Multiple task_parameter blocks in aws_ssm_maintenance_window_task do not apply in idempotent manner

[stangles]

Terraform Version

Terraform v0.11.2
+ provider.aws v1.8.0

Terraform Configuration Files

resource "aws_ssm_maintenance_window_task" "task" {
  window_id        = "${aws_ssm_maintenance_window.window.id}"
  task_type        = "RUN_COMMAND"
  task_arn         = "AWS-RunRemoteScript"
  priority         = 1
  service_role_arn = "${aws_iam_role.service_role.arn}"
  max_concurrency  = "1"
  max_errors       = "1"

  targets {
    key = "InstanceIds"

    values = [
      "${aws_instance.instance.id}",
    ]
  }

  task_parameters {
    name   = "sourceType"
    values = ["s3"]
  }

  task_parameters {
    name   = "sourceInfo"
    values = ["https://s3.amazonaws.com/bucket"]
  }

  task_parameters {
    name   = "commandLine"
    values = ["command-here"]
  }
}

Debug Output

Expected Behavior

After the above configuration is applied, all else being equal, running terraform apply again should result in no infrastructure changes.

Actual Behavior

Running terraform apply results in terraform wanting to destroy and create the aws_ssm_maintenance_window_task again, since the order in which multiple task_parameters are matched up is ostensibly not guaranteed. For instance, the below output shows the task_parameter ordering causes terraform to think the resource has changed in the config, even though it hasn't:

-/+ aws_ssm_maintenance_window_task.task (new resource required)
      id:                         "<old_id_here>" => <computed> (forces new resource)
      max_concurrency:            "1" => "1"
      max_errors:                 "1" => "1"
      priority:                   "1" => "1"
      service_role_arn:           "<service_role_arn_here>" => "<service_role_arn_here>"
      targets.#:                  "1" => "1"
      targets.0.key:              "InstanceIds" => "InstanceIds"
      targets.0.values.#:         "1" => "1"
      targets.0.values.0:         "<instance_id_here>" => "<instance_id_here>"
      task_arn:                   "AWS-RunRemoteScript" => "AWS-RunRemoteScript"
      task_parameters.#:          "3" => "3"
      task_parameters.0.name:     "sourceType" => "sourceType"
      task_parameters.0.values.#: "1" => "1"
      task_parameters.0.values.0: "s3" => "s3"
      task_parameters.1.name:     "commandLine" => "sourceInfo" (forces new resource)
      task_parameters.1.values.#: "1" => "1"
      task_parameters.1.values.0: "command-line-here" => "https://s3.amazonaws.com/bucket" (forces new resource)
      task_parameters.2.name:     "sourceInfo" => "commandLine" (forces new resource)
      task_parameters.2.values.#: "1" => "1"
      task_parameters.2.values.0: "https://s3.amazonaws.com/bucket" => "command-line-here" (forces new resource)
      task_type:                  "RUN_COMMAND" => "RUN_COMMAND"
      window_id:                  "<window_id_here>" => "<window_id_here>"

Running terraform apply again may show task_parameters matched up in different ways, and may even show no infrastructure changes required if you win the lottery and everything happens to match up evenly.

Steps to Reproduce

1. terraform init
2. Create a configuration that includes an aws_ssm_maintenance_window_task and multiple task_parameter blocks. (Note: there are SSM maintenance tasks that require more than one task parameter, so this should be a valid use case)
3. terraform apply => results in maintenance window task being applied.
4. terraform apply => most likely results in a plan where the maintenance window task wants to be recreated due to the multiple task_parameter blocks not matching up.

Additional Context

Hopefully nothing abnormal here in my setup, running the latest terraform and latest AWS provider on a MBP (10.13.3).

References

#2876 mentions behavior like this, but it's buried in a feature request and doesn't have much detail, so I figured I'd expand on it here.

[jimsmith]

be good to see both resolved 👍

[nitrocode]

I can confirm. I see this in 0.11.8 as well.

[egirard78]

Same problem on Terraform 0.11.10 with the AWS provider 1.57.0.

[bflad]

Fix submitted: #9364

[nywilken]

The fix to the aws_ssm_maintenance_window_task resource has been merged and will be released with version 2.20.0 of the Terraform AWS provider.

[nywilken]

The fix to the aws_ssm_maintenance_window_task resource, has been released in version 2.20.0 of the Terraform AWS provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this resource, please create a new GitHub issue following the template for triage. Thanks!

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thanks!