IAM service-linked role creation fails for AWS China

[n1cholasgeorge]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform Version

Terraform v0.12.13

• provider.aws v2.34.0

Affected Resource(s)

Terraform v0.12.13

• provider.aws v2.34.0

Terraform Configuration Files

resource "aws_iam_service_linked_role" "es" {
  aws_service_name = "es.cn-northwest-1.amazonaws.com.cn"
}

Debug Output

'''
https://gist.github.com/n1cholasgeorge/8dceb76d495784baeb54c19409ad3e5d
'''

Expected Behavior

Success

Actual Behavior

Error: "aws_service_name" must be a service URL e.g. elasticbeanstalk.amazonaws.com

Possibly due to the aws china endpoint address ending .com.cn

[bflad]

Hi @n1cholasgeorge 👋 Thank you for reporting this and sorry you ran into trouble with this resource.

The errant validation logic can be found here: https://github.com/terraform-providers/terraform-provider-aws/blob/f39af7fff691603f5dc5b553c618d1dbdb6ea0df/aws/resource_aws_iam_service_linked_role.go#L31-L38

If someone is interested in fixing this, my recommendation would be either allow all known suffixes (such as AWS Commercial/GovCloud (US) amazonaws.com, AWS China amazonaws.com.cn, AWS C2S c2s.ic.gov, and AWS SC2S sc2s.sgov.gov) or more preferably, just check for the presence of a period (.) since the idea behind this validation was to prevent mistakes such as just putting the service name (e.g. es):

				ValidateFunc: func(v interface{}, k string) (ws []string, es []error) {
					value := v.(string)
					if !strings.Contains(value, ".") {
						es = append(es, fmt.Errorf(
							"%q must be a full service hostname e.g. elasticbeanstalk.amazonaws.com", k))
					}
					return
				},

[ghost]

I'm going to close this issue due to inactivity (90 days without response ⏳ ). This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thanks!

[bflad]

Submitted bug fix: #11919

[bflad]

The fix for this has been merged and will release with version 2.52.0 of the Terraform AWS Provider, Thursday this week.

[ghost]

This has been released in version 2.52.0 of the Terraform AWS provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template for triage. Thanks!

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thanks!