Tf changing the identity schema without updating the identity schema version

[balajiramasamy007]

Terraform and AWS Provider Version

Terraform v1.12.2
on linux_amd64
+ provider registry.terraform.io/hashicorp/aws v5.100.0
+ provider registry.terraform.io/hashicorp/helm v2.17.0
+ provider registry.terraform.io/hashicorp/kubernetes v2.38.0
+ provider registry.terraform.io/hashicorp/local v2.5.3
+ provider registry.terraform.io/hashicorp/null v3.2.4
+ provider registry.terraform.io/hashicorp/time v0.13.1
+ provider registry.terraform.io/hashicorp/tls v4.1.0

Your version of Terraform is out of date! The latest version
is 1.13.1. You can update by downloading from https://developer.hashicorp.com/terraform/install

provider "aws" {
  source  = "hashicorp/aws"
  version = "5.100.0"
}

Affected Resource(s) or Data Source(s)

aws_iam_role

aws_iam_role_policy_attachment

aws_iam_policy

aws_launch_template

aws_launch_configuration

aws_eks_node_group

aws_iam_openid_connect_provider

aws_eks_addon

Expected Behavior

Terraform should decode resources from state without error when using a compatible provider version.

Actual Behavior

Terraform fails to decode resources due to identity schema mismatches, despite using AWS provider version 5.100.0, which satisfies the constraint >= 5.30.0, < 6.0.0.

Relevant Error/Panic Output

Error decoding "aws_iam_role.role": failed to decode identity: unsupported attribute "account_id"
Error decoding "aws_launch_template.launch_template-green": unsupported attribute "region"
Error decoding "aws_iam_policy.policy": failed to decode identity: unsupported attribute "arn"
Warning: Failed to decode resource from state
│ Error decoding "module.eks-cluster.module.efs-irsa[0].module.irsa_role.aws_iam_role_policy_attachment.policy_attachment[\"efs-csi-iam-policy\"]" from prior state: failed to decode identity: unsupported
│ attribute "account_id". This is most likely a bug in the Provider, providers must not change the identity schema without updating the identity schema version
╵
╷
│ Warning: Failed to decode resource from state
│
│ Error decoding "module.eks-cluster.module.efs-irsa[0].module.irsa_role.aws_iam_policy.policy[\"efs-csi-iam-policy\"]" from prior state: failed to decode identity: unsupported attribute "arn". This is
│ most likely a bug in the Provider, providers must not change the identity schema without updating the identity schema version
╵
╷
│ Warning: Failed to decode resource from state
│
│ Error decoding "module.eks-cluster.aws_launch_template.managed_launch_template-green" from prior state: unsupported attribute "region"
╵
╷
│ Warning: Failed to decode resource from state
│
│ Error decoding "module.eks-cluster.aws_launch_template.launch_template_managed[\"green-ondemand\"]" from prior state: unsupported attribute "region"
╵
╷
│ Warning: Failed to decode resource from state
│
│ Error decoding "module.eks-cluster.aws_iam_openid_connect_provider.oidc_provider" from prior state: failed to decode identity: unsupported attribute "arn". This is most likely a bug in the Provider,
│ providers must not change the identity schema without updating the identity schema version
╵
╷
│ Warning: Failed to decode resource from state
│
│ Error decoding "module.eks-cluster.aws_launch_template.managed_launch_template-blue" from prior state: unsupported attribute "region"
╵
╷
│ Warning: Failed to decode resource from state
│
│ Error decoding "module.eks-cluster.aws_iam_role_policy_attachment.node_tfsaws-base-ec2-policy" from prior state: failed to decode identity: unsupported attribute "account_id". This is most likely a bug
│ in the Provider, providers must not change the identity schema without updating the identity schema version
╵
╷
│ Warning: Failed to decode resource from state
│
│ Error decoding "module.eks-cluster.aws_iam_role_policy_attachment.node_AmazonEKSWorkerNodePolicy" from prior state: failed to decode identity: unsupported attribute "account_id". This is most likely a
│ bug in the Provider, providers must not change the identity schema without updating the identity schema version
╵
╷
│ Warning: Failed to decode resource from state
│
│ Error decoding "module.eks-cluster.aws_iam_role_policy_attachment.node_AmazonEC2ContainerRegistryReadOnly" from prior state: failed to decode identity: unsupported attribute "account_id". This is most
│ likely a bug in the Provider, providers must not change the identity schema without updating the identity schema version
╵
╷
│ Warning: Failed to decode resource from state
│
│ Error decoding "module.eks-cluster.aws_eks_node_group.workers_managed[\"green-ondemand\"]" from prior state: unsupported attribute "region"
╵
╷
│ Warning: Failed to decode resource from state
│
│ Error decoding "module.eks-cluster.aws_launch_configuration.launch_configuration-green" from prior state: unsupported attribute "region"
╵
╷
│ Warning: Failed to decode resource from state
│
│ Error decoding "module.eks-cluster.aws_launch_template.launch_template-blue" from prior state: unsupported attribute "region"
╵
╷
│ Warning: Failed to decode resource from state
│
│ Error decoding "module.eks-cluster.aws_iam_role_policy_attachment.node_AmazonEKS_CNI_Policy" from prior state: failed to decode identity: unsupported attribute "account_id". This is most likely a bug in
│ the Provider, providers must not change the identity schema without updating the identity schema version
╵
╷
│ Warning: Failed to decode resource from state
│
│ Error decoding "module.eks-cluster.aws_iam_role.node_iam_role" from prior state: failed to decode identity: unsupported attribute "account_id". This is most likely a bug in the Provider, providers must
│ not change the identity schema without updating the identity schema version
╵
╷
│ Warning: Failed to decode resource from state
│
│ Error decoding "module.eks-cluster.aws_launch_template.managed_launch_template-green-ondemand" from prior state: unsupported attribute "region"

