elasticache tag lookups happen in wrong account when assuming cross account iam roles in aws

[potto007]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform Version

Terraform v0.11.7
+ provider.aws v1.25.0

Affected Resource(s)

• aws_elasticache

Debug Output

https://gist.github.com/potto007/dc0cda64709c346d888e7ff2f9905f74

Expected Behavior

Terraform creates, reads, updates, and deletes tags for elasticache.

Actual Behavior

Terraform aborts with errors that the elasticache resources do not exist.

Steps to Reproduce

0. create a tf file that defines an aws_elasticache_cluster and tags for that cluster
1. assume role to another aws account
2. terraform apply

References

• rds resources tag looks ups happen in wrong account when assuming cross account iam roles in aws #1189

The root cause for this issue is the same as the root cause for #1189.

[bflad]

Potentially related to #5021 and #1615

[bflad]

This issue should be resolved by #5177 which was released in version 1.31.0 of the AWS provider. The updated provider initialization process uses new two methods to try and enhance the account ID lookup:

• Using account ID of the assume role ARN if provided in the provider configuration
• Using account ID found in the sts:GetCallerIdentity call as part of the "credentials validation" portion of the provider initialization (requires that skip_credentials_validation is not enabled, of course 😄 ) -- this occurs before other calls to EC2 Metadata and fallback IAM calls.

If this issue is not resolved by version 1.31.0, we can certainly reopen this. 👍 Thanks!

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thanks!