Amazon Connect Security Profiles can not be updated #2046
Comments
|
The issue is that the permissions are being indexed and a number in the index must be given to remove the permissions. The exact number of that particular permission in the index. If I look at the list of permissions from the cloud control api. There is a list, but order is not alphabetized. Or in any order I can understand... seems random, but maybe not. Now if I want to remove a particular permission I have to count the resources in this permissions list and pass in the permissions index value in the patch document. And the resource after update completes. So the question is should the cloud control api allow updating the permission list by name? This makes sense, but not sure the cloud control api team would agree. It would be impossible for terraform to know the index value without getting the resource configuration from the cloudcontrol api before trying to make an update. Does that mean the terraform provider has to do some comparison between what the cloudcontrol resource configuration is, the terraform state file, and requested updates? The one operation I have not tried is inserting a permission with the cloudcontrol api. When doing an add how would you know what index value to use for the insert. The index is not an alphabetized list so not sure what happens when you insert a value into the index. For example what makes the permission ContactSearchWithKeywords.Access in any given routing profile number 7 in the index? |
|
I can add permissions to the list of permissions by appending to the index. This puts the permission in the index. Now the newly added permission, HistoricalChanges.View, is 10 in the index. If I remove a permission, ReportsAdmin.Access, from the index. This changes the permission, HistoricalChanges.View, in the index. |
|
There are two options to fix this.
|
|
@btgann , thanks for reporting the issue. I was able to replicate this issue with smaller resource config to make it easier to debug. HCL configshorten for brevity Terraform stateshorten for brevity Amazon Connect API (direct)CCAPI GetResourceIt's clear that CCAPI GetResource response is not in the same order with Amazon Connect API nor the HCL config and Terraform statefile. This I believe is the crux of the problem (ordering on the CCAPI). |
|
To dive deeper, let's say I updated the configuration as follow HCL Configshorten for brevity Cloud Control API PatchDocumentShorten for brevity, the patch target removal of permission on index #1, which should be for However it's important to remember that on CCAP earlier, index #1 is for Amazon Connect API (direct)As expected, Connect shown that |
|
The attribute |
|
For now, I consider this as upstream AWS issue, because the response from CCAPI != Amazon Connect. Fixing the ordering on the CCAPI is the most straightforward way, considering the Connect API already stores the permissions in alphabetical order. As such, by updating any permission in the list on HCL, AWSCC can order the list and specify the index to remove and it will match the same index number in Connect API. This was described earlier in here There's also opportunity for AWSCC to try re-conciliate the order of |
wellsiau-aws
added
upstream-aws
|
This is not an upstream-aws issue. The issue is related to how the awscc provider is writing a patch document for adding and removing permissions with an index value. The alignment of the permission to a particular index value cannot be guaranteed and the terraform resource updates fail if the permissions are not aligned in the index with the terraform state. The awscc provider is not reading the configuration from the cloud control api and making a comparison of the current state to the desired state, while indexing the permission list. The awscc provider is assuming the state has not changed, (permission list with index), and erroring if the state does not match. For example if I remove a permission from the list in the console and then run an update with terraform the awscc provider the operation will fail. This is because the index of the permission is not the same as in the terraform state. The provider should update the resource based on the desired state in the terraform configuration file. This update can be accomplished by using the "replace" operation in the patch document instead of individual "add" and "remove" operations. This would be consistent with the underlying apis expected operations. What drives the decision to use "add" and "remove" operations versus "replace" in the provider logic? |
Community Note
Terraform CLI and Terraform AWS Cloud Control Provider Version
terraform -version
Terraform v1.2.8
on windows_amd64
Your version of Terraform is out of date! The latest version
is 1.9.5. You can update by downloading from https://www.terraform.io/downloads.html
Affected Resource(s)
awscc_connect_security_profile
Terraform Configuration Files
Please include all Terraform configurations required to reproduce the bug. Bug reports without a functional reproduction may be closed without investigation.
security-profiles.tf
provider.tf
Debug Output
https://gist.github.com/btgann/a9d7bc386f6fbe698a1020c50100351f
Expected Behavior
When deploying Amazon Connect Security Profiles with the awscc provider the resource successfully deploys. Removing or adding new permissions to the profile should update the existing profile.
Actual Behavior
The provider errors and the security profile is not updated.
│ Error: AWS SDK Go Service Operation Unsuccessful
│
│ with awscc_connect_security_profile.jb_cus_admin_profile,
│ on security_profiles.tf line 1, in resource "awscc_connect_security_profile" "jb_cus_admin_profile":
│ 1: resource "awscc_connect_security_profile" "jb_cus_admin_profile" {
│
│ Calling Cloud Control API service UpdateResource operation returned: operation error CloudControl: UpdateResource, https response error StatusCode: 400, RequestID: d29113aa-e54f-4555-bdef-f9ed3522363b, api error ValidationException:
│ index Out of bound, index is greater than 48
Steps to Reproduce
You will need an Amazon Connect Instance. The Connect Instance arn needs to be updated in the security-profiles.tf file.
Use the security-profile.tf to deploy an Amazon Connect Security Profile with terraform. After successfully deploying the security profile remove permissions from the profile by commenting out 10 of the permissions in the list. Apply the change with terraform.
Important Factoids
Looking at the patch document that is sent to the cloud control api through terraform debug and sending the patch document to the api gets the same error message. I can shorten the number of permissions in the patch document and the api will succeed. The number of permissions that can be passed in the patch document is intermittent.
References
The text was updated successfully, but these errors were encountered: