KMS doesn't work with newest verision of provider

[asiekkowa]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform CLI and Terraform AWS Provider Version

0.14.7

Affected Resource(s)

• aws_kms_key

Terraform Configuration Files

tested with below aws providers:
3.49 - works
3.53 - does not work
3.54 - does not work

Debug Output

Panic Output

Expected Behavior

aws_iam_policy.kms: Creation complete after 1s [id=arn:aws:iam::.....]

Actual Behavior

Error: error waiting for KMS Key (...) policy propagation: timeout while waiting for state to become 'TRUE' (last state: 'FALSE', timeout: 2m0s)

  on kms.tf line 1, in resource "aws_kms_key" "tg":

   1: resource "aws_kms_key" "tg" {

Steps to Reproduce

1. terraform apply

Important Factoids

References

• #0000

[borisvezmar]

I have this issue too. AWS provider version 3.54.0, Terraform version 1.0.4

[borisvezmar]

Can you look into this?

[borisvezmar]

tested with newest provider. Still facing the same issue. Provider ver. 3.55

[dzandt]

Am also having this issue. Need to test if the problem resolves with 3.49. Will report back.

[IvanMoucha]

I can confirm the same problem.

Terraform CLI version: 1.0.5
AWS module version: 3.55

Tested down to version 3.52, and this is the latest version which is working fine and as expected.

module.kms-logs-aws.aws_kms_key.kms-logs-aws: Creating...
module.kms-logs-aws.aws_kms_key.kms-logs-aws: Still creating... [10s elapsed]
module.kms-logs-aws.aws_kms_key.kms-logs-aws: Still creating... [20s elapsed]
module.kms-logs-aws.aws_kms_key.kms-logs-aws: Still creating... [30s elapsed]
module.kms-logs-aws.aws_kms_key.kms-logs-aws: Still creating... [40s elapsed]
module.kms-logs-aws.aws_kms_key.kms-logs-aws: Still creating... [50s elapsed]
module.kms-logs-aws.aws_kms_key.kms-logs-aws: Still creating... [1m0s elapsed]
module.kms-logs-aws.aws_kms_key.kms-logs-aws: Still creating... [1m10s elapsed]
module.kms-logs-aws.aws_kms_key.kms-logs-aws: Still creating... [1m20s elapsed]
module.kms-logs-aws.aws_kms_key.kms-logs-aws: Still creating... [1m30s elapsed]
module.kms-logs-aws.aws_kms_key.kms-logs-aws: Still creating... [1m40s elapsed]
module.kms-logs-aws.aws_kms_key.kms-logs-aws: Still creating... [1m50s elapsed]
module.kms-logs-aws.aws_kms_key.kms-logs-aws: Still creating... [2m0s elapsed]
module.kms-logs-aws.aws_kms_key.kms-logs-aws: Still creating... [2m10s elapsed]
module.kms-logs-aws.aws_kms_key.kms-logs-aws: Still creating... [2m20s elapsed]
╷
│ Error: error waiting for KMS Key (6bd7f396-fc11-4d38-8da9-7bf512186584) tag propagation: timeout while waiting for state to become 'TRUE' (last state: 'FALSE', timeout: 2m0s)
│
│ with module.kms-logs-aws.aws_kms_key.kms-logs-aws,
│ on ../../modules/kms/logs-aws/kms.tf line 1, in resource "aws_kms_key" "kms-logs-aws":
│ 1: resource "aws_kms_key" "kms-logs-aws" {

Base TF is simple:

resource "aws_kms_key" "kms-logs-aws" {
  description = "KMS key for S3 AWS logs storage"

  enable_key_rotation = true

  policy = <<POLICY
{
// Policy is here, redacted
}
POLICY

  tags = merge(var.tags, {
    Name = "team-kms-logs-aws-${var.env}"
  })
}

resource "aws_kms_alias" "kms-logs-aws--alias" {
  name = "alias/team-kms-logs-aws-${var.env}"
  target_key_id = aws_kms_key.kms-logs-aws.key_id
}

[dzandt]

Didn't have to go back to 3.49 because using 3.52 resolves the issue. When looking at the release notes for 3.53 there was some functionality added to the aws_kms_key resource. When I tested 3.53 it fails on KMS creation with the same error(s) as 3.55 (current as of this writing).

Functionality added to 3.53 (pasted from release notes)
resource/aws_kms_external_key: Add bypass_policy_lockout_safety_check argument (#18117)
resource/aws_kms_key: Add bypass_policy_lockout_safety_check argument (#18117)

[ghost]

Adding to @dzandt 's experience: Had the same issue, also works fine with 3.52

[westfood]

It's still affecting hashicorp/aws v3.57.0

[tgip-work]

Also 3.58.0 is affected somehow in different combinations but not all the time.
It seems that setting enable_key_rotation and providing tags causes a problem.

