`aws_vpc_security_group_egress_rule` fails plan with: `Error: failed to decode identity: unsupported attribute "account_id".`

[nairb774]

Terraform and AWS Provider Version

Failing configuration:

$ terraform --version
Terraform v1.13.2
on linux_amd64
+ provider registry.terraform.io/datadog/datadog v3.73.0
+ provider registry.terraform.io/hashicorp/aws v6.13.0
+ provider registry.terraform.io/hashicorp/random v3.7.2
+ provider registry.terraform.io/hashicorp/tfe v0.68.2
+ provider registry.terraform.io/hashicorp/time v0.13.1
+ provider registry.terraform.io/hashicorp/tls v4.1.0
+ provider registry.terraform.io/integrations/github v6.6.0
+ provider registry.terraform.io/nairb774/flipflop v0.2.0
+ provider registry.terraform.io/tailscale/tailscale v0.21.1

---

Working configuration:

$ terraform --version
Terraform v1.12.2
on linux_amd64
+ provider registry.terraform.io/datadog/datadog v3.73.0
+ provider registry.terraform.io/hashicorp/aws v6.13.0
+ provider registry.terraform.io/hashicorp/random v3.7.2
+ provider registry.terraform.io/hashicorp/tfe v0.68.2
+ provider registry.terraform.io/hashicorp/time v0.13.1
+ provider registry.terraform.io/hashicorp/tls v4.1.0
+ provider registry.terraform.io/integrations/github v6.6.0
+ provider registry.terraform.io/nairb774/flipflop v0.2.0
+ provider registry.terraform.io/tailscale/tailscale v0.21.1

---

Only difference is updating Terraform from 1.12.2 to 1.13.2.

Affected Resource(s) or Data Source(s)

• aws_vpc_security_group_egress_rule
• aws_vpc_security_group_ingress_rule

Expected Behavior

Upgrading from Terraform 1.12.2 to 1.13.2 should work without issue.

Actual Behavior

Unable to upgrade to using Terraform from 1.12.2 to 1.13.2 due to what looks to be a bug in the AWS provider.

Relevant Error/Panic Output

Error: failed to decode identity: unsupported attribute "account_id". This is most likely a bug in the Provider, providers must not change the identity schema without updating the identity schema version
Error: failed to decode identity: unsupported attribute "account_id". This is most likely a bug in the Provider, providers must not change the identity schema without updating the identity schema version
Warning: Failed to decode resource from state
Error decoding "aws_vpc_security_group_egress_rule.rule[\"port:5432\"]" from prior state: failed to decode identity: unsupported attribute "account_id". This is most likely a bug in the Provider, providers must not change the identity schema without updating the identity schema version
Warning: Failed to decode resource from state
Error decoding "aws_vpc_security_group_ingress_rule.rule[\"port:5432\"]" from prior state: failed to decode identity: unsupported attribute "account_id". This is most likely a bug in the Provider, providers must not change the identity schema without updating the identity schema version

Sample Terraform Configuration

Click to expand configuration

This is a simplified version of the code found in our workspace. I attempted to preserve as much structure as possible while at the same time disconnecting it from some internals.

provider "aws" {
  region = "us-east-1"
}

locals {
  ports = { for port in [var.port] : "port:${port}" => port }
}

resource "aws_vpc_security_group_egress_rule" "rule" {
  for_each = local.ports

  description                  = var.description
  security_group_id            = var.egress_security_group_id
  referenced_security_group_id = var.ingress_security_group_id

  ip_protocol = var.ip_protocol
  from_port   = each.value
  to_port     = each.value
}

resource "aws_vpc_security_group_ingress_rule" "rule" {
  for_each = local.ports

  description                  = var.description
  security_group_id            = var.ingress_security_group_id
  referenced_security_group_id = var.egress_security_group_id

  ip_protocol = var.ip_protocol
  from_port   = each.value
  to_port     = each.value
}

Steps to Reproduce

We updated to aws 6.13.0 a few days ago. Now attempting to upgrade Terraform to the 1.13 release cycle seems to be blocked.

I see #44198 was added in the 6.13.0 aws provider release, and it looks to be suspiciously related.

Looking in the state file for the implicated resources (all egress/ingress rules in the workspace) I see things like the following:

{
  "mode": "managed",
  "type": "aws_vpc_security_group_egress_rule",
  "name": "a_rule",
  "provider": "provider[\"registry.terraform.io/hashicorp/aws\"]",
  "instances": [
    {
      "schema_version": 0,
      "attributes": {
        "arn": "arn:aws:ec2:us-east-1:123456789012:security-group-rule/sgr-00112233445566778",
        "cidr_ipv4": null,
        "cidr_ipv6": "::/0",
        "description": "",
        "from_port": null,
        "id": "sgr-00112233445566778",
        "ip_protocol": "-1",
        "prefix_list_id": null,
        "referenced_security_group_id": null,
        "region": "us-east-1",
        "security_group_id": "sg-aabbccddeeff00112",
        "security_group_rule_id": "sgr-00112233445566778",
        "tags": null,
        "tags_all": {
          "zzz": "zzz"
        },
        "to_port": null
      },
      "sensitive_attributes": [],
      "identity_schema_version": 0,
      "identity": {
        "account_id": "123456789012",
        "id": "sgr-00112233445566778",
        "region": "us-east-1"
      },
      "dependencies": [
        "aws_security_group.a_group",
        "aws_vpc.vpc"
      ]
    }
  ]
}

We've not set any resource level account/region/provider settings. Additionally, attempting a state refresh, or a plan/apply cycle doesn't clear the error.

Debug Logging

GenAI / LLM Assisted Development

n/a

Important Facts and References

No response

Would you like to implement a fix?

No

[github-actions]

Community Guidelines

This comment is added to every new Issue to provide quick reference to how the Terraform AWS Provider is maintained. Please review the information below, and thank you for contributing to the community that keeps the provider thriving! 🚀

Voting for Prioritization

• Please vote on this Issue by adding a 👍 reaction to the original post to help the community and maintainers prioritize it.
• Please see our prioritization guide for additional information on how the maintainers handle prioritization.
• Please do not leave +1 or other comments that do not add relevant new information or questions; they generate extra noise for others following the Issue and do not help prioritize the request.

Volunteering to Work on This Issue

• If you are interested in working on this issue, please leave a comment.
• If this would be your first contribution, please review the contribution guide.
• For new resources and data sources, use skaff to generate scaffolding with comments detailing common expectations.

[nairb774]

Using the most recent Terraform 1.13.3 release seems to have made the issue go away. The one change called out in the 1.13.3 release notes doesn't seem to relate (to the uninitiated) so I'm suspicious there might be something else going on.

That said, if the fix truly was on the Terraform side feel free to close. For now, I'm unblocked.

[justinretzolk]

Hey @nairb774 👋 Thank you for taking the time to raise this, and for the follow up! After speaking with the team, I do suspect this is related to the Terraform version being used, so since you're unblocked, I'm going to close this issue out.

If you do run into any other unexpected behavior, please do let us know!

[github-actions]

Warning

This Issue has been closed, meaning that any additional comments are much easier for the maintainers to miss. Please assume that the maintainers will not see them.

Ongoing conversations amongst community members are welcome, however, the issue will be locked after 30 days. Moving conversations to another venue, such as the AWS Provider forum, is recommended. If you have additional concerns, please open a new issue, referencing this one where needed.

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.