terraform-provider-aws: Defining multiple aws_cognito_resource_server.scope's broken in new version

Community Note

Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
Please do not leave “+1” or “me too” comments, they generate extra noise for issue followers and do not help prioritize the request
If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform Version

Terraform v0.12.9

provider.aws v2.28.1

Affected Resource(s)

aws_cognito_resource_server

aws v2.28.1

Terraform Configuration Files

resource "aws_cognito_resource_server" "global" {
  user_pool_id = "${aws_cognito_user_pool.my_pool.id}"

  identifier = "${lower(var.environment)}-internalarchitecture"
  name       = "${var.environment}-InternalArchitecture"

  scope = [
    {
      scope_name        = "biscrapper"
      scope_description = "Scope for BI Scrapper"
    },
    {
      scope_name        = "timeentryservice"
      scope_description = "Scope"
    }
   ]
}

Expected Behavior

In the previous version of terraform (0.11) and aws provider (1.26) this was running fine and creating all the defined resource server scope identifiers. Documentation for aws_cognito_resource_server also specified that scope is a list of identifiers. So I expect to be able to define multiple resource server scopes.

Actual Behavior

Error: Unsupported argument

  on resource_servers.tf line 7, in resource "aws_cognito_resource_server" "global":
   7:   scope = [

An argument named "scope" is not expected here. Did you mean to define a block
of type "scope"?

I tried adding multiple scope blocks, like such

scope {<..>}
scope {<..>}

but then i get the output that only 1 scope block can be defined.

How do I apply the list of scopes now?

Steps to Reproduce

terraform apply

About this issue

Original URL
State: closed
Created 5 years ago
Reactions: 7
Comments: 15 (2 by maintainers)

Most upvoted comments

For anyone stuck on this, here is how we managed to get several scopes:

  variable "scopes" {
    type = "map"
    default = {
      scope1 = {
        "scope_name": "Hello"
        "scope_description": "description"
      },
      scope2 = {
        "scope_name": "Hello2"
        "scope_description": "description"
      }
    }
  }
  
  resource "aws_cognito_resource_server" "resource_server" {
    identifier = var.name
    name       = var.name
  
    dynamic "scope" {
      for_each = [for key, value in var.scopes: {
        scope_name     = value.scope_name
        scope_description     = value.scope_description
      }]
  
      content {
        scope_name     = scope.value.scope_name
        scope_description = scope.value.scope_description
      }
    }
  
    user_pool_id = var.pool_id
  }

jgournet on Oct 9, 2019

For anyone with a recent provider version (I tried with 3.35.0) who is confused whether to use the “dynamic” workaround, the original poster’s syntax, or something else: This snippet works for 2 or more scopes - no further workarounds required:

resource "aws_cognito_resource_server" "main" {
  user_pool_id = aws_cognito_user_pool.main.id

  identifier = "${var.appid}-resources"
  name = "${var.appid} resources"

  scope {
    scope_name = "read"
    scope_description = "..."
  }

  scope {
    scope_name = "write"
    scope_description = "..."
  }

  scope {
    scope_name = "make-it-three"
    scope_description = "..."
  }

}

tillkuhn on Apr 8, 2021

Hey all 👋 Given the feedback that this issue seems to be resolved, we’ll close this issue out. If you experience this issue again with new versions of the AWS Provider, please open a new issue so that we can take another look.

@codezninja 👋 It sounds like you may be having a slightly different issue. I’d recommend taking a quick look over the documentation on references to values; particularly the section on using for_each. If that doesn’t help, please feel free to open a new issue or open a discussion on the AWS Provider forum.

justinretzolk on Jan 23, 2023

@justinretzolk: I can confirm that the code from my https://github.com/hashicorp/terraform-provider-aws/issues/10159#issuecomment-815976453 which uses the scope argument multiple times is still working within recent versions of Terraform and AWS Provider. This seems to be in accordance with the official docs that describe scope as

scope - (Optional) A list of Authorization Scope.

Versions:

Terraform v1.1.0 on darwin_amd64
+ provider registry.terraform.io/hashicorp/aws v3.68.0

tillkuhn on Dec 10, 2021