Terraform: Odd error - Error Getting CloudWatch Logs Tag List: %s

[james-gonzalez]

Good morning,

After upgrading from 0.8.4 to 0.8.5 everything is fine, except the following error.

Terraform Version

0.8.5
Note: With Terragrunt 0.9.9

Affected Resource(s)

aws_cloudwatch_log_group

If this issue appears to affect multiple resources, it may be an issue with Terraform's core, so please mention this.

Terraform Configuration Files

resource "aws_cloudwatch_log_group" "cloudtrail" {
  name              = "cloudtrail"
  retention_in_days = 90
}

Expected Behavior

It should just want to create a log grup called "cloudtrail" in AWS CloudWatch. (it's just a plan)

Actual Behavior

It errors out with:
* aws_cloudwatch_log_group.cloudtrail: Error Getting CloudWatch Logs Tag List: %s

Steps to Reproduce

terraform init-no-refresh
terraform plan

Important Factoids

IAM permissions are generic, arn:aws:iam:aws:policy/ReadOnlyAccess

If I run using full AWS permissions, it works fine. (even with init-no-refresh).

Nothing has changed except Terraform and Terragrunt versions.

[chhuang0123]

0.8.6 also has this issue.

[james-gonzalez]

Yep, still there.

[st33v]

Same here but using the 'arn:aws-us-gov:iam:aws:policy/AdministratorAccess' policy.

[okzk]

In my workaround, add the "logs:ListTagsLogGroup" permission, then it works fine.
(I think the ReadOnlyAccess permissons should include this permission...)

[james-gonzalez]

@okzk Thanks, I'll try adding that. I can see the ReadOnly policy only includes:
"logs:Describe*", "logs:Get*", "logs:FilterLogEvents", "logs:TestMetricFilter",

Update: I can confirm that this does fix the problem. I've added logs:ListTagsLogGroup to my read-only role which I use on my CI tool and looks like I am back in business for code checks on commit.

[stack72]

Hi @cultavix

Thanks for the issue report here - it looks like the specific error has been updated to not try and force a string

The error message was updated to

return nil, errwrap.Wrapf("Error Getting CloudWatch Logs Tag List: {{err}}", err)

Please do let me know if you still get the same error going forward

Thanks

Paul

[hashibot[bot]]

I'm going to lock this issue because it has been closed for _30 days_ ⏳. This helps our maintainers find and focus on the active issues.

If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.