[Bug]: BadReqest: Invalid input error when changing file_system_id in aws_fsx_ontap_storage_virtual_machine resource

[acwwat]

Terraform Core Version

1.5.4

AWS Provider Version

5.16.2

Affected Resource(s)

• aws_fsx_ontap_storage_virtual_machine
• aws_fsx_ontap_file_system (indirect)

Expected Behavior

When file_system_id is changed in the aws_fsx_ontap_storage_virtual_machine resource, it should trigger a replacement.

Actual Behavior

When file_system_id is changed in the aws_fsx_ontap_storage_virtual_machine resource, it attempts to modify the existing resources leading to a BadRequest error with invalid input.

Relevant Error/Panic Output Snippet

aws_fsx_ontap_storage_virtual_machine.this: Modifying... [id=svm-0c489d034859a8437]
╷
│ Error: updating FSx ONTAP Storage Virtual Machine (svm-0c489d034859a8437): BadRequest: Invalid input provided to UpdateStorageVirtualMachine
│
│   with aws_fsx_ontap_storage_virtual_machine.this,
│   on shared-storage.tf line 496, in resource "aws_fsx_ontap_storage_virtual_machine" "this":
│  496: resource "aws_fsx_ontap_storage_virtual_machine" "this" {
│

Terraform Configuration Files

This is copied from my TF config. Replace variables with appropriate values if you are building a test case based on this config reference.

resource "aws_fsx_ontap_file_system" "this" {
  storage_capacity                  = var.fsx_ontap_config.fs_storage_capacity
  subnet_ids                        = [for az in slice(var.region_azs, 0, length(var.region_azs) > 1 && var.fsx_ontap_config.fs_deployment_type == "MULTI_AZ_1" ? 2 : 1) : data.aws_subnet.private[az].id]
  preferred_subnet_id               = data.aws_subnet.private[var.region_azs[0]].id
  weekly_maintenance_start_time     = var.fsx_ontap_config.fs_weekly_maintenance_start_time
  deployment_type                   = var.fsx_ontap_config.fs_deployment_type
  automatic_backup_retention_days   = var.fsx_ontap_config.fs_automatic_backup_retention_days
  daily_automatic_backup_start_time = var.fsx_ontap_config.fs_daily_automatic_backup_start_time
  # There is a bug where iops is required on create but not subsequently
  # See: https://github.com/hashicorp/terraform-provider-aws/issues/30435
  #disk_iops_configuration {
  #  mode = "AUTOMATIC"
  #}
  fsx_admin_password  = local.fsx_init_admin_pwd_secret_value["password"]
  route_table_ids     = var.fsx_ontap_config.fs_deployment_type == "MULTI_AZ_1" ? data.aws_route_tables.private.ids : null
  throughput_capacity = var.fsx_ontap_config.fs_throughput_capacity
  tags = {
    Name = "app-${var.env}-fsx-${local.region_abbrv}"
  }
  lifecycle {
    create_before_destroy = true
  }
}

resource "aws_fsx_ontap_storage_virtual_machine" "this" {
  file_system_id             = aws_fsx_ontap_file_system.this.id
  name                       = var.fsx_ontap_config.svm_name
  root_volume_security_style = "NTFS"
  active_directory_configuration {
    netbios_name = upper(var.fsx_ontap_config.svm_name)
    self_managed_active_directory_configuration {
      dns_ips                                = data.aws_directory_service_directory.this.dns_ip_addresses
      domain_name                            = upper(data.aws_directory_service_directory.this.name) # Must be uppercase
      username                               = local.ad_domain_join_secret_value["awsSeamlessDomainUsername"]
      password                               = local.ad_domain_join_secret_value["awsSeamlessDomainPassword"]
      organizational_unit_distinguished_name = "${var.fsx_ontap_config.svm_ad_ou},${local.ad_ou_dn_suffix}"
    }
  }

Steps to Reproduce

1. Create a aws_fsx_ontap_file_system resource and a aws_fsx_ontap_storage_virtual_machine resource that sets the file_system_id attribute to the id attribute of the former resource.
2. For a change in the aws_fsx_ontap_file_system resource which will replace the resource (for example, change deployment_type.

Debug Output

No response

Panic Output

No response

Important Factoids

No response

References

No response

Would you like to implement a fix?

None

[github-actions]

Community Note

Voting for Prioritization

• Please vote on this issue by adding a 👍 reaction to the original post to help the community and maintainers prioritize this request.
• Please see our prioritization guide for information on how we prioritize.
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request.

Volunteering to Work on This Issue

• If you are interested in working on this issue, please leave a comment.
• If this would be your first contribution, please review the contribution guide.

[acwwat]

Adding replace_triggered_by lifecycle metadata to the aws_fsx_ontap_storage_virtual_machine object seems to work around the issue. For example:

resource "aws_fsx_ontap_storage_virtual_machine" "this" {
  file_system_id             = aws_fsx_ontap_file_system.this.id
  name                       = var.fsx_ontap_config.svm_name
  root_volume_security_style = "NTFS"
  active_directory_configuration {
    netbios_name = upper(var.fsx_ontap_config.svm_name)
    self_managed_active_directory_configuration {
      dns_ips                                = data.aws_directory_service_directory.this.dns_ip_addresses
      domain_name                            = upper(data.aws_directory_service_directory.this.name) # Must be uppercase
      username                               = local.ad_domain_join_secret_value["awsSeamlessDomainUsername"]
      password                               = local.ad_domain_join_secret_value["awsSeamlessDomainPassword"]
      organizational_unit_distinguished_name = "${var.fsx_ontap_config.svm_ad_ou},${local.ad_ou_dn_suffix}"
    }
  }
  # Workaround for a bug where file_system_id change triggers a change vs. a replacement causing a BadRequest error
  # See: https://github.com/hashicorp/terraform-provider-aws/issues/33542
  lifecycle {
    replace_triggered_by = [aws_fsx_ontap_file_system.this.id]
  }
}

[ewbankkit]

terraform-provider-aws/internal/service/fsx/ontap_storage_virtual_machine.go

Lines 199 to 203 in 701f091

	"file_system_id": {
	Type: schema.TypeString,
	Required: true,
	ValidateFunc: validation.StringLenBetween(11, 21),
	},

Need to add ForceNew: true,.

@acwwat Thanks for raising this issue 👏.
I'm working through some FSx PRs and will ensure that this gets fixed in the next one I merge.

[github-actions]

This functionality has been released in v5.18.0 of the Terraform AWS Provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template. Thank you!

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.