aws_dms_replication_subnet_group resource created even after sanity check from API throwing an error

[Siebjee]

When you try to create a aws_dms_replication_subnet_group with it's replication_subnet_group_id accidentally containing underscores. The plan does not throw any error. And it will actually create your resource in AWS.
Yet the API throws an error.

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform CLI and Terraform AWS Provider Version

Affected Resource(s)

• aws_dms_replication_subnet_group

Terraform Configuration Files

Please include all Terraform configurations required to reproduce the bug. Bug reports without a functional reproduction may be closed without investigation.

terraform {
  required_version = "1.0.9"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "3.65.0"
    }
  }
}

resource "aws_dms_replication_subnet_group" "test" {
  replication_subnet_group_description = "Test replication subnet group"
  replication_subnet_group_id          = "lets_break_aws"

  subnet_ids = ["subnet-redacted-a", "subnet-redacted-b", "subnet-redacted-c"]

  tags = {
    Name = "test"
  }
}

Expected Behavior

Failing with the error and not creating the AWS resource

Actual Behavior

❯ terraform apply

Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols:
  + create

Terraform will perform the following actions:

  # aws_dms_replication_subnet_group.test will be created
  + resource "aws_dms_replication_subnet_group" "test" {
      + id                                   = (known after apply)
      + replication_subnet_group_arn         = (known after apply)
      + replication_subnet_group_description = "Test replication subnet group"
      + replication_subnet_group_id          = "lets_break_aws"
      + subnet_ids                           = [
          + "subnet-redacted-a",
          + "subnet-redacted-b",
          + "subnet-redacted-c",
        ]
      + tags                                 = {
          + "Name" = "test"
        }
      + tags_all                             = {
          + "Name" = "test"
        }
      + vpc_id                               = (known after apply)
    }

Plan: 1 to add, 0 to change, 0 to destroy.

Do you want to perform these actions?
  Terraform will perform the actions described above.
  Only 'yes' will be accepted to approve.

  Enter a value: yes

aws_dms_replication_subnet_group.test: Creating...
╷
│ Error: InvalidParameterValueException: The parameter Filter: replication-subnet-group-id is not a valid identifier. Identifiers must begin with a letter; must contain only ASCII letters, digits, and hyphens; and must not end with a hyphen or contain two consecutive hyphens.
│ 	status code: 400, request id: 12ca4d90-74b2-42cf-8704-e2b964c35609
│
│   with aws_dms_replication_subnet_group.test,
│   on test.tf line 1, in resource "aws_dms_replication_subnet_group" "test":
│    1: resource "aws_dms_replication_subnet_group" "test" {
│
╵

And yet the resource is created, therefor ended up in the state. Basically breaking your state & aws console :)

Steps to Reproduce

Apply the code above :)

1. terraform apply

Recovery notes

To recover: terraform state rm aws_dms_replication_subnet_group.test
And delete the resource in the AWS console from the subnet group overview.

Credit goes to @devopsz21 for finding this issue.

Edit: AWS Support ticket is raised too

[Siebjee]

Update: AWS Support confirmed the issue, and they will make changes on the DMS part.

From AWS Support:

I will like to sincerely appreciate for sharing these with us and have already shared the same with our Internal DMS Team for review so that the character limitation can be enforced during the DMS subnet group creation.

[ewbankkit]

Relates #5424.