Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Bug]: aws_ecs_task_definition incorrectly adds appProtocol to empty portMappings #38779

Closed
mball-agathos opened this issue Aug 8, 2024 · 11 comments · Fixed by #38870
Closed
Assignees
Labels
bug Addresses a defect in current functionality. regression Pertains to a degraded workflow resulting from an upstream patch or internal enhancement. service/ecs Issues and PRs that pertain to the ecs service.
Milestone

Comments

@mball-agathos
Copy link

Terraform Core Version

1.5.7

AWS Provider Version

5.61.0

Affected Resource(s)

aws_ecs_task_definition

Expected Behavior

When creating a new task definition with portMapping set to an empty list, it should stay an empty list during the terraform plan phase.

Actual Behavior

I see this terraform plan (with a few unrelated changes removed):

/+ resource "aws_ecs_task_definition" "this" {
      ~ container_definitions    = jsonencode(
          ~ [ # forces replacement
              ~ {
                  - essential         = true -> null
                    name              = "redash"
                  + portMappings      = [
                      + {
                          + appProtocol = ""
                          + protocol    = ""
                        },
                    ]
                    # (9 unchanged elements hidden)
                } # forces replacement,
            ]
        )
        # (8 unchanged attributes hidden)
    }

In particular, this provider is now inserting the appProtocol and protocol attributes into what should have been an empty portMappings list.

This then triggers an error later about an "Invalid 'containerPort'" because this portMapping is no longer empty.

Relevant Error/Panic Output Snippet

│ Error: creating ECS Task Definition (my-service): operation error ECS: RegisterTaskDefinition, https response error StatusCode: 400, RequestID: ..., ClientException: Invalid 'containerPort' setting for container 'redash'.
│ 
│   with module.ecs-service["my-service"].aws_ecs_task_definition.this,
│   on ../../modules/aws/ecs-service/main.tf line 130, in resource "aws_ecs_task_definition" "this":
│  130: resource "aws_ecs_task_definition" "this" {
│

Terraform Configuration Files

n/a

Steps to Reproduce

Create a new ecs task definition with portMappings: []

Debug Output

No response

Panic Output

No response

Important Factoids

This is a regression. This used to work correctly in aws version 5.56.1. This broke sometime between that version and 5.61.0

References

No response

Would you like to implement a fix?

No

@mball-agathos mball-agathos added the bug Addresses a defect in current functionality. label Aug 8, 2024
Copy link

github-actions bot commented Aug 8, 2024

Community Note

Voting for Prioritization

  • Please vote on this issue by adding a 👍 reaction to the original post to help the community and maintainers prioritize this request.
  • Please see our prioritization guide for information on how we prioritize.
  • Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request.

Volunteering to Work on This Issue

  • If you are interested in working on this issue, please leave a comment.
  • If this would be your first contribution, please review the contribution guide.

@github-actions github-actions bot added the service/ecs Issues and PRs that pertain to the ecs service. label Aug 8, 2024
@terraform-aws-provider terraform-aws-provider bot added the needs-triage Waiting for first response or review from a maintainer. label Aug 8, 2024
@mball-agathos mball-agathos changed the title [Bug]: aws_ecs_task_definition incorrectly adds appProtocol to empty portMapping [Bug]: aws_ecs_task_definition incorrectly adds appProtocol to empty portMappings Aug 8, 2024
@mball-agathos
Copy link
Author

@ewbankkit as FYI, I see the AppProtocol and Protocol fields getting added to the PortMappings between versions 5.58.0 and 5.60.0:

#38622

Do you know offhand whether that PR could have caused new fields to get added to the portMappings in addition to any camelCase updates? Thanks!

@ewbankkit ewbankkit added regression Pertains to a degraded workflow resulting from an upstream patch or internal enhancement. and removed needs-triage Waiting for first response or review from a maintainer. labels Aug 9, 2024
@ewbankkit ewbankkit self-assigned this Aug 9, 2024
@terraform-aws-provider terraform-aws-provider bot added the prioritized Part of the maintainer teams immediate focus. To be addressed within the current quarter. label Aug 9, 2024
@ewbankkit
Copy link
Contributor

@mball-agathos Thanks for raising this issue 👏.
Could you please paste in the relevant Terraform configuration?

@ewbankkit ewbankkit added the waiting-response Maintainers are waiting on response from community or contributor. label Aug 9, 2024
@mball-agathos
Copy link
Author

mball-agathos commented Aug 9, 2024

Hi @ewbankkit

I haven't worked out a minimal configuration, but from looking at the example provided at https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ecs_task_definition and removing extra stuff, I get something like this:

resource "aws_ecs_task_definition" "service" {
  family = "service"
  container_definitions = jsonencode([
    {
      name      = "first"
      image     = "service-first"
      cpu       = 10
      memory    = 512
      essential = true
      portMappings = [
        {}
      ]
    }
  ])
}

The key part here is that the portMappings contains an empty list with just an empty object.

The terraform plan for this looks like this:

  # aws_ecs_task_definition.service will be created
  + resource "aws_ecs_task_definition" "service" {
      + arn                   = (known after apply)
      + arn_without_revision  = (known after apply)
      + container_definitions = jsonencode(
            [
              + {
                  + cpu          = 10
                  + essential    = true
                  + image        = "service-first"
                  + memory       = 512
                  + name         = "first"
                  + portMappings = [
                      + {
                          + appProtocol = ""
                          + protocol    = ""
                        },
                    ]
                },
            ]
        )
      + family                = "service"
      + id                    = (known after apply)
      + network_mode          = (known after apply)
      + revision              = (known after apply)
      + skip_destroy          = false
      + tags_all              = {
...
        }
      + track_latest          = false
    }

Notice the inserted appProtocol and protocol in the portMappings.

