Terraform-provider-aws: aws_ses_receipt_rule fails when kms_key_arn is not specified

[plutino]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform Version

Terraform v0.11.7
+ provider.aws v1.24.0

Affected Resource(s)

• aws_ses_receipt_rule

Terraform Configuration Files

resource "aws_ses_receipt_rule" "main" {
  rule_set_name = "incoming_email_rule_set"
  name          = "incoming_email"
  recipients    = ["example.com"]
  enabled       = true
  scan_enabled  = true

  s3_action {
    position          = 1
    bucket_name       = "incoming_email_bucket"
  }
}

# Copy-paste your Terraform configurations here - for large Terraform configs,
# please use a service like Dropbox and share a link to the ZIP file. For
# security, you can also encrypt the files using our GPG public key: https://keybase.io/hashicorp

Debug Output

2018-06-22T14:49:37.318-0700 [DEBUG] plugin.terraform-provider-aws_v1.24.0_x4: 2018/06/22 14:49:37 [DEBUG] [aws-sdk-go] DEBUG: Request email/CreateReceiptRule Details:
2018-06-22T14:49:37.318-0700 [DEBUG] plugin.terraform-provider-aws_v1.24.0_x4: ---[ REQUEST POST-SIGN ]-----------------------------
  recipients.#:                            "" => "1"
2018-06-22T14:49:37.318-0700 [DEBUG] plugin.terraform-provider-aws_v1.24.0_x4: POST / HTTP/1.1
2018-06-22T14:49:37.318-0700 [DEBUG] plugin.terraform-provider-aws_v1.24.0_x4: Host: email.us-east-1.amazonaws.com
2018-06-22T14:49:37.318-0700 [DEBUG] plugin.terraform-provider-aws_v1.24.0_x4: User-Agent: aws-sdk-go/1.14.8 (go1.9.2; darwin; amd64) APN/1.0 HashiCorp/1.0 Terraform/0.11.7
2018-06-22T14:49:37.318-0700 [DEBUG] plugin.terraform-provider-aws_v1.24.0_x4: Content-Length: 534
2018-06-22T14:49:37.318-0700 [DEBUG] plugin.terraform-provider-aws_v1.24.0_x4: Authorization: AWS4-HMAC-SHA256 Credential=ASIAIH6NWPYPRXPDN5HQ/20180622/us-east-1/ses/aws4_request, SignedHeaders=content-length;content-type;host;x-amz-date;x-amz-security-token, Signature=******************************************************************
2018-06-22T14:49:37.318-0700 [DEBUG] plugin.terraform-provider-aws_v1.24.0_x4: Content-Type: application/x-www-form-urlencoded; charset=utf-8
2018-06-22T14:49:37.318-0700 [DEBUG] plugin.terraform-provider-aws_v1.24.0_x4: X-Amz-Date: 20180622T214937Z
  recipients.3816381997:                   "" => "example.com"
2018-06-22T14:49:37.318-0700 [DEBUG] plugin.terraform-provider-aws_v1.24.0_x4: X-Amz-Security-Token: ************************************************************
2018-06-22T14:49:37.318-0700 [DEBUG] plugin.terraform-provider-aws_v1.24.0_x4: Accept-Encoding: gzip
2018-06-22T14:49:37.318-0700 [DEBUG] plugin.terraform-provider-aws_v1.24.0_x4: 
2018-06-22T14:49:37.318-0700 [DEBUG] plugin.terraform-provider-aws_v1.24.0_x4: Action=CreateReceiptRule&Rule.Actions.member.1.S3Action.BucketName=incoming_email_bucket&Rule.Actions.member.1.S3Action.KmsKeyArn=&Rule.Actions.member.1.S3Action.ObjectKeyPrefix=&Rule.Enabled=true&Rule.Name=incoming_email&Rule.Recipients.member.1=example.com&Rule.ScanEnabled=true&RuleSetName=incoming_email_rule_set&Version=2010-12-01
2018-06-22T14:49:37.318-0700 [DEBUG] plugin.terraform-provider-aws_v1.24.0_x4: -----------------------------------------------------
  rule_set_name:                           "" => "incoming_email_rule_set"
  s3_action.#:                             "" => "1"
  s3_action.2175499855.bucket_name:        "" => "incoming_email_bucket"
  s3_action.2175499855.kms_key_arn:        "" => ""
  s3_action.2175499855.object_key_prefix:  "" => ""
  s3_action.2175499855.position:           "" => "1"
  s3_action.2175499855.topic_arn:          "" => ""
  scan_enabled:                            "" => "true"
  tls_policy:                              "" => "<computed>"
