resource/aws_dynamodb_table: Perpetual diff for encrypted replicas with default keys

[gdavison]

Terraform Core Version

N/A

AWS Provider Version

4.39.0

Affected Resource(s)

• aws_dynamodb_table

Expected Behavior

When a DynamoDB is created with replicas and encryption enabled with default keys, a perpetual diff is reported for the kms_key_arn

Actual Behavior

No diff is reported

Relevant Error/Panic Output Snippet

No response

Terraform Configuration Files

resource "aws_dynamodb_table" "example" {
  name             = "example"
  hash_key         = "TestTableHashKey"
  billing_mode     = "PAY_PER_REQUEST"
  stream_enabled   = true
  stream_view_type = "NEW_AND_OLD_IMAGES"

  attribute {
    name = "TestTableHashKey"
    type = "S"
  }

  replica {
    region_name = data.aws_region.alternate.name
  }

  server_side_encryption {
    enabled = true
  }
}

Steps to Reproduce

• terraform apply
• terraform plan

Debug Output

No response

Panic Output

No response

Important Factoids

No response

References

May be related to #25812 and #26552

Would you like to implement a fix?

No response

[github-actions]

Community Note

Voting for Prioritization

• Please vote on this issue by adding a 👍 reaction to the original post to help the community and maintainers prioritize this request.
• Please see our prioritization guide for information on how we prioritize.
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request.

Volunteering to Work on This Issue

• If you are interested in working on this issue, please leave a comment.
• If this would be your first contribution, please review the contribution guide.

[github-actions]

This functionality has been released in v4.52.0 of the Terraform AWS Provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template. Thank you!

[YakDriver]

The problem here came from a sort of perfect storm:

1. replica is a set of schema (config blocks), making custom diff handling tricky if you're looking at schema elements specifically (clearing diff on a block argument in a set is non-trivial).
2. The overall replica is not computed so a diff cannot be cleared at the block level (and error prone due to missing correct diffs and future-added block arguments).
3. The diff is caused because if you enable server side encryption and send nothing to AWS in aws_key_arn, which means to use the default AWS-managed DynamoDB KMS key alias/aws/dynamodb, then AWS responds with ARN of the default key in aws_key_arn.
4. replica cannot be changed to computed because then when replica is absent, the provider will not update in the specific situation where you remove all replica blocks when you previously had some, as was the previous behavior (breaking change).

The solutions (choose one):

1. A super complicated combination of custom diff, including clearing diff of an argument of a set + mess with input to exclude default keys at just the right times, with the added diff problems of a non-computed set.
2. Don't populate aws_key_arn with default keys. (They shouldn't be sent back to AWS anyway.) dynamodb/table_replica: Fix creation error when KMS #29102 takes this approach.

[ankon]

Thanks a lot for the clear explanation, @YakDriver -- this helps a lot for reviewing changelogs when updating the provider in production!

[virtualdom]

Hi, I'm still seeing this issue on 4.55 -- has this been fixed?

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.