[Tracking Issue] Order is lost in JSON/policies when applied

[YakDriver]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Relates #22048

Centralized JSON List/Array Diff Issue

When Terraform reports a spurious diff, it can be inconvenient. If that non-diff forces replacement, it can seriously affect systems. We don't want that.

This issue focues on AWS provider non-diffs occurring on AWS policy JSONs. It is looking at the problem, tracking fixes, and gathering references.

Diffs vs. Reordering vs. Preserving Order vs. Ignoring Order

Assuming that non-diff diffs (i.e., spurious diffs) are the crux of the problem, consistent reordering (such as alphabetical or anti-alphabetical as with #6107), preserving the given order, or completely ignoring order within JSON arrays can all be solutions. Many times issues suggest some variation of ordering but the bottom-line reason seems to be avoiding diffs.

Step 1

In this round of fixes, the approach is to ignore order by only setting a new policy JSON when it is not equivalent to the existing policy JSON. The data source aws_iam_policy_document takes a different approach by reordering the JSON arrays, currently anti-alphabetically (see #6107).

Companion Issue to #11801

Perhaps the most popular issue to describe these problems is #11801. Rather than hijack it, this is a generalized issue and central place for documenting similar problems and tracking fixes.

Fixes Needed

• apigateway/rest_api (apigateway/rest_api: Fix diffs from equivalent policies #22115)
• apigateway/rest_api_policy (apigateway/rest_api: Fix diffs from equivalent policies #22115)
• apigatewayv2/model (verified non-policy JSON)
• appconfig/configuration_profile (verified non-policy JSON)
• backup/vault_policy (backup/vault_policy: Fix diffs with equivalent policies #22130)
• cloudwatch/dashboard (verified non-policy JSON)
• cloudwatchlogs/resource_policy (logs/resource_policy: Fix equivalent policy diffs #22135)
• codeartifact/domain_permissions_policy (codeartifact/permissions_policy: Fix equivalent policy diffs #22136)
• codeartifact/repository_permissions_policy (codeartifact/permissions_policy: Fix equivalent policy diffs #22136)
• codecommit/approval_rule_template (verified non-policy JSON)
• configservice/organization_custom_rule (verified non-policy JSON)
• configservice/organization_managed_rule (verified non-policy JSON)
• connect/contact_flow (verified non-policy JSON)
• dms/replication_task (verified non-policy JSON)
• ec2/vpc_endpoint (ec2/vpc_endpoint: Fix erroneous diffs with equivalent policies #22137)
• ecr/lifecycle_policy (ecr/lifecycle_policy: Fix diffs when policy equivalent #22142)
• ecr/registry_policy (ecr: Preserve/ignore order in JSON/policy #22004)
• ecr/repository_policy (ecr: Preserve/ignore order in JSON/policy #22004)
• efs/file_system_policy (efs/file_system_policy: Fix diffs with equivalent policies #22100)
• elasticsearch/domain (elasticsearch/domain: Fix erroneous/perpetual diffs #22157)
• elasticsearch/domain_policy (elasticsearch/domain: Fix erroneous/perpetual diffs #22157)
• emr/cluster (verified non-policy JSON)
• emr/instance_group (verified non-policy JSON)
• events/bus_policy (events/bus_policy: Fix diffs with policy #22165)
• fms/policy (verified non-policy JSON)
• glacier/vault (glacier/vault: Fix spurious policy diffs #22166)
• glacier/vault_lock (glacier/vault: Fix spurious policy diffs #22166)
• glue/crawler (verified non-policy JSON)
• glue/resource_policy (glue/resource_policy: Fix diffs with equivalent policies #22167)
• iam/group_policy (IAM: Only set policy if actually changed #22067)
• iam/policy (IAM: Only set policy if actually changed #22067)
• iam/role (iam/role: Fix spurious diffs with inline_policy ordering #22099)
• iam/role_policy (IAM: Only set policy if actually changed #22067)
• iam/user_policy (IAM: Only set policy if actually changed #22067)
• iot/policy (iot/policy: Fix diffs with equivalent policies #22169)
• kms/external_key (kms: Preserve order in JSON/policies #21990)
• kms/key (kms/key: Preserve order in JSON policy lists #21969)
• kms/replica_external_key (kms: Preserve order in JSON/policies #21990)
• kms/replica_key (kms: Preserve order in JSON/policies #21990)
• lambda/invocation_data_source_test (verified non-policy JSON)
• mediastore/container_policy (mediastore/container_policy: Fix equivalent policy diffs #22170)
• networkfirewall/resource_policy (networkfirewall/resource_policy: Fix equivalent policy diffs #22171)
• opsworks/stack (verified non-policy JSON)
• organizations/policy (verified non-IAM-policy JSON)
• s3/bucket (s3: Preserve order in JSON/policy arrays #21997)
• s3/bucket_policy (s3: Preserve order in JSON/policy arrays #21997)
• s3control/access_point (s3control: Fix equivalent policy diffs #22255)
• s3control/access_point_policy (s3control: Fix equivalent policy diffs #22255)
• s3control/bucket_policy (s3control: Fix equivalent policy diffs #22255)
• s3control/multi_region_access_point_policy (s3control: Fix equivalent policy diffs #22255)
• s3control/object_lambda_access_point_policy (s3control: Fix equivalent policy diffs #22255)
• sagemaker/flow_definition (verified non-policy JSON)
• sagemaker/model_package_group_policy (sagemaker/model_package_group_policy: Fix equivalent policy diffs #22259)
• schemas/schema (verified non-policy JSON)
• secretsmanager/secret (secretsmanager/secret: Fix equivalent policy diffs #22217)
• secretsmanager/secret_policy (secretsmanager/secret: Fix equivalent policy diffs #22217)
• servicecatalog/constraint (verified non-policy JSON)
• servicecatalog/diff (verified non-policy JSON)
• ses/identity_policy (ses/identity_policy: Fix equivalent policy diffs #22214)
• sns/topic (sns/topic: Fix diffs with policies #22213)
• sns/topic_policy (sns/topic: Fix diffs with policies #22213)
• sns/topic_subscription (verified non-IAM-policy JSON)
• sqs/queue (sqs: Fix diffs with policies #22194)
• sqs/queue_policy (sqs: Fix diffs with policies #22194)
• ssoadmin/permission_set_inline_policy (ssoadmin/permission_set_inline_policy: Fix errorneous diffs #22192)
• transfer/access (transfer: Fix erroneous diffs with user and access policies #22193)
• transfer/user (transfer: Fix erroneous diffs with user and access policies #22193)

