3.64.1/0 breaks certain FIPS endpoints during terraform plan/apply

[joseph-max-coalfire]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform CLI and Terraform AWS Provider Version

Affected Resource(s)

• custom endpoints block within the AWS provider resource
• Looks like not all AWS FIPS endpoints are broken-- we're seeing issues with the Elasticsearch "es" and Config "config" endpoints but nothing else at the moment reference page in AWS

Terraform Configuration Files

variable "aws_region" {
    default = "us-east-1"
}

provider "aws" {
  region                 = var.aws_region
  version                = ">=3.26"
  skip_region_validation = "true"
  profile                = "default"
  alias                  = "stage"

  //FIPs endpoints for govcloud
//  endpoints {
//    configservice    = "config-fips.${var.aws_region}.amazonaws.com"
//    es         = "es-fips.${var.aws_region}.amazonaws.com"
//  }

    // FIPs endpoints for east/west aws
    endpoints {
      es         = "es-fips.${var.aws_region}.amazonaws.com"
      configservice    = "config-fips.${var.aws_region}.amazonaws.com"

    }
}

Debug Output

link to gist

Expected Behavior

Terraform plan/apply succeeds with these endpoints defined in the provider "aws" stanzas

Actual Behavior

Terraform plan/apply fails, complaining about "An argument named {AWS_service_prefix} is not expected here. Did you mean {another_AWS_service_prefix_that's_not_correct}?

Steps to Reproduce

1. Create a provider "aws" block within your Terraform code somewhere
2. Within the provider block, create an endpoints map using AWS FIPS endpoints, with either "es" (AWS Elasticsearch) or "config" (AWS Config)
3. terraform plan

Downgrading to version 3.63 fixes this

References

• Release 3.64.1
• Release 3.64.0

[ewbankkit]

@joseph-max-coalfire Thanks for raising this issue.
It has already been noticed in #21646. I'm going to close this one as a duplicate so that we can concentrate discussion in the linked issue.
Please add any additional comments there.

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.