aws_backup_region_settings: Element present in resource type opt in preference has invalid values

[ohmer]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Description

I have a module which contains the following:

variable "resource_type_opt_in_preference" {
  type = map(bool)

  default = {
    "Aurora"          = true
    "DocumentDB"      = true
    "DynamoDB"        = true
    "EBS"             = true
    "EC2"             = true
    "EFS"             = true
    "FSx"             = false
    "Neptune"         = false
    "RDS"             = true
    "Storage Gateway" = false
  }
}

resource "aws_backup_region_settings" "this" {
  resource_type_opt_in_preference = var.resource_type_opt_in_preference
}

It is part of a baseline and I would like it to apply to any region. It fails to apply in us-west-1 with the error message below:

│ Error: error setting Backup Region Settings (us-west-1): InvalidParameterValueException: Element present in resource type opt in preference has invalid values. Please use describeRegionSettings API to know the supported resource types
│ {
│   RespMetadata: {
│     StatusCode: 400,
│     RequestID: "<REDACTED>"
│   },
│   Code_: "ERROR_41007",
│   Message_: "Element present in resource type opt in preference has invalid values. Please use describeRegionSettings API to know the supported resource types"
│ }

I believe the root cause is the list of service differs by region:

$ aws backup describe-region-settings --region us-west-1
{
    "ResourceTypeOptInPreference": {
        "Aurora": true,
        "DynamoDB": true,
        "EBS": true,
        "EC2": true,
        "EFS": true,
        "FSx": true,
        "Neptune": false,
        "RDS": true,
        "Storage Gateway": true
    }
}

DocumentDB is not in us-west-1 but is in us-east-1

$ aws backup describe-region-settings --region us-east-1
{
    "ResourceTypeOptInPreference": {
        "Aurora": false,
        "DocumentDB": false,
        "DynamoDB": true,
        "EBS": true,
        "EC2": true,
        "EFS": true,
        "FSx": false,
        "Neptune": false,
        "RDS": true,
        "Storage Gateway": true
    }
}

New or Affected Resource(s)

• aws_backup_region_settings

Potential Terraform Configuration

Not tested but probably something like that:

variable "resource_type_opt_in_preference" {
  type = map(bool)

  default = {
    "Aurora"          = true
    "DocumentDB"      = true
    "DynamoDB"        = true
    "EBS"             = true
    "EC2"             = true
    "EFS"             = true
    "FSx"             = false
    "Neptune"         = false
    "RDS"             = true
    "Storage Gateway" = false
  }
}

data "aws_backup_region_settings" "this" {}

resource "aws_backup_region_settings" "this" {
  resource_type_opt_in_preference = matchkeys(
      values(var.resource_type_opt_in_preference),
      keys(var.resource_type_opt_in_preference),
      keys(data.aws_backup_region_settings.this.resource_type_opt_in_preference)
    )
  }
}

References

• Support Backup Region Settings #13449

[justinretzolk]

Hey @ohmer 👋 Thank you for taking the time to file this issue. In looking into it, it seems this is an error message coming back from the AWS API itself, rather than a bug within the provider (I suspect you've already deduced this). Based on the "potential Terraform configuration" section, it looks like you're interested in a new data source that uses the describeRegionSettings API to determine the supported settings; is that accurate?

[ohmer]

Hey @justinretzolk ,

New data source, yes it is a suggestion. I thought that silently handling this inside the resource would be less ideal. What do you think?

[snmason]

Bumping as I am hitting the same issue. Has a work around been found?

[lpiob]

It seems that the available settings are different for different regions. For example Timestream at this moment can be set for eu-west-1 but not for eu-west-3.

Skipping this setting causes perpetual change to be displayed in eu-west-1.
Including this setting causes an error on apply in eu-west-3.

[or-shachar]

I've started working on this feature that might at least answer the perpetual change issue.
#33993

Unfortunately I'm not at capacity to get into the acceptance testing framework.
If anyone would like to give me direction of missing pieces - would really appreciate it ✌️