn:aws:s3:::my-example-terraform-grant",
        "bucket": "my-example-terraform-grant",
        "bucket_domain_name": "my-example-terraform-grant.s3.amazonaws.com",
        "bucket_prefix": null,
        "bucket_regional_domain_name": "my-example-terraform-grant.s3.eu-west-1.amazonaws.com",
        "cors_rule": [],
        "force_destroy": false,
        "grant": [
          {
            "id": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
            "permissions": [
              "FULL_CONTROL"
            ],
            "type": "CanonicalUser",
            "uri": ""
          }
        ],
        "hosted_zone_id": "XXXXXXXXXXXXXX",
        "id": "my-example-terraform-grant",
        "lifecycle_rule": [],
        "logging": [],
        "object_lock_configuration": [],
        "policy": null,
        "region": "eu-west-1",
        "replication_configuration": [],
        "request_payer": "BucketOwner",
        "server_side_encryption_configuration": [],
        "tags": {},
        "versioning": [
          {
            "enabled": false,
            "mfa_delete": false
          }
        ],
        "website": [],
        "website_domain": null,
        "website_endpoint": null
      },
      "private": "bnVsbA=="
    }
  ]
}

@ewbankkit I think I’ve seen in the past where terraform can manage something but hasn’t actually been managing it where the provider will silently ignore the diff but maybe that’s a false memory.

Still, this kind of change feels odd for a minor version bump since I would expect those to be non-breaking.

still having the same issue with provider.aws ~> 2.69 and terraform 0.12.25

[terragrunt] 2020/07/07 15:27:01 Running command: terraform providers
.
├── provider.aws ~> 2.69
├── module.bucket_access_policies
│   └── provider.aws (inherited)
├── module.bucket_policies
│   └── provider.aws (inherited)
├── module.s3_bucket
│   └── provider.aws (inherited)
└── module.system_users
    └── provider.aws (inherited)

It’s the fact that terraform wants to remove a grant which is created by default whenever a bucket is created that I find confusing - IMO if the grants block isn’t specified then it should leave the default grant alone.

When you create a bucket or an object, Amazon S3 creates a default ACL that grants the resource owner full control over the resource. https://docs.aws.amazon.com/AmazonS3/latest/dev/acl-overview.html

Generated plan

      - grant {
          - id          = "<creatorid>" -> null
          - permissions = [
              - "FULL_CONTROL",
            ] -> null
          - type        = "CanonicalUser" -> null
        }