terraform-provider-aws: [Bug]: Org Trail resource creation failed for CloudTrail Delegated Administrator

Terraform Core Version

1.3.6

AWS Provider Version

4.47.0

Affected Resource(s)

aws_cloudtrail

Expected Behavior

1. We choose a Delegated Administrator for the CloudTrail Service (see AWS doc). All CloudTrail resources remain in the Management Account, even if they are created by the Delegated Account. (the ARN show the Account ID of the Management Account).
2. We deploy a new organization trail on this Delegated Account with Terraform.
3. The organization trail is fully created and enabled in the Management Account.

Actual Behavior

When Terraform applies, it’s failed when it try to enable logging it in the Delegated Account because it’s did not find the trail.

After successfully creation, The AWS provider seems try to enable the trail locally (in the Delegated account) instead to referer to the trail ‘stored’ in the Management Account. The ARN in the below log explains the bug.

Relevant Error/Panic Output Snippet

‘111111111111’ is the Delegated Account ID.

aws_cloudtrail.org_main: Creating...
╷
│ Error: Error starting logging on CloudTrail (org-cloudtrail): TrailNotFoundException: Unknown trail: arn:aws:cloudtrail:us-east-1:111111111111:trail/org-cloudtrail for the user: 111111111111
│ 
│   with aws_cloudtrail.org_main,
│   on 01-cloudtrail.tf line 4, in resource "aws_cloudtrail" "org_main":
│    4: resource "aws_cloudtrail" "org_main" {
│ 
╵
Operation failed: failed running terraform apply (exit 1)

Terraform Configuration Files

resource "aws_cloudtrail" "org_main" {
  name                          = "org-cloudtrail"
  enable_logging                = true
  s3_bucket_name                = aws_s3_bucket.cloudtrail.id
  s3_key_prefix                 = ""
  include_global_service_events = true
  enable_log_file_validation    = false
  is_multi_region_trail         = true
  is_organization_trail         = true

  event_selector {
    read_write_type                  = "WriteOnly"
    include_management_events        = true
    exclude_management_event_sources = ["kms.amazonaws.com", "rdsdata.amazonaws.com"]
  }
}

Steps to Reproduce

1. TF plan (ok)
2. TF apply (failed)

Debug Output

No response

Panic Output

No response

Important Factoids

No response

References

https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-delegated-administrator.html

Would you like to implement a fix?

No