Sample Terraform Configuration

terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5.30.0, < 6.0.0"
    }
  }
}

provider "aws" {
  region = "us-west-2"
}

resource "aws_iam_role" "example" {
  name = "example-role"

  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Action = "sts:AssumeRole"
      Effect = "Allow"
      Principal = {
        Service = "ec2.amazonaws.com"
      }
    }]
  })
}

resource "aws_iam_policy" "example_policy" {
  name        = "example-policy"
  description = "Example policy"
  policy      = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Action   = ["ec2:DescribeInstances"]
      Effect   = "Allow"
      Resource = "*"
    }]
  })
}

resource "aws_iam_role_policy_attachment" "example_attach" {
  role       = aws_iam_role.example.name
  policy_arn = aws_iam_policy.example_policy.arn
}

resource "aws_launch_template" "example_lt" {
  name_prefix   = "example-lt-"
  image_id      = "ami-0abcdef1234567890"
  instance_type = "t3.micro"
}

Steps to Reproduce

Steps to Reproduce

1. Create a Terraform configuration that includes AWS resources such as:
   aws_iam_role
   aws_iam_role_policy_attachment
   aws_iam_policy
   aws_launch_template
   aws_eks_node_group
   aws_iam_openid_connect_provider

2.Initialize Terraform with a recent version of the AWS provider (e.g., 5.100.0) and apply the configuration to generate the state.

bash
terraform init
terraform apply

3.Commit the .terraform.lock.hcl file to version control.

4.On a fresh machine or workspace, clone the configuration and run:

bash
terraform init -upgrade
terraform plan

5.Observe decoding errors such as:

Code

Error decoding "aws_iam_role.role": failed to decode identity: unsupported attribute "account_id"
Error decoding "aws_launch_template.launch_template-green": unsupported attribute "region"
Error decoding "aws_iam_policy.policy": failed to decode identity: unsupported attribute "arn"

6.Attempting to run terraform plan -target=... on unaffected modules still triggers decoding errors from unrelated resources in the state.

