aws_cloudtrail : Tags are not added to cloudtrail even if values are provided on first terraform apply

[RohanArya4894]

Description
Tags are not added to cloudtrail even if values are provided on first terraform apply.
On Second terraform apply, tags are added to cloudtrail.
I am creating an organizational trail with all configurations of cloudtrail enabled.

Terraform Version
Terraform v0.14.4
terraform-aws-provider 3.27.0

Affected Resource(s)
aws_cloudtrail

Code to reproduce:

resource "aws_cloudtrail" "org_trail" {
  name                          = "orgtrail"
  enable_logging                = true
  s3_bucket_name                = "<S3BucketName>"
  enable_log_file_validation    = true
  include_global_service_events = true
  is_organization_trail         = true
  tags = var.tags

  event_selector {
    read_write_type           = "All"
    include_management_events = true

    data_resource {
      type   = "AWS::S3::Object"
      values = ["arn:aws:s3:::"]
    }

    data_resource {
      type   = "AWS::Lambda::Function"
      values = ["arn:aws:lambda"]
    }
  }

  insight_selector {
    insight_type = "ApiCallRateInsight"
  }
}

variable "tags" {
  default = {
    "Env"  = "All"
    "Type" = "OrganizationalTrail"
  }
}

provider "aws" {
  region  = "us-east-1"
}

terraform {
  required_version = ">= 0.13"
  required_providers {
    aws = {
      source = "hashicorp/aws"
      version = "= 3.27.0"
    }
  }
}

Expected Behavior
would create tags on first apply

Actual Behavior
does not create tags on first apply and create them on second apply eventually

Trace Log
2021-02-10T15:12:10.188+0530 [INFO] plugin.terraform-provider-aws_v3.27.0_x5.exe: 2021/02/10 15:12:10 [DEBUG] [aws-sdk-go] {"InsightSelectors":[{"InsightType":"ApiCallRateInsight"}],"TrailARN":"arn:aws:cloudtrail:us-east-1:049589510323:trail/orgtrail"}: timestamp=2021-02-10T15:12:10.188+0530
2021/02/10 15:12:10 [WARN] Provider "registry.terraform.io/hashicorp/aws" produced an unexpected new value for aws_cloudtrail.org_trail, but we are tolerating it because it is using the legacy plugin SDK.
The following problems may be the cause of any confusing errors from downstream operations:

• .kms_key_id: was null, but now cty.StringVal("")
• .tags: element "Env" has vanished
• .tags: element "Type" has vanished
• .cloud_watch_logs_role_arn: was null, but now cty.StringVal("")
• .s3_key_prefix: was null, but now cty.StringVal("")
• .sns_topic_name: was null, but now cty.StringVal("")
• .cloud_watch_logs_group_arn: was null, but now cty.StringVal("")

[RohanArya4894]

Hi I have noticed that this happens when trying to create the cloudtrail resource with same name after destroying it. If we try with the different name which was not previously used for cloudtrail, it works just fine and tags getting applied on first apply only.

[ewbankkit]

This is most likely due to eventual consistency issues with CloudTrail tagging.
There is an issue - #15572 - to capture this behavior.

[github-actions]

Marking this issue as stale due to inactivity. This helps our maintainers find and focus on the active issues. If this issue receives no comments in the next 30 days it will automatically be closed. Maintainers can also remove the stale label.

If this issue was automatically closed and you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thank you!

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.