S3 Bucket Tags with "" Value are Not Created / Result is Perpetual Plan and Apply Differences

[colinbjohnson]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform CLI and Terraform AWS Provider Version

Terraform v1.2.5
on darwin_arm64
+ provider registry.terraform.io/hashicorp/aws v4.22.0

Affected Resource(s)

• aws_s3_bucket

Note that aws_iam_user type resources are not impacted.

Terraform Configuration Files

provider "aws" {
  region = "us-west-2"
}

resource "aws_s3_bucket" "terraform_null_tags_test_bucket" {
  bucket = "terraform-default-tags-test-bucket"
  tags = {
    # note that the tag Environment will _not_ be created
    # this creates a perpetual diff during plan/apply
    Environment = ""
  }
}

resource "aws_iam_user" "terraform_null_tags_test_iam_user" {
  name = "terraform-null-tags-test-iam-role"
  tags = {
    # note that the tag Key Environment with a Value (empty) will be created 
    Environment = ""
  }
}

Debug Output

https://gist.github.com/colinbjohnson/9822e9af6350d238c9e3739cdd05789d

Panic Output

NA

Expected Behavior

A tag with the Key "Environment" should be created with an empty Value should be created.

Actual Behavior

No tag is created.

Steps to Reproduce

1. Run terraform apply

Important Factoids

In the above gist/debug output it does seem that terraform/the AWS provider is aware of an issue and as a result the following is returned:

2022-07-16T14:02:00.617-0700 [DEBUG] provider.terraform-provider-aws_v4.22.0_x5: ---[ RESPONSE ]--------------------------------------
2022-07-16T14:02:00.617-0700 [DEBUG] provider.terraform-provider-aws_v4.22.0_x5: HTTP/1.1 404 Not Found
2022-07-16T14:02:00.617-0700 [DEBUG] provider.terraform-provider-aws_v4.22.0_x5: Transfer-Encoding: chunked
2022-07-16T14:02:00.617-0700 [DEBUG] provider.terraform-provider-aws_v4.22.0_x5: Content-Type: application/xml
2022-07-16T14:02:00.617-0700 [DEBUG] provider.terraform-provider-aws_v4.22.0_x5: Date: Sat, 16 Jul 2022 21:01:59 GMT
2022-07-16T14:02:00.617-0700 [DEBUG] provider.terraform-provider-aws_v4.22.0_x5: Server: AmazonS3
2022-07-16T14:02:00.617-0700 [DEBUG] provider.terraform-provider-aws_v4.22.0_x5: X-Amz-Id-2: pLafGSxQhpqykSaX9wYZsxa0uege0gyJQTTiS594awPuA42TRNOMntkd5IIItA80sK9Ml8OhLCA=
2022-07-16T14:02:00.617-0700 [DEBUG] provider.terraform-provider-aws_v4.22.0_x5: X-Amz-Request-Id: GPM7ED5PYSEA124A
2022-07-16T14:02:00.617-0700 [DEBUG] provider.terraform-provider-aws_v4.22.0_x5: 
2022-07-16T14:02:00.617-0700 [DEBUG] provider.terraform-provider-aws_v4.22.0_x5: 
2022-07-16T14:02:00.617-0700 [DEBUG] provider.terraform-provider-aws_v4.22.0_x5: -----------------------------------------------------
2022-07-16T14:02:00.617-0700 [DEBUG] provider.terraform-provider-aws_v4.22.0_x5: [DEBUG] [aws-sdk-go] <?xml version="1.0" encoding="UTF-8"?>
2022-07-16T14:02:00.617-0700 [DEBUG] provider.terraform-provider-aws_v4.22.0_x5: <Error><Code>NoSuchTagSet</Code><Message>The TagSet does not exist</Message><BucketName>terraform-default-tags-test-bucket</BucketName><RequestId>GPM7ED5PYSEA124A</RequestId><HostId>pLafGSxQhpqykSaX9wYZsxa0uege0gyJQTTiS594awPuA42TRNOMntkd5IIItA80sK9Ml8OhLCA=</HostId></Error>
2022-07-16T14:02:00.617-0700 [DEBUG] provider.terraform-provider-aws_v4.22.0_x5: [DEBUG] [aws-sdk-go] DEBUG: Validate Response s3/GetBucketTagging failed, attempt 0/25, error NoSuchTagSet: The TagSet does not exist
2022-07-16T14:02:00.617-0700 [DEBUG] provider.terraform-provider-aws_v4.22.0_x5: 	status code: 404, request id: GPM7ED5PYSEA124A, host id: pLafGSxQhpqykSaX9wYZsxa0uege0gyJQTTiS594awPuA42TRNOMntkd5IIItA80sK9Ml8OhLCA=
2022-07-16T14:02:00.618-0700 [WARN]  Provider "provider[\"registry.terraform.io/hashicorp/aws\"]" produced an unexpected new value for aws_s3_bucket.terraform_null_tags_test_bucket, but we are tolerating it because it is using the legacy plugin SDK.
    The following problems may be the cause of any confusing errors from downstream operations:
      - .tags: element "Environment" has vanished
      - .tags_all: element "Environment" has vanished
aws_s3_bucket.terraform_null_tags_test_bucket: Modifications complete after 1s [id=terraform-default-tags-test-bucket]
2022-07-16T14:02:00.644-0700 [DEBUG] provider.stdio: received EOF, stopping recv loop: err="rpc error: code = Unavailable desc = transport is closing"
2022-07-16T14:02:00.652-0700 [DEBUG] provider: plugin process exited: path=.terraform/providers/registry.terraform.io/hashicorp/aws/4.22.0/darwin_arm64/terraform-provider-aws_v4.22.0_x5 pid=4854
2022-07-16T14:02:00.652-0700 [DEBUG] provider: plugin exited

References

NA

[stevewright82]

I see this exact thing, but with resource aws_subnet. I'm not sure it happens when the initial subnet is built, only if tagging changes.

Note, it seems specific to key/value pairs where the value is empty (a valid AWS case), and is fine if the value is anything.

[justinretzolk]

Hey @colinbjohnson 👋 Thanks for taking the time to submit this issue. It looks like this is a duplicate of #24449. We like to try to keep discussions consolidated, so we’re going to close this new issue in favor of #24449.

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.