[Bug]: aws_bedrockagent_agent resource fails to destroy when an alias created outside Terraform exists

[acwwat]

Terraform Core Version

1.6.6

AWS Provider Version

5.47.0

Affected Resource(s)

aws_bedrockagent_agent

Expected Behavior

Resource is destroyed successfully.

Actual Behavior

Resource fails to destroy with the error below.

Relevant Error/Panic Output Snippet

Updated: 2024-05-18: The resource is now returning a better error message:

╷
│ Error: deleting Bedrock Agent (7HNG5UEHZC)
│
│ operation error Bedrock Agent: DeleteAgent, https response error StatusCode: 409, RequestID: c654de85-1b5c-4907-b8c3-578d508f259b, ConflictException: Could  
│ not delete Agent with ID 7HNG5UEHZC, since it has active aliases
╵

aws_iam_role_policy.bedrock_agent_forex_asst: Destroying... [id=AmazonBedrockExecutionRoleForAgents_ForexAssistant:AmazonBedrockAgentBedrockFoundationModelPolicy_ForexAssistant]
aws_bedrockagent_agent.forex_asst: Destroying... [id=BJP8AZXZTV]
aws_iam_role_policy.bedrock_agent_forex_asst: Destruction complete after 0s
╷
│ Error: waiting for Bedrock Agent (BJP8AZXZTV) delete
│
│ unexpected state 'PREPARED', wanted target ''. last error: %!s(<nil>)
╵

Terraform Configuration Files

locals {
  model_id = "anthropic.claude-3-haiku-20240307-v1:0"
}

data "aws_caller_identity" "this" {}

data "aws_region" "this" {}

data "aws_iam_policy" "lambda_basic_execution" {
  name = "AWSLambdaBasicExecutionRole"
}

data "aws_bedrock_foundation_model" "this" {
  model_id = local.model_id
}

locals {
  account_id = data.aws_caller_identity.this.account_id
  region     = data.aws_region.this.name
}

resource "aws_iam_role" "bedrock_agent_forex_asst" {
  name = "AmazonBedrockExecutionRoleForAgents_ForexAssistant"
  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = "sts:AssumeRole"
        Effect = "Allow"
        Principal = {
          Service = "bedrock.amazonaws.com"
        }
        Condition = {
          StringEquals = {
            "aws:SourceAccount" = local.account_id
          }
          ArnLike = {
            "aws:SourceArn" = "arn:aws:bedrock:${local.region}:${local.account_id}:agent/*"
          }
        }
      }
    ]
  })
}

resource "aws_iam_role_policy" "bedrock_agent_forex_asst" {
  name = "AmazonBedrockAgentBedrockFoundationModelPolicy_ForexAssistant"
  role = aws_iam_role.bedrock_agent_forex_asst.name
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action   = "bedrock:InvokeModel"
        Effect   = "Allow"
        Resource = data.aws_bedrock_foundation_model.this.model_arn
      }
    ]
  })
}

resource "aws_bedrockagent_agent" "forex_asst" {
  agent_name              = "ForexAssistant"
  agent_resource_role_arn = aws_iam_role.bedrock_agent_forex_asst.arn
  description             = "An assisant that provides forex rate information."
  foundation_model        = data.aws_bedrock_foundation_model.this.model_id
  instruction             = "You are an assistant that looks up today's currency exchange rates. A user may ask you what the currency exchange rate is for one currency to another. They may provide either the currency name or the three-letter currency code. If they give you a name, you may first need to first look up the currency code by its name."
}

Steps to Reproduce

1. Ensure that you have requested access to the Claude 3 Haiku model.
2. Initialize and apply the Terraform configuration above to create the resources.
3. In the AWS Management Console, open the agent in the Bedrock console.
4. Create a new alias, for example beta.
5. Run terraform destroy and see that it fails with the error message.

Debug Output

No response

Panic Output

No response

Important Factoids

I am able to delete the agent in the AWS Management Console, so I think the Terraform resource should be able to do the same.

References

No response

Would you like to implement a fix?

None

[github-actions]

Community Note

Voting for Prioritization

• Please vote on this issue by adding a 👍 reaction to the original post to help the community and maintainers prioritize this request.
• Please see our prioritization guide for information on how we prioritize.
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request.

Volunteering to Work on This Issue

• If you are interested in working on this issue, please leave a comment.
• If this would be your first contribution, please review the contribution guide.

[acwwat]

Similar to that of action group, the DeleteAgent API has a SkipResourceInUseCheck flag that can force the deletion. Adding support for this flag will address the issue, so I'll work on it.