[Bug]: Issue with aws_dms_replication_task resource replication_task_settings Logging.CloudWatchLogStream is read-only and cannot be set

[Volodymyr-Kuchinskyi]

Terraform Core Version

v1.4.0

AWS Provider Version

5.46.0

Affected Resource(s)

• aws_dms_replication_task

Expected Behavior

Plan running without any errors

Actual Behavior

The parameter Logging.CloudWatchLogStream is read-only and cannot be set.

Relevant Error/Panic Output Snippet

Errors:

in resource "aws_dms_replication_task" "dms_task":
replication_task_settings = local.task_settings

The parameter Logging.CloudWatchLogStream is read-only and cannot be set.

Error: Invalid value
in resource "aws_dms_replication_task" "dms_task":
replication_task_settings = local.task_settings

The parameter Logging.CloudWatchLogGroup is read-only and cannot be set.

Error: Invalid value

Terraform Configuration Files

resource "aws_dms_replication_task" "dms_task" {
  replication_task_id       = local.task_id
  replication_instance_arn  = var.instance_arn
  migration_type            = "full-load-and-cdc"
  replication_task_settings = local.task_settings
  source_endpoint_arn       = var.source_endpoint_arn // postgres endpoint
  target_endpoint_arn       = var.target_endpoint_arn // postgres endpoint
  table_mappings            = local.table_mappings
  lifecycle {
    ignore_changes = [replication_task_settings]
  }
  tags = merge(
    var.account.account_tags,
    {
      Name = local.task_id
    }
  )
}

Steps to Reproduce

1. Create a DMS task with version 5.45.0
2. Try to run terraform plan with enabled and disabled logging for dms task

Debug Output

No response

Panic Output

No response

Important Factoids

The dms task was created ~2 years ago with a different version of terraform provider
terraform plan runs without any errors for 5.45.0 so there is something introduced in 5.46.0

References

#36936

Would you like to implement a fix?

None

[github-actions]

Community Note

Voting for Prioritization

• Please vote on this issue by adding a 👍 reaction to the original post to help the community and maintainers prioritize this request.
• Please see our prioritization guide for information on how we prioritize.
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request.

Volunteering to Work on This Issue

• If you are interested in working on this issue, please leave a comment.
• If this would be your first contribution, please review the contribution guide.

[Rohan8782git]

The parameter Logging.CloudWatchLogGroup is read-only and cannot be set.

Didn't work with aws provider 5.46.0 is there any update on this?

[ewok]

CloudWatchLogGroup and CloudWatchLogStream seem to be dynamic and changed by aws itself.
Try to remove these two from your replication_task_settings.
This worked for me.

[zachary-povey]

From the release notes:

We've just hit this too as our settings had these explicitly set to null (presumably we had this due to a copy and paste from the docs here) so yeah think it's just a case of removing these settings entirely.

[ArpanSamariya]

Along with the above errors, I am getting error: The parameter Logging.EnableLogContext is not allowed when Logging.EnableLogging is not set to true.
Earlier this was working without errors, recent validation checks in aws_dms_replication_task have caused this.

Worked for me:

• Removed EnableLogContext from the task settings since EnableLogging is set to false.
• Removed CloudWatchLogGroup and CloudWatchLogStream from the logging settings.

[eugenetaranov]

seems like it was already fixed in v.3.36 #13476 but then can be replicated with 5.10+

[YakDriver]

We apologize for the inconvience caused by this!

TL;DR

This change was required due to an AWS change. The fix is to remove Logging.CloudWatchLogGroup and Logging.CloudWatchLogStream from your configuration since they are read only anyway.

Correct Example

EnableLogging is set. EnableLogContext could also be set here since EnableLogging is true.

resource "aws_dms_replication_task" "test" {
  # ... other config ...

  replication_task_settings = jsonencode(
    {
      Logging = {
        EnableLogging = true,
        LogComponents = [{
          Id       = "DATA_STRUCTURE",
          Severity = "LOGGER_SEVERITY_WARNING"
        }]
      }
    }
  )
}

Incorrect Example 1

EnableLogging is set but regardless CloudWatchLogGroup and CloudWatchLogStream are read only and cannot be set.

resource "aws_dms_replication_task" "test" {
  # ... other config ...

  replication_task_settings = jsonencode(
    {
      Logging = {
        EnableLogging = true,
        CloudWatchLogGroup = "abcdef"
        CloudWatchLogStream = "abcdef"
      }
    }
  )
}

Incorrect Example 2

EnableLogging is set but regardless CloudWatchLogGroup and CloudWatchLogStream are read only and shouldn't be set.

resource "aws_dms_replication_task" "test" {
  # ... other config ...

  replication_task_settings = jsonencode(
    {
      Logging = {
        EnableLogging = true,
        CloudWatchLogGroup = null
        CloudWatchLogStream = null
      }
    }
  )
}

Background

Unfortunately, our hand was forced by a change made by AWS. Previously, Logging.CloudWatchLogGroup and Logging.CloudWatchLogStream could be sent to AWS even though they did nothing, and AWS would not complain. However, AWS made a change so that including them would result in constant diffs (see #36598). In reality, AWS fixed the behavior because these settings are read only and cannot be changed. You can enable logging with Logging.EnableLogging but then AWS sets Logging.CloudWatchLogGroup and Logging.CloudWatchLogStream so they should not be included in the configuration.

[github-actions]

Warning

This issue has been closed, meaning that any additional comments are hard for our team to see. Please assume that the maintainers will not see them.

Ongoing conversations amongst community members are welcome, however, the issue will be locked after 30 days. Moving conversations to another venue, such as the AWS Provider forum, is recommended. If you have additional concerns, please open a new issue, referencing this one where needed.

[github-actions]

This functionality has been released in v5.49.0 of the Terraform AWS Provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template. Thank you!

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.