Trigger destructive update of resource_aws_dynamodb_table_item if range_key has changed

[tuomov-tieto]

Version 1.11 of terraform-provider-aws generates invalid parameters for DynamoDB changes when aws_dynamodb_table_item range_key has changed due to attempting update in-place. This PR changes the provider behaviour to recreate such resources instead. This is useful especially in cases where DynamoDB table uses a composite key, items are created from lists and items in middle of the list are removed.

[tuomov-tieto]

Example case:

resource "aws_dynamodb_table" "dynamo_key_test" {
  name           = "dynamo_key_test"
  read_capacity  = 1
  write_capacity = 1
  hash_key       = "HashKey"
  range_key      = "RangeKey"

  attribute {
    name = "HashKey"
    type = "S"
  }

  attribute {
    name = "RangeKey"
    type = "N"
  }
}

resource "aws_dynamodb_table_item" "dynamo_test_items" {
  count      = "${length(var.items)}"
  table_name = "${aws_dynamodb_table.dynamo_key_test.name}"
  hash_key   = "${aws_dynamodb_table.dynamo_key_test.hash_key}"
  range_key  = "${aws_dynamodb_table.dynamo_key_test.range_key}"

  item = <<ITEM
{
	"HashKey": {"S": "MyHash"},
	"RangeKey": {"N":"${count.index + 1}"},
	"SomeValue": {"S": "${element(var.items, count.index)}"}
}
ITEM
}

variable "items" {
  type = "list"
}

hash_key is kept static in the example above - that may not be very good design but encountered in real-life situation when terraforming configuration for https://github.com/aws-samples/aws-lambda-fanout/

When the value of items changes from ["first", "second", "third"] to ["first", "third"] the apply phase fails:

1 error(s) occurred:

* aws_dynamodb_table_item.dynamo_test_items[1]: 1 error(s) occurred:

* aws_dynamodb_table_item.dynamo_test_items.1: ValidationException: One or more parameter values were invalid: Cannot update attribute RangeKey. This attribute is part of the key
	status code: 400, request id: <...>

[bflad]

LGTM -- thanks for this fix! 🚀

Previously:

make testacc TEST=./aws TESTARGS='-run=TestAccAWSDynamoDbTableItem_updateWithRangeKey'
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./aws -v -run=TestAccAWSDynamoDbTableItem_updateWithRangeKey -timeout 120m
=== RUN   TestAccAWSDynamoDbTableItem_updateWithRangeKey
--- FAIL: TestAccAWSDynamoDbTableItem_updateWithRangeKey (30.72s)
	testing.go:518: Step 1 error: Error applying: 1 error(s) occurred:

		* aws_dynamodb_table_item.test: 1 error(s) occurred:

		* aws_dynamodb_table_item.test: ValidationException: One or more parameter values were invalid: Cannot update attribute rangeKey. This attribute is part of the key
			status code: 400, request id: L1P9N1I61KTNJ6SI04UND6PKIJVV4KQNSO5AEMVJF66Q9ASUAAJG
FAIL
FAIL	github.com/terraform-providers/terraform-provider-aws/aws	30.771s
make: *** [testacc] Error 1

Now:

5 tests passed (all tests)
=== RUN   TestAccAWSDynamoDbTableItem_withMultipleItems
--- PASS: TestAccAWSDynamoDbTableItem_withMultipleItems (15.58s)
=== RUN   TestAccAWSDynamoDbTableItem_basic
--- PASS: TestAccAWSDynamoDbTableItem_basic (16.95s)
=== RUN   TestAccAWSDynamoDbTableItem_updateWithRangeKey
--- PASS: TestAccAWSDynamoDbTableItem_updateWithRangeKey (21.93s)
=== RUN   TestAccAWSDynamoDbTableItem_update
--- PASS: TestAccAWSDynamoDbTableItem_update (26.87s)
=== RUN   TestAccAWSDynamoDbTableItem_rangeKey
--- PASS: TestAccAWSDynamoDbTableItem_rangeKey (52.71s)

[bflad]

This has been released in version 1.14.1 of the AWS provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thanks!