References

Provider References

• aws_iam_policy_document orders actions anti-alphabetically #6107
• Order is lost for data aws_iam_policy_document when applied to S3 buckets, iam roles, kms keys, etc #11801
• s3 bucket policy with not_principal always changes due to ordering #13144
• Inconsistent ordering of values in codeartifact_repository_permissions_policy #17024
• Principals in aws_s3_bucket_policy should be ordered for plan #18878
• aws_iam_policy_document Bool condition always shows diff #19245
• aws_ecr_repository_policy tries to enforce order of principals when AWS insists on a different random ordering. #19365
• iam_role inline_policy: Issue importing iam role with inline policies wanting to be deleted and recreated when there is no difference #19444
• Terraform detects spurious bucket policy changes before each apply after upgrading to 0.15.4 #19627
• "Objects changed outside of Terraform" shown wrongly for various resources #19727
• Unhelpful "changes made outside of terraform" due to AWS vs tf representation in 1.0 #20107
• S3 bucket policy condition block displays endless diff with values array of length 1 #20456
• IAM Policy Principals: Objects have changed outside of Terraform #20665
• Policy documents and other lists causing drift #20781

Other References

• Ignore JSON array order awspolicyequivalence#1
• Convert boolean and numeric values to strings for value comparison awspolicyequivalence#7
• https://github.com/hashicorp/awspolicyequivalence
• Classifying normalization vs. drift terraform-plugin-framework#70
• DiffSuppressFunc should be used for "Objects have changed outside of Terraform" logic terraform-plugin-sdk#801
• Policy elements that are syntactically lists but semantically sets should have their order ignored jen20/awspolicyequivalence#10
• aws_iam_policy_document applies reverse sort on resources list. terraform#22931
• Preserving object key order in jsonencode terraform#27880
• A way to hide certain expected changes from the "refresh" report ("Objects have changed outside of Terraform") terraform#28803
• Random and persistent rearrangements of objects within array of jsonencode function terraform#29685

[github-actions]

This functionality has been released in v3.70.0 of the Terraform AWS Provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template. Thank you!

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.