2018-06-22T14:49:37.656-0700 [DEBUG] plugin.terraform-provider-aws_v1.24.0_x4: 2018/06/22 14:49:37 [DEBUG] [aws-sdk-go] DEBUG: Response email/CreateReceiptRule Details:
2018-06-22T14:49:37.656-0700 [DEBUG] plugin.terraform-provider-aws_v1.24.0_x4: ---[ RESPONSE ]--------------------------------------
2018-06-22T14:49:37.656-0700 [DEBUG] plugin.terraform-provider-aws_v1.24.0_x4: HTTP/1.1 400 Bad Request
2018-06-22T14:49:37.656-0700 [DEBUG] plugin.terraform-provider-aws_v1.24.0_x4: Connection: close
2018-06-22T14:49:37.656-0700 [DEBUG] plugin.terraform-provider-aws_v1.24.0_x4: Content-Length: 284
2018-06-22T14:49:37.656-0700 [DEBUG] plugin.terraform-provider-aws_v1.24.0_x4: Content-Type: text/xml
2018-06-22T14:49:37.656-0700 [DEBUG] plugin.terraform-provider-aws_v1.24.0_x4: Date: Fri, 22 Jun 2018 21:49:37 GMT
2018-06-22T14:49:37.656-0700 [DEBUG] plugin.terraform-provider-aws_v1.24.0_x4: X-Amzn-Requestid: 28ada35a-7666-11e8-b98c-899fd8125e39
2018-06-22T14:49:37.656-0700 [DEBUG] plugin.terraform-provider-aws_v1.24.0_x4: 
2018-06-22T14:49:37.656-0700 [DEBUG] plugin.terraform-provider-aws_v1.24.0_x4: 
2018-06-22T14:49:37.656-0700 [DEBUG] plugin.terraform-provider-aws_v1.24.0_x4: -----------------------------------------------------
2018-06-22T14:49:37.656-0700 [DEBUG] plugin.terraform-provider-aws_v1.24.0_x4: 2018/06/22 14:49:37 [DEBUG] [aws-sdk-go] <ErrorResponse xmlns="http://ses.amazonaws.com/doc/2010-12-01/">
2018-06-22T14:49:37.656-0700 [DEBUG] plugin.terraform-provider-aws_v1.24.0_x4:   <Error>
2018-06-22T14:49:37.656-0700 [DEBUG] plugin.terraform-provider-aws_v1.24.0_x4:     <Type>Sender</Type>
2018-06-22T14:49:37.656-0700 [DEBUG] plugin.terraform-provider-aws_v1.24.0_x4:     <Code>InvalidParameterValue</Code>
2018/06/22 14:49:37 [TRACE] root.main-region: eval: *terraform.EvalWriteState
2018-06-22T14:49:37.656-0700 [DEBUG] plugin.terraform-provider-aws_v1.24.0_x4:     <Message>Invalid KMS encryption key ARN: </Message>
2018/06/22 14:49:37 [TRACE] root.main-region: eval: *terraform.EvalApplyProvisioners
2018/06/22 14:49:37 [TRACE] root.main-region: eval: *terraform.EvalIf
2018/06/22 14:49:37 [TRACE] root.main-region: eval: *terraform.EvalWriteState
2018/06/22 14:49:37 [TRACE] root.main-region: eval: *terraform.EvalWriteDiff
2018-06-22T14:49:37.656-0700 [DEBUG] plugin.terraform-provider-aws_v1.24.0_x4:   </Error>
2018/06/22 14:49:37 [DEBUG] plugin: waiting for all plugin processes to complete...

Error: Error applying plan:

1 error(s) occurred:

* module.main-region.aws_ses_receipt_rule.main: 1 error(s) occurred:

* aws_ses_receipt_rule.main: Error creating SES rule: InvalidParameterValue: Invalid KMS encryption key ARN: 
    status code: 400, request id: 28ada35a-7666-11e8-b98c-899fd8125e39

Panic Output

Expected Behavior

AWS create a ses_receipt_rule resource with a S3 action writing to a S3 bucket without encryption

Actual Behavior

AWS treated the Rule.Actions.member.1.S3Action.KmsKeyArn parameter as having an empty string value. It seems that AWS expects the parameter not to be set if it means to be not set.

Steps to Reproduce

1. terraform apply

Important Factoids

References

• #0000

[ebarault]

this is a duplicate of #4906

[saravanan30erd]

submitted PR #4965

[bflad]

The fix for this has been merged into master and will release with version 1.25.0 of the AWS provider, likely middle of this week.

[bflad]

This has been released in version 1.25.0 of the AWS provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

[ebarault]

tested, i confirm it now works. And in addition, passing "" for the kms_key results in the provided not passing the param. thanks for landing this !

[hashibot[bot]]

I'm going to lock this issue because it has been closed for _30 days_ ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thanks!