See test scenarios below:

Working 1 (description only)

resource "aws_kms_key" "this" {
  description = "Some description"
}

aws_kms_key.this: Creating...
aws_kms_key.this: Creation complete after 1s [id=777fcd30-dc0c-487a-a42e-b7b4c359e73e]

Working 2 (description AND tags)

resource "aws_kms_key" "this" {
  description = "Some description"
  tags =  {
    Name = "tf-provider-test"
  }
}

aws_kms_key.this: Creating...
aws_kms_key.this: Creation complete after 6s [id=bc64c1e8-630a-49ea-a030-17c1c1529688]

Working 3 (description, enable_key_rotation, NO tags)

resource "aws_kms_key" "this" {
  description = "Some description"
  enable_key_rotation = true
}

aws_kms_key.this: Creating...
aws_kms_key.this: Creation complete after 6s [id=f8f7726e-d15d-4767-a485-f69d7098accb]

Working 4 (description, enable_key_rotation, policy, NO tags)

resource "aws_kms_key" "this" {
  description = "Some description"
  enable_key_rotation = true
  policy = <<POLICY
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "Allow direct access to key metadata to the account",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::${var.account_id}:root"
            },
            "Action": "kms:*",
            "Resource": "*"
        }
    ]
}
POLICY
}

aws_kms_key.this: Creating...
aws_kms_key.this: Creation complete after 10s [id=d6ba1227-66d2-4b71-85d4-eaecb566a712]

Not working 1 (description, enable_key_rotation and tags)

resource "aws_kms_key" "this" {
  description = "Some description"

  enable_key_rotation = true

  tags =  {
    Name = "tf-provider-test"
  }
}

aws_kms_key.this: Creating...
aws_kms_key.this: Still creating... [10s elapsed]
(...)
aws_kms_key.this: Still creating... [2m0s elapsed]
╷
│ Error: error waiting for KMS Key (c116ac55-ce22-4990-880c-45c2d3e3c990) tag propagation: timeout while waiting for state to become 'TRUE' (last state: 'FALSE', timeout: 2m0s)
│ 
│   with aws_kms_key.this,
│   on eks copy.tf line 1, in resource "aws_kms_key" "this":
│    1: resource "aws_kms_key" "this" {

Not working 2 (description, enable_key_rotation, tags and policy):

resource "aws_kms_key" "this" {
  description = "Some description"

  enable_key_rotation = true

  policy = <<POLICY
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "Allow direct access to key metadata to the account",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::${var.account_id}:root"
            },
            "Action": "kms:*",
            "Resource": "*"
        }
    ]
}
POLICY

  tags =  {
    Name = "tf-provider-test"
  }
}

aws_kms_key.this: Creating...
aws_kms_key.this: Still creating... [10s elapsed]
(.......)
aws_kms_key.this: Still creating... [2m10s elapsed]
│ Error: error waiting for KMS Key (abe4656f-f887-4c5f-9cbc-b792e5026966) tag propagation: timeout while waiting for state to become 'TRUE' (last state: 'FALSE', timeout: 2m0s)
│ 
│   with aws_kms_key.this,
│   on eks copy.tf line 1, in resource "aws_kms_key" "this":
│    1: resource "aws_kms_key" "this" {

[vat-gatepost-BARQUE]

rolling back to 3.52 also fixed the issue for me.

[github-actions]

This functionality has been released in v3.59.0 of the Terraform AWS Provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template. Thank you!

[hligit]

I'm still seeing this error with 3.59.0. (Terraform 1.0.2).

error waiting for KMS Key (...) policy propagation: timeout while waiting for state to become 'TRUE' (last state: 'FALSE', timeout: 5m0s)

[vat-gatepost-BARQUE]

I am also seeing the same.. I had to go back to 3.52 again.

[andresvia]

Can somebody tell us what is exactly "policy propagation", I don't see it documented anywhere...

[Kaydub00]

I'm also still seeing this error in 3.60

[AshMenhennett]

Still seeing this error in 3.61.

Issue was:

• Creating key w/ inline policy with two statements (one for account lockout and one for XYZ)
• Ran the plan twice with same errors as above.

Tried removing the second statement in the policy (leaving just the account lockout statement) and it created the key w/ policy.

Tried making an update to the policy by adding second statement back but apply operation fails to complete successfully, same errors as above.

[oaksenov]

yep, definitely still happening on 3.62 version of provider as well

[oaksenov]

we should probably open new issue as this issue is closed and I doubt anybody is paying attention to the chat in closed issues

[AshMenhennett]

Heya @oaksenov

Opened #21225 to continue the discussion.

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.