aws_account_alternate_contact not working if contact was not previously set

[jansepke]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform CLI and Terraform AWS Provider Version

• Terraform v1.0.11
• hashicorp/aws v3.69.0

Affected Resource(s)

• aws_account_alternate_contact

Terraform Configuration Files

Please include all Terraform configurations required to reproduce the bug. Bug reports without a functional reproduction may be closed without investigation.

resource "aws_account_alternate_contact" "billing" {
  alternate_contact_type = "BILLING"

  name          = "XYZ"
  title         = "Ops"
  email_address = var.contact_email_address
  phone_number  = var.contact_phone_number
}

Debug Output

Panic Output

Expected Behavior

When the alternate contact of that type does not exist yet in AWS I would expect terraform to set the contact details for that type without errors.

Actual Behavior

Error: error reading Account Alternate Contact (/BILLING): couldn't find resource

Steps to Reproduce

1. terraform apply

Important Factoids

The resource aws_account_alternate_contact was introduced in #21789. When a contact is empty and needs to be created by terraform the AWS API will return a ResourceNotFoundException. This is not handled in this resource. A possible solution could be to check in resourceAlternateContactRead if the resource is new and if we got a not found error.

References

• PR: New resource/aws_account_alternate_contact #21789
• AWS Terraform Docs: https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/account_alternate_contact
• AWS CLI Docs: https://docs.aws.amazon.com/cli/latest/reference/account/get-alternate-contact.html

[davidferguson-cr]

Seeing the same errors on BILLING and SECURITY contacts on a new account where the OPERATIONS contact works fine. A second terraform apply appears to deploy the changes successfully.

[YakDriver]

@jansepke Thanks for reporting this!

@davidferguson-cr Thank your for the additional details.

I have added eventual consistency in #23516 to hopefully fix this issue. It is difficult for us to test since we do not have new test accounts without a previously set alternate contact. However, my best guess is that there is a longer delay with a new account to create the alternate contact. That would explain the error you are seeing since there was no wait between creation and reading, which is where you get the error.

After you get a chance to test #23516 (should be part of v4.4), please let me know if this is resolved.

[markogenomics]

@YakDriver I've tested with v4.9.0 and getting the same error. I have introduced 5 minutes delay after account creation, and then try to set alternate contacts. The error I'm getting is
Error: error waiting for Account Alternate Contact (/BILLING) create: couldn't find resource (21 retries)

Previously, with v3.75.1 error was Error: error reading Account Alternate Contact (/BILLING): couldn't find resource

[devonbleak]

This is also consistently inconsistent for me. Earlier I did 69 contact adds and 9 failed, just now I did 9 and 5 of them failed. I double-checked one of the accounts in question this last time and the contacts that failed just aren't showing up at all.

Looking at the code in the provider it seems correct - it's checking for errors returned from the SDK. Looking at the SDK it's using the same request.Send() method that every other service uses. This seems like an issue with the API itself silently discarding requests?

Edit: Opened a support case w/ AWS.

[devonbleak]

According to AWS they've deployed a fix for this on their side. Haven't had a chance to test it myself yet.

[markogenomics]

Tested and all works fine. Thanks all!

[github-actions]

Marking this issue as stale due to inactivity. This helps our maintainers find and focus on the active issues. If this issue receives no comments in the next 30 days it will automatically be closed. Maintainers can also remove the stale label.

If this issue was automatically closed and you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thank you!

[YakDriver]

There have been signficant changes since this was first raised leaving this in an unknown state:

• We deployed an eventual consistency fix
• Retry mechanism has been reworked with AWS SDK v2
• AWS has deployed a fix

To shift focus to things we know are problems currently, I'm going to close this issue. Please don't hestitate to raise a new issue if this isn't resolved.

[github-actions]

Warning

This issue has been closed, meaning that any additional comments are hard for our team to see. Please assume that the maintainers will not see them.

Ongoing conversations amongst community members are welcome, however, the issue will be locked after 30 days. Moving conversations to another venue, such as the AWS Provider forum, is recommended. If you have additional concerns, please open a new issue, referencing this one where needed.

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.