Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

aws_route53_resolver_rule data lookup tag error #10211

Closed
justicel opened this issue Sep 23, 2019 · 9 comments · Fixed by #10348
Closed

aws_route53_resolver_rule data lookup tag error #10211

justicel opened this issue Sep 23, 2019 · 9 comments · Fixed by #10348
Labels
bug Addresses a defect in current functionality. service/route53resolver Issues and PRs that pertain to the route53resolver service.
Milestone

Comments

@justicel
Copy link

Community Note

  • Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
  • Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
  • If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform Version

v0.11.14

Affected Resource(s)

  • data.aws_route53_resolver_rule
  • data.aws_route53_resolver_rules

Terraform Configuration Files

data "aws_route53_resolver_rule" "dns_ram" {
  count       = "${length(var.forward_zones)}"
  domain_name = "${var.forward_zones[count.index]}"
  depends_on = ["aws_ram_resource_share_accepter.dns_ram"]
}

Expected Behavior

Should have done a data lookup and located route53 resolver rule(s).

Actual Behavior

Terraform returns an error that you are not authorized to look at tags on shared resource:

* module.share.data.aws_route53_resolver_rule.dns_ram[2]: data.aws_route53_resolver_rule.dns_ram.2: error reading Route 53 Resolver rule (rslvr-rr-190b4db83f3b4b148) tags: InvalidParameterException: [RSLVR-00900] Invalid arn: "[RSLVR-00907] You are not authorized to do this operation on shared resource"
status code: 400, request id: 26e84b24-6b23-48a3-b51f-807ef47ee0cf
* module.share.data.aws_route53_resolver_rule.dns_ram[4]: data.aws_route53_resolver_rule.dns_ram.4: error reading Route 53 Resolver rule (rslvr-rr-9426511912e444d59) tags: InvalidParameterException: [RSLVR-00900] Invalid arn: "[RSLVR-00907] You are not authorized to do this operation on shared resource"

Steps to Reproduce

  1. terraform apply

Important Factoids

This is a shared resolver rule set from another AWS account. The share was accepted and the rules show up in our account. This appears to be a bug in that you cannot lookup tags of a shared rule via the AWS API.

@ghost ghost added service/route53 Issues and PRs that pertain to the route53 service. service/route53resolver Issues and PRs that pertain to the route53resolver service. labels Sep 23, 2019
@github-actions github-actions bot added the needs-triage Waiting for first response or review from a maintainer. label Sep 23, 2019
@ewbankkit
Copy link
Contributor

@ewbankkit
Copy link
Contributor

OK, I can reproduce with an acceptance test case:

$ AWS_ALTERNATE_ACCESS_KEY_ID=AAAAAAAAAAAAAAAAAAAA AWS_ALTERNATE_SECRET_ACCESS_KEY=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx make testacc TEST=./aws/ TESTARGS='-run=TestAccDataSourceAwsRoute53ResolverRule_SharedWithMe'
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./aws/ -v -count 1 -parallel 20 -run=TestAccDataSourceAwsRoute53ResolverRule_SharedWithMe -timeout 120m
=== RUN   TestAccDataSourceAwsRoute53ResolverRule_SharedWithMe
=== PAUSE TestAccDataSourceAwsRoute53ResolverRule_SharedWithMe
=== CONT  TestAccDataSourceAwsRoute53ResolverRule_SharedWithMe
--- FAIL: TestAccDataSourceAwsRoute53ResolverRule_SharedWithMe (215.89s)
    testing.go:569: Step 0 error: errors during apply:
        
        Error: error reading Route 53 Resolver rule (rslvr-rr-5587d23bbd0b4427b) tags: InvalidParameterException: [RSLVR-00907] You are not authorized to do this operation on shared resource
        	status code: 400, request id: e29548bf-4df3-49e5-8539-ce527aea6562
        
          on /var/folders/4j/lf5jdq5j4y91g80ytf6qzjwmk6drp5/T/tf-test261069804/main.tf line 147:
          (source code not available)
        
        
FAIL
FAIL	github.com/terraform-providers/terraform-provider-aws/aws	215.980s
FAIL
make: *** [testacc] Error 1

@ewbankkit
Copy link
Contributor

ewbankkit commented Oct 3, 2019

I wonder if the same applies to other RAM shareable resources with tags (and data sources)?

  • aws_ec2_transit_gateway - No separate API call to retrieve tags as they are returned in DescribeTransitGateways. OK
  • aws_subnet - No separate API call to retrieve tags as they are returned in DescribeSubnets. OK
  • aws_rds_cluster for Aurora clusters - Tags are retrieved in separate API call. Not supported currently - See below.

@dbaggerman
Copy link

Just checked our TGW shares. DescribeTransitGateways in the account being shared to doesn't error, but it returns an empty Tags array despite the shared TGW having tags in the source account.

I don't have any shares of the other resource types to check.

@ewbankkit
Copy link
Contributor

@dbaggerman Thanks for checking that. It looks like it may just be Aurora RDS clusters that could cause a similar problem; I'll investigate that.
I have finished the PR to fix the Route 53 Resolver rules problem: #10348.

@ewbankkit
Copy link
Contributor

Aurora cross-account cloning uses the RDS point-in-time restore mechanism.
There is an PR to support this, I'll add a note to consider investigating this case to that PR.

@bflad bflad added this to the v2.35.0 milestone Nov 4, 2019
@bflad bflad added bug Addresses a defect in current functionality. and removed needs-triage Waiting for first response or review from a maintainer. service/route53 Issues and PRs that pertain to the route53 service. labels Nov 4, 2019
@bflad
Copy link
Contributor

bflad commented Nov 4, 2019

The fix for this has been merged and will release with version 2.35.0 of the Terraform AWS Provider, Thursday. Thanks to @ewbankkit for the fix. 👍

@ghost
Copy link

ghost commented Nov 7, 2019

This has been released in version 2.35.0 of the Terraform AWS provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template for triage. Thanks!

@ghost
Copy link

ghost commented Mar 29, 2020

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thanks!

@ghost ghost locked and limited conversation to collaborators Mar 29, 2020
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
bug Addresses a defect in current functionality. service/route53resolver Issues and PRs that pertain to the route53resolver service.
Projects
None yet
4 participants