[Bug]: Error: updating CloudFormation StackSet Instance
Terraform Core Version
1.5.7
AWS Provider Version
5.62.0
Affected Resource(s)
aws_cloudformation_stack_set_instance
Expected Behavior
it should update the instance
Actual Behavior
on update it fails , with what I believe is an incorrect validation error on create its fine
the API is expecting an aws account number the code seems to give it the org-id despite it being given a list of accounts
Relevant Error/Panic Output Snippet
│ Error: updating CloudFormation StackSet Instance (DatadogForwarderStack,r-h130,eu-west-1): operation error CloudFormation: UpdateStackInstances, https response error StatusCode: 400, RequestID: b4fbd58a-e9c8-4454-93c4-3acf6bc27605, api error ValidationError: 1 validation error detected: Value '[r-h130]' at 'accounts' failed to satisfy constraint: Member must satisfy constraint: [Member must have length less than or equal to 12, Member must have length greater than or equal to 12, Member must satisfy regular expression pattern: ^[0-9]{12}$]Terraform Configuration Files
resource "aws_cloudformation_stack_set" "forwarder_stackset" {
name = var.datadog_forwarder_stackset_name
permission_model = "SERVICE_MANAGED"
capabilities = ["CAPABILITY_NAMED_IAM"]
auto_deployment {
enabled = true
retain_stacks_on_account_removal = false
}
operation_preferences {
region_concurrency_type = "PARALLEL"
failure_tolerance_count = 20
max_concurrent_count = 1
}
parameters = {
DdApiKeySecretArn = var.datadog_forwarder_api_secret_arn
DdSite = var.datadog_site
}
template_body = file("${path.module}/datadog_forwarder.yaml")
}
resource "aws_cloudformation_stack_set_instance" "forwarder_stackset" {
deployment_targets {
organizational_unit_ids = toset([data.aws_organizations_organization.organization.roots[0].id])
account_filter_type = "INTERSECTION"
accounts = var.datadog_forwarder_targets
}
region = var.region
stack_set_name = aws_cloudformation_stack_set.forwarder_stackset.name
timeouts {
create = "2h"
delete = "2h"
}
operation_preferences {
region_concurrency_type = "PARALLEL"
failure_tolerance_count = 20
max_concurrent_count = 1
}
}
var.datadog_forwarder_targets was a simple list of aws account numbers and at no point did it contain the org id that the validation triggers !
Steps to Reproduce
create the resource
terraform plan , apply etc
make a change such as add another account
apply
Debug Output
No response
Panic Output
No response
Important Factoids
it looks like a code change in the update a few months ago - I am not a go expert but the code path here looks off https://github.com/hashicorp/terraform-provider-aws/blob/main/internal/service/cloudformation/stack_set_instance.go#L410
References
No response
Would you like to implement a fix?
None
Source: hashicorp/terraform-provider-aws