Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Bug]: Can not destroy the cluster if SNS topic is not confirmed yet #36494

Open
EugenKon opened this issue Mar 20, 2024 · 1 comment
Open

[Bug]: Can not destroy the cluster if SNS topic is not confirmed yet #36494

EugenKon opened this issue Mar 20, 2024 · 1 comment
Labels
bug Addresses a defect in current functionality. service/sns Issues and PRs that pertain to the sns service.

Comments

@EugenKon
Copy link

Terraform Core Version

v1.7.4

AWS Provider Version

v5.41.0

Affected Resource(s)

  • aws_sns_topic
  • aws_sns_topic_policy
  • aws_sns_topic_subscription
  • aws_iam_policy_document

Expected Behavior

If SNS topic does not exists, then terraform should just remove resource from the state instead of failing.

image

Actual Behavior

I can not destroy cluster.

Relevant Error/Panic Output Snippet

No response

Terraform Configuration Files

data "aws_iam_policy_document" "notify-devops" {
  version   = "2012-10-17"
  policy_id = "__default_policy_ID"
  statement {
    sid = "__default_statement_ID"
    actions = [
      "SNS:GetTopicAttributes",
      "SNS:SetTopicAttributes",
      "SNS:AddPermission",
      "SNS:RemovePermission",
      "SNS:DeleteTopic",
      "SNS:Subscribe",
      "SNS:ListSubscriptionsByTopic",
      "SNS:Publish",
      "SNS:Receive"
    ]
    effect    = "Allow"
    resources = [aws_sns_topic.notify-devops.arn]

    condition {
      test     = "StringEquals"
      variable = "AWS:SourceOwner"

      values = [
        "${data.aws_caller_identity.current.account_id}"
      ]
    }

    principals {
      identifiers = ["*"]
      type        = "AWS"
    }
  }
}

...
resource "aws_sns_topic" "notify-devops" {
  name = "${var.project_name}-notify-devops"
}

resource "aws_sns_topic_policy" "notify-devops" {
  arn    = aws_sns_topic.notify-devops.arn
  policy = data.aws_iam_policy_document.notify-devops.json
}

resource "aws_sns_topic_subscription" "notify-devops" {
  topic_arn                       = aws_sns_topic.notify-devops.arn
  protocol                        = "email"
  endpoint                        = "xxxx@xxxx"
  confirmation_timeout_in_minutes = 1
  endpoint_auto_confirms          = false
}

Steps to Reproduce

In my case some error happened on other step. I suppose SNS topic already was deleted. And when I rerun destroy again the terraform failed when tried to remove SNS topic second time.

So steps to reproduce

  1. Create SNS topic
  2. Create other resource
  3. Try to destroy cluster, but change it in a way the terraform fail after deleted SNS topic, eg. SNS topic is deleted but fail on other resource.
  4. Fix the problem, try to destroy cluster again to remove resources
  5. At this point terraform will try to delete SNS topic second time and fail. And will not try to delete resource which was created on step (2), because of earlier error.

Debug Output

╷
│ Error: reading SNS Topic (arn:aws:sns:us-east-2:315400321086:stg-enterprise-notify-devops): operation error SNS: GetTopicAttributes, https response error StatusCode: 400, RequestID: b8d7e0c7-8c1b-567f-8944-beb37666cb92, InvalidParameter: Invalid parameter: TopicArn
│
│ with module.private-cloud.aws_sns_topic.notify-devops,
│ on modules/private-cloud/sns.tf line 176, in resource "aws_sns_topic" "notify-devops":
│ 176: resource "aws_sns_topic" "notify-devops" {
│
╵

Panic Output

No response

Important Factoids

No response

References

hashicorp/terraform#34868

Would you like to implement a fix?

None
@EugenKon EugenKon added the bug Addresses a defect in current functionality. label Mar 20, 2024
@github-actions GitHub Actions
Copy link

Community Note

Voting for Prioritization

  • Please vote on this issue by adding a 👍 reaction to the original post to help the community and maintainers prioritize this request.
  • Please see our prioritization guide for information on how we prioritize.
  • Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request.

Volunteering to Work on This Issue

  • If you are interested in working on this issue, please leave a comment.
  • If this would be your first contribution, please review the contribution guide.

@github-actions github-actions bot added service/iam Issues and PRs that pertain to the iam service. service/sns Issues and PRs that pertain to the sns service. labels Mar 20, 2024
@terraform-aws-provider terraform-aws-provider bot added the needs-triage Waiting for first response or review from a maintainer. label Mar 20, 2024
@justinretzolk justinretzolk removed service/iam Issues and PRs that pertain to the iam service. needs-triage Waiting for first response or review from a maintainer. labels Mar 21, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
bug Addresses a defect in current functionality. service/sns Issues and PRs that pertain to the sns service.
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@justinretzolk @EugenKon