Refresh phase fails if Shield Protection was manually removed

[mkielar]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform CLI and Terraform AWS Provider Version

Affected Resource(s)

• aws_shield_protection

Terraform Configuration Files

Please include all Terraform configurations required to reproduce the bug. Bug reports without a functional reproduction may be closed without investigation.

resource "aws_shield_protection" "nat_eip" {
  count = var.enabled && var.vpc_enable_nat_gateway && var.enable_shield_protection ? local.nat_gateway_count : 0

  name         = "${var.vpc_name}-nat-eip-${module.vpc.nat_ids[count.index]}"
  resource_arn = "arn:aws:ec2:${data.aws_region.current.name}:${data.aws_caller_identity.current.account_id}:eip-allocation/${module.vpc.nat_ids[count.index]}"
}

Debug Output

N/A

Panic Output

N/A

Expected Behavior

Terraform should see that both the protected resource and the protection were removed from AWS and recreate them.

Actual Behavior

Terraform fails with:

Error: error reading Shield Protection ([MASKED]): ResourceNotFoundException: The referenced protection does not exist.
{
  RespMetadata: {
    StatusCode: 400,
    RequestID: "[MASKED]"
  },
  Message_: "The referenced protection does not exist."
}

Steps to Reproduce

1. terraform apply
2. Manuall destroy the protection from AWS Shield Console
3. terraform apply

[mkielar]

As a workaround it's possible to try running terraform destroy with -refresh=false flag, which on one hand allows Terraform do remove aws_shield_protection resources from the statefile.

On the other hand running with -refresh=false causes a gazzilion of failures on other resources that suddenly did not expect nulls in different places, so it's not really an option for us in fully automated CICD.

[mkielar]

I think the issue is with returning an error here:
https://github.com/hashicorp/terraform-provider-aws/blob/main/aws/resource_aws_shield_protection.go#L60-L62

without first examining it for "resource not found" situation, similar to what's done here:
https://github.com/hashicorp/terraform-provider-aws/blob/main/aws/resource_aws_iam_role.go#L240-L244

The describe_protection method raises ResourceNotFoundException according to docs, which should be checked in the resource *Read method, and processed correctly without failing.

[ewbankkit]

A _disappears acceptance test would have caught this 😄.

[ghost]

This has been released in version 3.39.0 of the Terraform AWS provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template for triage. Thanks!

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.