Unable to create awscc_resiliencehub_app resource

[FrancisRalph]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment
• The resources and data sources in this provider are generated from the CloudFormation schema, so they can only support the actions that the underlying schema supports. For this reason submitted bugs should be limited to defects in the generation and runtime code of the provider. Customizing behavior of the resource, or noting a gap in behavior are not valid bugs and should be submitted as enhancements to AWS via the CloudFormation Open Coverage Roadmap.

Terraform CLI and Terraform AWS Cloud Control Provider Version

Terraform v1.7.3
on darwin_arm64
+ provider registry.terraform.io/hashicorp/aws v5.31.0
+ provider registry.terraform.io/hashicorp/awscc v0.70.0

Affected Resource(s)

• awscc_resiliencehub_app

Terraform Configuration Files

Please include all Terraform configurations required to reproduce the bug. Bug reports without a functional reproduction may be closed without investigation.

resource "awscc_resiliencehub_app" "main" {
  name = "OnboardingAssignment"
  app_template_body = <<EOF
{ "resources": [], "appComponents": [], "excludedResources": { "logicalResourceIds": [] }, "version": 2 }
  EOF
  resource_mappings = [ {
    physical_resource_id = {
      identifier = "s3://terraform-state-files/onboarding-assignment.tfstate"
      type = "Native"
    }
    mapping_type = "Terraform"
    terraform_source_name = "onboarding-assignment.tfstate"
  } ]
  resiliency_policy_arn = "arn:aws:resiliencehub:ap-southeast-1:<account-id>:resiliency-policy/<id>"
  permission_model = {
    type = "RoleBased"
    invoker_role_name = "resilience-hub-test-app-role"
  }
  event_subscriptions = []
  app_assessment_schedule = "Disabled"
  description = "TF Managed"
  tags = {}
}

Debug Output

│ Error: AWS SDK Go Service Operation Incomplete
│ 
│   with awscc_resiliencehub_app.main,
│   on resilience_hub.tf line 1, in resource "awscc_resiliencehub_app" "main":
│    1: resource "awscc_resiliencehub_app" "main" {
│ 
│ Waiting for Cloud Control API service CreateResource operation completion returned: waiter state transitioned to FAILED. StatusMessage:
│ [format attribute "password" not supported, object has too few properties (found 0 but schema requires at least 1)] (Service:
│ Resiliencehub, Status Code: 400, Request ID: 4ffc1f4a-f156-47c3-ba4a-1d9cb960d5d2). ErrorCode: InvalidRequest
╵

Expected Behavior

Successfully created awscc_resiliencehub_app resource

Actual Behavior

Error occurs. Unsure why the error is mentioning a password format validation error.

Steps to Reproduce

1. terraform apply

[wellsiau-aws]

I got similar error as well and I am escalating internally to Resilience Hub team

[niroz89]

Encountered the same error while creating the resource awscc_resiliencehub_resiliency_policy as well.

╷
│ Error: AWS SDK Go Service Operation Incomplete
│
│   90: resource "awscc_resiliencehub_resiliency_policy" "this" {
│
│ Waiting for Cloud Control API service CreateResource operation completion
│ returned: waiter state transitioned to FAILED. StatusMessage: [format
│ attribute "password" not supported, object has too few properties (found 0
│ but schema requires at least 1), format attribute "int32" not supported]
│ (Service: Resiliencehub, Status Code: 400, Request ID:
│ d7473d56-8c13-4084-a62b-4eb002156a19). ErrorCode: InvalidRequest
╵
Operation failed: failed running terraform apply (exit 1)

[YarivLevy81]

I found a workaround for this issue, simply adding a non-empty tags map should avoid the validation issues:

resource "awscc_resiliencehub_app" "main" {
  name = "Application"
  app_template_body = ...
  resource_mappings = ...
...
  tags = { # <==== See these
      "test" = "test"
  }
..
}

I tested the same for awscc_resiliencehub_resiliency_policy.
This probably occurs due to the way AWS-CC integrate tags with the CloudFormation resource handlers, we're looking into it.

You can just add something like for now:

 tags = {
      "test" = "test"
  }

[niroz89]

Thank you @YarivLevy81 , it's working when adding a non-empty tag.