[Bug]: v5.31.0 - aws_lb - 'ValidationError: Attributes cannot be empty' on apply for existing NLB in GovCloud (but appears to actually work?)

[ghost]

Terraform Core Version

1.5.7

AWS Provider Version

5.31.0

Affected Resource(s)

• aws_lb

Expected Behavior

Upgraded provider from v5.22.0 --> v5.31.0, in response to issue #34135 being marked as resolved. Expected re-apply of Terraform configuration to upgrade all resources to latest provider configuration (v5.31.0).``

Actual Behavior

Attempted to re-apply Terraform configuration (with no other changes) to an existing NLB in GovCloud, which produced the following error: "ValidationError: Attributes cannot be empty."

If you then re-execute a terraform apply (or terraform plan), Terraform shows no changes required.

Relevant Error/Panic Output Snippet

Terraform will perform the following actions:

  # module.lb.aws_lb.this will be updated in-place
  ~ resource "aws_lb" "this" {
      + dns_record_client_routing_policy = "any_availability_zone"
        id                               = "<REDACTED>"
        name                             = "<REDACTED>"
        tags                             = {}
        # (13 unchanged attributes hidden)

        # (3 unchanged blocks hidden)
    }

Plan: 0 to add, 1 to change, 0 to destroy.

Do you want to perform these actions?
  Terraform will perform the actions described above.
  Only 'yes' will be accepted to approve.

  Enter a value: yes

module.lb.aws_lb.this: Modifying... [id=<REDACTED>]
|
│ Error: modifying ELBv2 Load Balancer (<REDACTED>) attributes: ValidationError: Attributes cannot be empty
│       status code: 400, request id: c3bdeeec-4853-4edb-8d81-30a404f52223
│ 
│   with module.lb.aws_lb.this,
│   on .terraform/modules/lb/main.tf line 9, in resource "aws_lb" "this":
│    9: resource "aws_lb" "this" {
│ 
|

Terraform Configuration Files

resource "aws_lb" "this" {
load_balancer_type = "network"

name = "some-name"
internal = true
subnets = ["subnet-id-1", "subnet-id-2"]

enable_deletion_protection = true
enable_cross_zone_load_balancing = true
}

Steps to Reproduce

1. Update hashicorp/aws provider version constraint from ~> 5.0, <= 5.22 --> ~> 5.31
2. Execute terraform init -upgrade to update the provider version
3. Execute terraform apply to (attempt) upgrade of all resources
4. Observe "ValidationError: Attributes cannot be empty"
5. Re-run terraform apply (or terraform plan)
6. Observe that Terraform shows the infrastructure matches the configuration

Debug Output

No response

Panic Output

No response

Important Factoids

• Network Load Balancer (NLB)
• in GovCloud partition (us-gov-west-1)
• existing NLB resource

References

Would you like to implement a fix?

No

[github-actions]

Community Note

Voting for Prioritization

• Please vote on this issue by adding a 👍 reaction to the original post to help the community and maintainers prioritize this request.
• Please see our prioritization guide for information on how we prioritize.
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request.

Volunteering to Work on This Issue

• If you are interested in working on this issue, please leave a comment.
• If this would be your first contribution, please review the contribution guide.

[MetricMike]

The logic to drop the attribute in https://github.com/hashicorp/terraform-provider-aws/blob/c95fffbb4f29a9408e223ccfb9e5bd648b83a83f/internal/service/elbv2/load_balancer.go#L675C72-L675C72 is working correctly - in CloudTrail I can see the ValidationError get thrown because the attribute isn't supported, and then a second ModifyLoadBalancerAttributes request is sent without that attribute - if that was the only thing that changed, as seen in the snippet above the request fails because ModifyLoadBalancerAttributes expects a non-empty attribute list.

As a workaround, you can add:

lifecycle {
  ignore_changes = [dns_record_client_routing_policy]
}

and then a plan/apply will succeed. You can remove the ignore_changes block after terraform succeeds and records the updated state.

But a permanent fix should include not updating if that list is empty. Not sure exactly how the provider is "retrying" that request though.

[github-actions]

This functionality has been released in v5.32.0 of the Terraform AWS Provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template. Thank you!

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.