bug: `limit_by_labels` in <=1.0.1 replaced by `limit_by_label` in provider and not fixed here

[MaxymVlasov]

See for details lacework/terraform-provider-lacework#421

[afiune]

Hi @MaxymVlasov, I can't believe we missed this. I am really sorry for the delay, I am personally fixing this right now.

[afiune]

@MaxymVlasov actually, looking at this change #39 it seems that we have fixed this module. 🤔

-- What is the problem you are experiencing?

[MaxymVlasov]

🤔 I'll double check and return

[afiune]

Please do and let us know if you are having issues. We acknowledge we really messed up with that change in the provider so if there is anything we can do to unblock you, or anyone else, we will do it right away.

[MaxymVlasov]

lacework/lacework 1.0.1, lacework/ecr/aws 0.7.2 conf

terraform {
  required_version = "~> 1.3"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 4.38"
    }

    lacework = {
      source  = "lacework/lacework"
      version = "~> 1.0.1"
    }
  }
}

module "ecr" {
  source  = "lacework/ecr/aws"
  version = "0.7.2"

  count = module.this.enabled ? 1 : 0

  lacework_integration_name = module.this.tags.Name
  iam_role_name             = module.lacework_iam_role_name.id
}

tf plan: No changes. Your infrastructure matches the configuration.

lacework/lacework 1.1.0 (same for 1.4.0), lacework/ecr/aws 0.7.3 conf

terraform {
  required_version = "~> 1.3"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 4.38"
    }

    lacework = {
      source  = "lacework/lacework"
      version = "~> 1.1.0"
    }
  }
}

module "ecr" {
  source  = "lacework/ecr/aws"
  version = "0.7.3"

  count = module.this.enabled ? 1 : 0

  lacework_integration_name = module.this.tags.Name
  iam_role_name             = module.lacework_iam_role_name.id
}

tf plan:

╷
│ Error: Failed to decode resource from state
│ 
│ Error decoding "module.ecr[0].lacework_integration_ecr.iam_role" from previous state:
│ missing expected [
╵
╷
│ Error: missing expected [
│ 
│   with module.ecr[0].lacework_integration_ecr.iam_role,
│   on .terraform/modules/ecr/main.tf line 36, in resource "lacework_integration_ecr" "iam_role":
│   36: resource "lacework_integration_ecr" "iam_role" {
│ 
╵
Releasing state lock. This may take a few moments...
exit status 1

I dunno why it expects [ here

terraform-aws-ecr/main.tf

Lines 36 to 55 in a330b97

	resource "lacework_integration_ecr" "iam_role" {
	name = var.lacework_integration_name
	registry_domain = local.registry_domain
	non_os_package_support = var.non_os_package_support
	credentials {
	role_arn = local.iam_role_arn
	external_id = local.iam_role_external_id
	}
	limit_by_tags = var.limit_by_tags
	dynamic "limit_by_label" {
	for_each = var.limit_by_labels
	content {
	key = limit_by_label.value.key
	value = limit_by_label.value.value
	}
	}
	limit_by_repositories = var.limit_by_repositories
	limit_num_imgs = var.limit_num_imgs
	depends_on = [time_sleep.wait_time]
	}

[MaxymVlasov]

Maybe it relates count arg, but...

[MaxymVlasov]

@afiune Happy Friday! Ping you in case you miss my previous msg :)

[sarahhodne]

We're also encountering this, though with a slightly different error message.

Version 1.0.1 of the provider and 0.7.2 of the module reports "No changes", but upgrading the provider to 1.4.0 and the module to 0.7.3 gives us:

╷
│ Error: Failed to decode resource from state
│
│ Error decoding "module.lacework_ecr.lacework_integration_ecr.iam_role" from previous state: unsupported attribute "limit_by_labels"
╵

[MaxymVlasov]

@afiune ?

[MaxymVlasov]

Okay then, @dmurray-lacework ?

[afiune]

@sarahhodne @MaxymVlasov apologies for the delayed response.

Let me take a quick look at this thread again. 👀

[afiune]

Essentially change #39 was a breaking change since we changed the variable limit_by_labels from map(string) to list(object()) which should have been released as v1.0.0 instead.

With this breaking change you are going to have to update your Terraform code for the limit_by_labels variable and use the new format.

If you are using it like this:

  limit_by_labels       = {example: "example"}

You will have to update it to:

limit_by_labels = [{
    key   = "example"
    value = "test"
    }]

We apologize for the inconveniences. 😞

[MaxymVlasov]

@afiune we don't use limit_by_labels anymore, but we still get the next error:

#41 (comment)