plan detects changes in aws_ssm_parameter ARN when it shouldn't

[jrobison-sb]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform CLI and Terraform AWS Provider Version

Terraform v0.12.24
+ provider.aws v2.70.0

Affected Resource(s)

• aws_ssm_parameter

Terraform Configuration Files

Basically any resource which uses an ARN of an SSM parameter. Such as this example where data.aws_iam_policy_document uses an SSM ARN as part of building an IAM policy:

  statement {
    sid       = "GetMyParameter"
    actions   = ["ssm:GetParameter"]
    resources = [aws_ssm_parameter.my_parameter.arn]
  }

Expected Behavior

If the value of the parameter changes, it will only change the value, it won't recreate the SSM parameter or the ARN of the parameter. And thus the resources using the parameter ARN shouldn't report a change as part of terraform plan.

Actual Behavior

If the value of the parameter changes, any resources using the ARN of the parameter will show up in terraform plan and report that they will change.

Steps to Reproduce

1. Create an SSM parameter and use it's ARN in some other resource, such as in an IAM policy described above. Apply it.
2. Change the value of the parameter, which does not recreate the SSM parameter or change it's ARN. Run a plan.
3. The IAM policy (or whatever) resource will show up in the plan as if it was going to change, even though no change should be required.

[rmclaughlin-nelnet]

I see this issue quite often. Would love to see it fixed. For example, I changed the description of some SSM values and the plan indicated it would update all the IAM policies that used them.

[kamilturek]

I think it's no longer valid. I can't reproduce it.