@github-actions github-actions bot removed the waiting-response Maintainers are waiting on response from community or contributor. label Aug 9, 2024
@mball-agathos
Copy link
Author

mball-agathos commented Aug 12, 2024

Also, it looks like this will also reproduce the error (i.e., using null instead of an empty object):

resource "aws_ecs_task_definition" "service" {
  family = "service"
  container_definitions = jsonencode([
    {
      name      = "first"
      image     = "service-first"
      cpu       = 10
      memory    = 512
      essential = true
      portMappings = [
        null
      ]
    }
  ])
}

@dimaman2001
Copy link

The key part here is that the portMappings contains an empty list with just an empty object.

Its not an empty list then. Why would you want to add an empty port mapping object rather than just having a zero size list? AKA

portMappings = []

@mball-agathos
Copy link
Author

In my particular case, the ultimate portMappings was generated via this logic:

  "portMappings": port_mappings != null ? [
    for map_object in port_mappings : (
      map_object.port != null ? {
        "name": "${map_object.name}",
        "containerPort": tonumber(map_object.port),
        "hostPort": tonumber(coalesce(map_object.host_port, map_object.port)),
        "protocol": coalesce("${map_object.protocol}", "tcp")
      } : null
    )
  ] : [],

This particular code will end up generating [{}] if the port_mappings input has an empty object.

All said, I've finished writing this particular logic on my side to avoid generating an empty object and we've been able to move on, but I do expect that a subset of existing users will run into a similar problem if they have similar generator logic for their port mappings.

@ewbankkit
Copy link
Contributor

ewbankkit commented Aug 14, 2024

Verified that this is a change in behavior between v5.58.0 and v5.62.0:

v5.58.0

% terraform apply
Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following
symbols:
  + create

Terraform will perform the following actions:

  # aws_ecs_task_definition.service will be created
  + resource "aws_ecs_task_definition" "service" {
      + arn                   = (known after apply)
      + arn_without_revision  = (known after apply)
      + container_definitions = jsonencode(
            [
              + {
                  + cpu          = 10
                  + essential    = true
                  + image        = "service-first"
                  + memory       = 512
                  + name         = "first"
                  + portMappings = []
                },
            ]
        )
      + family                = "ewbankkit-test-001"
      + id                    = (known after apply)
      + network_mode          = (known after apply)
      + revision              = (known after apply)
      + skip_destroy          = false
      + tags_all              = (known after apply)
      + track_latest          = false
    }

Plan: 1 to add, 0 to change, 0 to destroy.

Do you want to perform these actions?
  Terraform will perform the actions described above.
  Only 'yes' will be accepted to approve.

  Enter a value: yes

aws_ecs_task_definition.service: Creating...
aws_ecs_task_definition.service: Creation complete after 0s [id=ewbankkit-test-001]

Apply complete! Resources: 1 added, 0 changed, 0 destroyed.

v5.62.0

% terraform apply
Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following
symbols:
  + create

Terraform will perform the following actions:

  # aws_ecs_task_definition.service will be created
  + resource "aws_ecs_task_definition" "service" {
      + arn                   = (known after apply)
      + arn_without_revision  = (known after apply)
      + container_definitions = jsonencode(
            [
              + {
                  + cpu          = 10
                  + essential    = true
                  + image        = "service-first"
                  + memory       = 512
                  + name         = "first"
                  + portMappings = [
                      + {},
                    ]
                },
            ]
        )
      + family                = "ewbankkit-test-001"
      + id                    = (known after apply)
      + network_mode          = (known after apply)
      + revision              = (known after apply)
      + skip_destroy          = false
      + tags_all              = (known after apply)
      + track_latest          = false
    }

Plan: 1 to add, 0 to change, 0 to destroy.

Do you want to perform these actions?
  Terraform will perform the actions described above.
  Only 'yes' will be accepted to approve.

  Enter a value: yes

aws_ecs_task_definition.service: Creating...
╷
│ Error: creating ECS Task Definition (ewbankkit-test-001): operation error ECS: RegisterTaskDefinition, https response error StatusCode: 400, RequestID: 75147d53-07c7-4cb3-bcc6-ad0da7038c07, ClientException: Invalid 'containerPort' setting for container 'first'.
│ 
│   with aws_ecs_task_definition.service,
│   on main.tf line 3, in resource "aws_ecs_task_definition" "service":
│    3: resource "aws_ecs_task_definition" "service" {
│ 
╵

Relates #38016.

Copy link

Warning

This issue has been closed, meaning that any additional comments are hard for our team to see. Please assume that the maintainers will not see them.

Ongoing conversations amongst community members are welcome, however, the issue will be locked after 30 days. Moving conversations to another venue, such as the AWS Provider forum, is recommended. If you have additional concerns, please open a new issue, referencing this one where needed.

@github-actions github-actions bot added this to the v5.63.0 milestone Aug 14, 2024
@github-actions github-actions bot removed the prioritized Part of the maintainer teams immediate focus. To be addressed within the current quarter. label Aug 15, 2024
Copy link

This functionality has been released in v5.63.0 of the Terraform AWS Provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template. Thank you!

Copy link

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.

@github-actions github-actions bot locked as resolved and limited conversation to collaborators Sep 15, 2024
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
bug Addresses a defect in current functionality. regression Pertains to a degraded workflow resulting from an upstream patch or internal enhancement. service/ecs Issues and PRs that pertain to the ecs service.
Projects
None yet
3 participants