terraform-provider-aws: Bug introduced v3.29.0 with RDS Validation and Snapshots

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave “+1” or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform CLI and Terraform AWS Provider Version

v3.29.0 for AWS Provider v0.14.5 for Terraform

Affected Resource(s)

• aws_db_instance

Terraform Configuration Files

Please include all Terraform configurations required to reproduce the bug. Bug reports without a functional reproduction may be closed without investigation.

resource "aws_db_instance" "main" {
  engine                                = "postgres"
  engine_version                        = var.engine_version
  apply_immediately                     = true
  identifier                            = "db-${var.name}-pg-instance"
  name                                  = var.database_name
  username                              = var.database_name
  password                              = random_password.password.result
  storage_encrypted                     = true
  allocated_storage                     = var.allocated_storage
  max_allocated_storage                 = var.max_allocated_storage
  instance_class                        = var.instance_class
  snapshot_identifier                   = var.snapshot_identifier
  storage_type                          = var.storage_type
  backup_retention_period               = var.backup_retention_period
  backup_window                         = var.backup_window
  maintenance_window                    = var.maintenance_window
  auto_minor_version_upgrade            = true
  final_snapshot_identifier             = "${var.name}-rds-pg-final-snapshot"
  multi_az                              = true
  vpc_security_group_ids                = [aws_security_group.main.id]
  db_subnet_group_name                  = aws_db_subnet_group.main.name
  parameter_group_name                  = length(var.db_parameters) > 0 ? aws_db_parameter_group.main[0].name : null

  monitoring_interval                   = 30
  monitoring_role_arn                   = aws_iam_role.monitor_role.arn

  performance_insights_enabled          = true
  performance_insights_retention_period = 7

  enabled_cloudwatch_logs_exports       = [
    "postgresql",
    "upgrade"
  ]

  deletion_protection                   = var.deletion_protection
  tags                                  = local.common_data_tags

  lifecycle {
    ignore_changes = [
      username
    ]
  }

  #depends_on = [aws_iam_policy_attachment.monitor_role]
}

Debug Output

Panic Output

Expected Behavior

Because we’re passing null in for the snapshot we’d expect validation to succeed.

Actual Behavior

Validation fails because it does not take the null case into account.

Steps to Reproduce

1. Create a aws_db_instance resource that includes a username and passes in null for the snapshot id.
2. terraform apply

Important Factoids

This is a bug introduced in #17156

References

• #17156