TF FIS action aws:ecs:stop-task validates fine (only 5 allowed values), but when apply cause ValidationException

[dhartford]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform CLI and Terraform AWS Provider Version

Terraform v0.14.7

• provider registry.terraform.io/hashicorp/aws v4.27.0

Affected Resource(s)

aws_fis_experiment_template

Terraform Configuration Files

Please include all Terraform configurations required to reproduce the bug. Bug reports without a functional reproduction may be closed without investigation.

resource "aws_fis_experiment_template" "fis_test" {
  action {
    name      = "terminateFargateTasks"
    action_id = "aws:ecs:stop-task"
    role_arn    = "arn:aws:iam::XXXX:role/FisRole"


      #key: Clusters, DBInstances (RDS), Instances (Ec2)  ##2022-08-25  ValidationException: Unexpected target "Clusters" found in action
    target {
      key   = "Clusters" #Clusters is failing oddly...but 'terraform validate' is passing. Putting in "asdf" terraform validate fails. (TF 0.14.7 cli / aws 4.27.0)
      value = "target-fargatetasks" 
    }
  }// end action

target {
    name           = "target-fargatetasks"
    resource_type  = "aws:ecs:task"
    selection_mode = "ALL" #case sensitive, ALL, COUNT(number),PERCENT(number)
    resource_tag {
      key   = "STAGE"
      value = "dev"
    }
    filter {
        path = "Placement.AvailabilityZone"
        values = ["us-east-1a"] 
    }
    filter{
        path = "State.Name"
        values = ["running"]  
    }
 
  }//end target
}

Debug Output

Expected Behavior

terraform apply should have been successful without validation exception.

Actual Behavior

Steps to Reproduce

1. terraform apply

Important Factoids

When changing target to lowercase 'clusters':

References

[justinretzolk]

Hey @dhartford 👋 Thank you for taking the time to raise this! Admittedly, this isn't a resource I've encountered before, but I did a bit of reading and believe I may have figured out what the issue is here. I think the AWS API error message that's getting passed through isn't very helpful in this case, as I don't think the key is the issue, but rather the value is. The two main resources that helped were the example in the resource documentation and the AWS example documentation.

Based on those documents, I suspect the issue here is that you need to define a target in addition to the action.target. In the target argument, you define a resource type, selection mode, etc., and then give it a friendly name. Then, in the action.target.value argument, you would supply this friendly name. I'll paste the example from the Terraform docs below to save you a click. In the example, a target called example-target is defined, and then in the action.target.value, that friendly name is used.

resource "aws_fis_experiment_template" "example" {
  description = "example"
  role_arn    = aws_iam_role.example.arn

  stop_condition {
    source = "none"
  }

  action {
    name      = "example-action"
    action_id = "aws:ec2:terminate-instances"

    target {
      key   = "Instances"
      value = "example-target"
    }
  }

  target {
    name           = "example-target"
    resource_type  = "aws:ec2:instance"
    selection_mode = "COUNT(1)"

    resource_tag {
      key   = "env"
      value = "example"
    }
  }
}

[dhartford]

thanks for taking a peek @justinretzolk , I've updated with the full configuration example (modified for sensitive information).

[dhartford]

Further trial/error, honing in on that is something around these values that are the challenge related to the aws:ecs:stop-task action id:

fis action:

action_id = "aws:ecs:stop-task"

fis target:

resource_type = "aws:ecs:task"

FURTHER clarification, it seems the drain-container only works on EC2 launch types in ECS, -not- Fargate, so the aws:ecs:stop-task is critically important for fargate based workloads

This is based on the below being able to terraform apply fine, while the original aws:ecs:stop-task would error with validationexception. One of the usecases was to do chaos testing on full AZ down (simulate unexpected) so a full stop-task would be more relevant than a drain for this scenario.

resource "aws_fis_experiment_template" "fis_test" {
  action {
    name      = "terminateFargateTasks"
#    action_id = "aws:ecs:stop-task"
     action_id = "aws:ecs:drain-container-instances"
    role_arn    = "arn:aws:iam::XXXX:role/FisRole"

    #required only for aws:ecs:drain-container-instances
    parameter {
      key = "drainagePercentage"
      value = "100" 
    }


      #key: Clusters, DBInstances (RDS), Instances (Ec2)  ##2022-08-25  ValidationException: Unexpected target "Clusters" found in action
    target {
      key   = "Clusters" #Clusters is failing oddly...but 'terraform validate' is passing. Putting in "asdf" terraform validate fails. (TF 0.14.7 cli / aws 4.27.0)
      value = "target-fargatetasks" 
    }
  }// end action

target {
    name           = "target-fargatetasks"
#    resource_type  = "aws:ecs:task"
    resource_type  = "aws:ecs:cluster"

    selection_mode = "ALL" #case sensitive, ALL, COUNT(number),PERCENT(number)
    resource_tag {
      key   = "STAGE"
      value = "dev"
    }
    filter {
        path = "Placement.AvailabilityZone"
        values = ["us-east-1a"] 
    }
    filter{
        path = "State.Name"
        values = ["running"]  
    }
 
  }//end target
}

[yipsmith]

Any work arounds? Seems like we are still not able to create FIS templates via TF with the aws:ecs:stop-task action.
Keep getting ValidationException: Unexpected target "Clusters" found in action "terminate-fargate-tasks"

or Error: expected action.0.target.0.key to be one of [Clusters DBInstances Instances SpotInstances Nodegroups Roles], got Tasks

Any way we can add Tasks for ECS as a acceptable target key?

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.