Bug: terraform doesn't change DynamoDB correctly when AutoScaling enabled

[chunyong-lin]

Background

Terraform failed to update DynamoDB AutoScaling target due to invalid value set provisionedThroughput.readCapacityUnits and provisionedThroughput.writeCapacityUnits to -1.

Description

When terraform is making change to provisionedThroughput.readCapacityUnits and provisionedThroughput.writeCapacityUnits, it will set it to -1 first, and then change it to new value we set. However, -1 is invalid value to AWS API. The error message is sent to CloudWatch event, and there is no error output from terraform plan or terraform apply.

The error message in CloudWatch event is 2 validation errors detected: Value '-1' at 'provisionedThroughput.writeCapacityUnits' failed to satisfy constraint: Member must have value greater than or equal to 1; Value '-1' at 'provisionedThroughput.readCapacityUnits' failed to satisfy constraint: Member must have value greater than or equal to 1

Desired Change

Prevent terraform to change provisionedThroughput.readCapacityUnits and provisionedThroughput.writeCapacityUnits set to -1 before new value kicks in.

[chunyong-lin]

Open the issue in terraform repo to get support hashicorp/terraform-provider-aws#3155

[chunyong-lin]

I found out there is a post in AWS development discussion forums (you need to login to your aws console to have read permission), it mentioned that
- Application Auto Scaling automatically creates the SLR in your account when you call RegisterScalableTarget or PutScalingPolicy if you have the IAM CreateServiceLinkedRole permission.

This requirement affects dynamodb table when the autoscale is enabled also. Because in our terraform code, it creates a IAM role for dynamodb autoscale. But eventually, aws will use the service role it created when registering a scale target for autoscale.

The idea to solve this problem is we probably will force to use DynamoDB Autoscaling which is configurable currently. So we can remove the IAM we create for DynamoDB table and use auto-created one instead.

[austinbyers]

Closed via #623

[easyawslearn]

Observed that suggestion of using the Default role provided by AWS, but couldn't found the solutions for what changes require if i want to use my custom IAM role, Please suggest.

[chunyong-lin]

Hi @vijaypatel1985 A work around it is to use AWS created service role dynamodb.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_DynamoDBTable. Please refer to our code at here.

This service role should be existed when enabled autoscale. You can double check it using aws cli if you have list and get iam roles permission.

aws iam get-role --role-name AWSServiceRoleForApplicationAutoScaling_DynamoDBTable

You also can check the role existence from aws console.

Let me know if you have questions.