This issue was originally opened by @e-gineer as hashicorp/terraform#6909. It was migrated here as part of the provider split. The original body of the issue is below.

When an SNS topic in AWS account 111111111111 is subscribed to publish messages to an SQS queue in a different AWS account 222222222222, the aws_sns_topic_subscription is successfully created but is not recorded in the terraform state so is continuously recreated on every subsequent terraform run.

Terraform Version

Terraform v0.6.16

Affected Resource(s)

• aws_sns_topic_subscription

Terraform Configuration Files

resource "aws_sns_topic" "user_updates" {
  name = "user-updates-topic"
}

resource "aws_sns_topic_subscription" "user_updates_sqs_target" {
  topic_arn = "${aws_sns_topic.user_updates.arn}"
  protocol  = "sqs"
  endpoint  = "arn:aws:sqs:us-east-1:222222222222:sqs-queue-in-another-account"
}

Debug Output

https://gist.github.com/e-gineer/c7141b4c30dc0db120f1e8b9701a684a

Expected Behavior

The SNS topic subscription should be created only once from SNS in account 1 to the SQS in account 2. Future terraform runs should not recreate it.

Actual Behavior

When an SNS topic in AWS account 111111111111 is subscribed to publish messages to an SQS queue in a different AWS account 222222222222, the aws_sns_topic_subscription is successfully created but is not recorded in the terraform state so is continuously recreated on every subsequent terraform run.

Steps to Reproduce

1. Establish two separate AWS accounts.
2. In account 2, setup an SQS queue which allows SNS in account 1 to publish to it. This requires an SQS policy to allow the cross-account subscribe - please see below.
3. terraform apply
4. Accept the subscribe request by using the link that appears in the queue messages list. This completes the setup between SNS and SQS. (We do this immediately & automatically in software.)
5. terraform apply

Important Factoids

Allowing cross-account publishing from the SNS topic in account 1 to the queue in account 2 is important. The SQS queue requires a policy similar to:

{
  "Version":"2012-10-17",
  "Id":"MyQueuePolicy",
  "Statement":[
    {
      "Sid":"Allow-Publishing-Of-Messages-for-Queue",
      "Effect":"Allow",
      "Principal":{
        "AWS":"111111111111"
      },
      "Action":[
        "sqs:SendMessage"
      ],
      "Resource":[
        "arn:aws:sns:us-east-1:222222222222:sqs-queue-in-another-account",
      ]
    }
  ]
}

References

• Importing aws_security_group creates aws_security_group_rule's #6652 (similar SNS subscription area, but different issue)