resource/aws_ssm_document: Unable to Share with more than 20 Accounts

[brandonstevens]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform Version

$ terraform -v
Terraform v0.11.7
+ provider.aws v1.28.0

Affected Resource(s)

• aws_ssm_document

Terraform Configuration Files

locals {
  # 25 randomly generated Account IDs
  account_ids = [
    "118535508916",
    "154276429936",
    "161759918038",
    "194598394645",
    "196052683219",
    "247493144767",
    "250493209165",
    "316287036670",
    "387227595876",
    "425170165879",
    "445725168100",
    "539904583428",
    "590030253021",
    "623181299604",
    "630469292428",
    "636729286444",
    "661009953133",
    "674645499404",
    "689964341709",
    "714964602168",
    "725131050115",
    "751712731274",
    "758789874641",
    "958531182898",
    "977656872983",
  ]
}

resource "aws_ssm_document" "foo" {
  name          = "test_document"
  document_type = "Command"

  permissions {
    type        = "Share"
    account_ids = "${join(",", local.account_ids)}"
  }

  content = <<DOC
  {
    "schemaVersion": "1.2",
    "description": "Check ip configuration of a Linux instance.",
    "parameters": {

    },
    "runtimeConfig": {
      "aws:runShellScript": {
        "properties": [
          {
            "id": "0.aws:runShellScript",
            "runCommand": ["ifconfig"]
          }
        ]
      }
    }
  }
DOC
}

Output

Error: Error applying plan:

1 error(s) occurred:

* aws_ssm_document.foo: 1 error(s) occurred:

* aws_ssm_document.foo: [ERROR] Error setting permissions for SSM document: ValidationException: 1 validation error detected: Value '[118535508916, 154276429936, 161759918038, 194598394645, 196052683219, 247493144767, 250493209165, 316287036670, 387227595876, 425170165879, 445725168100, 539904583428, 590030253021, 623181299604, 630469292428, 636729286444, 661009953133, 674645499404, 689964341709, 714964602168, 725131050115, 751712731274, 758789874641, 958531182898, 977656872983]' at 'accountIdsToAdd' failed to satisfy constraint: Member must have length less than or equal to 20
	status code: 400, request id: e3b47fc5-f335-42c6-8e7c-aa1d17780b06

Expected Behavior

• Terraform works within the API limit and is able to share the document with more than 20 Accounts

Actual Behavior

• Terraform makes a single API call which fails due to the limit

Steps to Reproduce

1. terraform apply

Important Factoids

• According to AWS Support, they do not currently support raising this limit.

References

• resource/aws_ssm_document: Issues with Document Permissions #5308

[bflad]

For additional clarification, here is the relevant item from https://docs.aws.amazon.com/general/latest/gr/aws_service_limits.html

A single Systems Manager document can be shared with a maximum of 1000 AWS accounts.

If you're looking for implementation ideas, its not the prettiest, but I recently did this type of request batching for Kinesis tagging: #4574

[bflad]

The fix for this has been merged and will release with version 1.52.0 of the AWS provider, likely middle of next week.

[bflad]

This has been released in version 1.52.0 of the AWS provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thanks!