Debug Logging

│ Warning: Failed to decode resource from state
│
│ Error decoding "module.eks-cluster.aws_iam_role_policy_attachment.node_tfsaws-base-ec2-policy" from prior state: failed to decode identity: unsupported attribute "account_id". This is most likely a bug
│ in the Provider, providers must not change the identity schema without updating the identity schema version
╵
╷
│ Warning: Failed to decode resource from state
│
│ Error decoding "module.eks-cluster.aws_launch_template.launch_template-green" from prior state: unsupported attribute "region"
╵
╷
│ Warning: Failed to decode resource from state
│
│ Error decoding "module.eks-cluster.aws_iam_openid_connect_provider.oidc_provider" from prior state: failed to decode identity: unsupported attribute "arn". This is most likely a bug in the Provider,
│ providers must not change the identity schema without updating the identity schema version
╵
╷
│ Warning: Failed to decode resource from state
│
│ Error decoding "module.eks-cluster.aws_iam_role_policy_attachment.node_AmazonEKSWorkerNodePolicy" from prior state: failed to decode identity: unsupported attribute "account_id". This is most likely a
│ bug in the Provider, providers must not change the identity schema without updating the identity schema version
╵
╷
│ Warning: Failed to decode resource from state
│
│ Error decoding "module.eks-cluster.aws_iam_role_policy_attachment.node_AmazonEKS_CNI_Policy" from prior state: failed to decode identity: unsupported attribute "account_id". This is most likely a bug in
│ the Provider, providers must not change the identity schema without updating the identity schema version
╵
╷
│ Warning: Failed to decode resource from state
│
│ Error decoding "module.eks-cluster.aws_launch_configuration.launch_configuration-green" from prior state: unsupported attribute "region"
╵
╷
│ Warning: Failed to decode resource from state
│
│ Error decoding "module.eks-cluster.aws_eks_node_group.workers_managed[\"green-ondemand\"]" from prior state: unsupported attribute "region"
╵
╷
│ Warning: Failed to decode resource from state
│
│ Error decoding "module.eks-cluster.aws_launch_configuration.launch_configuration-blue" from prior state: unsupported attribute "region"
╵
╷
│ Warning: Failed to decode resource from state
│
│ Error decoding "module.eks-cluster.aws_iam_role_policy_attachment.node_AmazonEC2ContainerRegistryReadOnly" from prior state: failed to decode identity: unsupported attribute "account_id". This is most
│ likely a bug in the Provider, providers must not change the identity schema without updating the identity schema version
╵
╷
│ Warning: Failed to decode resource from state
│
│ Error decoding "module.eks-cluster.aws_iam_role.node_iam_role" from prior state: failed to decode identity: unsupported attribute "account_id". This is most likely a bug in the Provider, providers must
│ not change the identity schema without updating the identity schema version
╵
╷
│ Warning: Failed to decode resource from state
│
│ Error decoding "module.eks-cluster.aws_launch_template.launch_template-blue" from prior state: unsupported attribute "region"
╵
╷
│ Warning: Failed to decode resource from state
│
│ Error decoding "module.eks-cluster.module.efs_addon[0].aws_eks_addon.add_on" from prior state: unsupported attribute "region"
╵
╷
│ Warning: Failed to decode resource from state
│
│ Error decoding "module.eks-cluster.module.efs-irsa[0].module.irsa_role.aws_iam_role_policy_attachment.aws_managed_policies_policy_attachment[\"service-role/AmazonEFSCSIDriverPolicy\"]" from prior state:
│ failed to decode identity: unsupported attribute "account_id". This is most likely a bug in the Provider, providers must not change the identity schema without updating the identity schema version
╵
╷
│ Warning: Failed to decode resource from state
│
│ Error decoding "module.eks-cluster.module.efs-irsa[0].module.irsa_role.aws_iam_role_policy_attachment.policy_attachment[\"efs-csi-iam-policy\"]" from prior state: failed to decode identity: unsupported
│ attribute "account_id". This is most likely a bug in the Provider, providers must not change the identity schema without updating the identity schema version
╵
╷
│ Warning: Failed to decode resource from state
│
│ Error decoding "module.eks-cluster.module.efs-irsa[0].module.irsa_role.aws_iam_policy.policy[\"efs-csi-iam-policy\"]" from prior state: failed to decode identity: unsupported attribute "arn". This is
│ most likely a bug in the Provider, providers must not change the identity schema without updating the identity schema version
╵
╷
│ Warning: Failed to decode resource from state
│
│ Error decoding "module.eks-cluster.module.efs-irsa[0].module.irsa_role.aws_iam_role.role" from prior state: failed to decode identity: unsupported attribute "account_id". This is most likely a bug in the
│ Provider, providers must not change the identity schema without updating the identity schema version
╵
╷
│ Warning: Failed to decode resource from state
│
│ Error decoding "module.eks-cluster.module.alb-controller-irsa[0].module.irsa_role.aws_iam_role_policy_attachment.policy_attachment[\"alb-controller-iam-policy\"]" from prior state: failed to decode
│ identity: unsupported attribute "account_id". This is most likely a bug in the Provider, providers must not change the identity schema without updating the identity schema version
╵
╷
│ Warning: Failed to decode resource from state
│
│ Error decoding "module.eks-cluster.module.alb-controller-irsa[0].module.irsa_role.aws_iam_policy.policy[\"alb-controller-iam-policy\"]" from prior state: failed to decode identity: unsupported attribute
│ "arn". This is most likely a bug in the Provider, providers must not change the identity schema without updating the identity schema version
╵
╷
│ Warning: Failed to decode resource from state
│
│ Error decoding "module.eks-cluster.module.alb-controller-irsa[0].module.irsa_role.aws_iam_role.role" from prior state: failed to decode identity: unsupported attribute "account_id". This is most likely a
│ bug in the Provider, providers must not change the identity schema without updating the identity schema version
╵
╷
│ Error: failed to decode identity: unsupported attribute "arn". This is most likely a bug in the Provider, providers must not change the identity schema without updating the identity schema version
│
│
╵
╷
│ Error: failed to decode identity: unsupported attribute "account_id". This is most likely a bug in the Provider, providers must not change the identity schema without updating the identity schema version
│
│
╵
╷
│ Error: failed to decode identity: unsupported attribute "arn". This is most likely a bug in the Provider, providers must not change the identity schema without updating the identity schema version
│
│
╵
╷
│ Error: failed to decode identity: unsupported attribute "arn". This is most likely a bug in the Provider, providers must not change the identity schema without updating the identity schema version
│
│
╵
2025-09-08T13:09:26.384-0700 [DEBUG] provider.stdio: received EOF, stopping recv loop: err="rpc error: code = Unavailable desc = error reading from server: EOF"
2025-09-08T13:09:26.384-0700 [DEBUG] provider.stdio: received EOF, stopping recv loop: err="rpc error: code = Unavailable desc = error reading from server: EOF"
2025-09-08T13:09:26.384-0700 [DEBUG] provider.stdio: received EOF, stopping recv loop: err="rpc error: code = Unavailable desc = error reading from server: EOF"
2025-09-08T13:09:26.398-0700 [INFO]  provider: plugin process exited: plugin=.terraform/providers/registry.terraform.io/hashicorp/local/2.5.3/linux_amd64/terraform-provider-local_v2.5.3_x5 id=26749
2025-09-08T13:09:26.398-0700 [DEBUG] provider: plugin exited
2025-09-08T13:09:26.398-0700 [INFO]  provider: plugin process exited: plugin=.terraform/providers/registry.terraform.io/hashicorp/null/3.2.4/linux_amd64/terraform-provider-null_v3.2.4_x5 id=26769
2025-09-08T13:09:26.398-0700 [INFO]  provider: plugin process exited: plugin=.terraform/providers/registry.terraform.io/hashicorp/helm/2.17.0/linux_amd64/terraform-provider-helm_v2.17.0_x5 id=26813
2025-09-08T13:09:26.398-0700 [DEBUG] provider: plugin exited
2025-09-08T13:09:26.398-0700 [DEBUG] provider: plugin exited
2025-09-08T13:09:26.399-0700 [DEBUG] provider.stdio: received EOF, stopping recv loop: err="rpc error: code = Unavailable desc = error reading from server: EOF"
2025-09-08T13:09:26.399-0700 [INFO]  provider: plugin process exited: plugin=.terraform/providers/registry.terraform.io/hashicorp/kubernetes/2.38.0/linux_amd64/terraform-provider-kubernetes_v2.38.0_x5 id=26776
2025-09-08T13:09:26.399-0700 [DEBUG] provider.stdio: received EOF, stopping recv loop: err="rpc error: code = Unavailable desc = error reading from server: EOF"
2025-09-08T13:09:26.399-0700 [DEBUG] provider: plugin exited
2025-09-08T13:09:26.402-0700 [INFO]  provider: plugin process exited: plugin=.terraform/providers/registry.terraform.io/hashicorp/aws/5.100.0/linux_amd64/terraform-provider-aws_v5.100.0_x5 id=26756
2025-09-08T13:09:26.402-0700 [DEBUG] provider: plugin exited

GenAI / LLM Assisted Development

n/a

Important Facts and References

No response

Would you like to implement a fix?

Yes

[github-actions]

Community Guidelines

This comment is added to every new Issue to provide quick reference to how the Terraform AWS Provider is maintained. Please review the information below, and thank you for contributing to the community that keeps the provider thriving! 🚀

Voting for Prioritization

• Please vote on this Issue by adding a 👍 reaction to the original post to help the community and maintainers prioritize it.
• Please see our prioritization guide for additional information on how the maintainers handle prioritization.
• Please do not leave +1 or other comments that do not add relevant new information or questions; they generate extra noise for others following the Issue and do not help prioritize the request.

Volunteering to Work on This Issue

• If you are interested in working on this issue, please leave a comment.
• If this would be your first contribution, please review the contribution guide.
• For new resources and data sources, use skaff to generate scaffolding with comments detailing common expectations.

[justinretzolk]

Hey @balajiramasamy007 👋 Thank you for taking the time to raise this! Looking at the logging you've provided, I noticed a few instances like this:

│ Warning: Failed to decode resource from state
│
│ Error decoding "module.eks-cluster.aws_launch_template.launch_template_managed[\"green-ondemand\"]" from prior state: unsupported attribute "region"
╵

The region argument wasn't added to the aws_launch_template resource until version v6.0.0, which definitely makes it seem like something is off here.

Are you able to provide a more complete debug output from when the issue occurs? It may also be helpful if you can provide the output from terraform --version on the machine where the issue is reproduced as well, to make sure the appropriate version of the provider has indeed been installed.