[awscc v0.34.0] awscc_networkmanager_core_network produces invalid json

[zhujik]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment
• The resources and data sources in this provider are generated from the CloudFormation schema, so they can only support the actions that the underlying schema supports. For this reason submitted bugs should be limited to defects in the generation and runtime code of the provider. Customizing behavior of the resource, or noting a gap in behavior are not valid bugs and should be submitted as enhancements to AWS via the CloudFormation Open Coverage Roadmap.

Terraform CLI and Terraform AWS Cloud Control Provider Version

Terraform v1.3.2
on linux_amd64

• provider registry.terraform.io/hashicorp/aws v4.32.0
• provider registry.terraform.io/hashicorp/awscc v0.34.0

Affected Resource(s)

• awscc_networkmanager_core_network

Terraform Configuration Files

resource "awscc_networkmanager_global_network" "cn" {
  description = "Global Network"
}

resource "awscc_networkmanager_core_network" "cn" {
  description       = "Core Network"
  global_network_id = "NetworkID"
  policy_document   = jsonencode({"hello"="world"})
}

Debug Output

https://gist.github.com/zhujik/e4985d91dd915f1bca3e3db6a5102162

Panic Output

Expected Behavior

Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols:
  + create

Terraform will perform the following actions:

  # awscc_networkmanager_core_network.cn will be created
  + resource "awscc_networkmanager_core_network" "cn" {
      + core_network_arn  = (known after apply)
      + core_network_id   = (known after apply)
      + created_at        = (known after apply)
      + description       = "Core Network"
      + edges             = [
        ] -> (known after apply)
      + global_network_id = "NetworkID"
      + id                = (known after apply)
      + owner_account     = (known after apply)
      + policy_document   = jsonencode(
            {
              + hello = "world"
            }
        )
      + segments          = [
        ] -> (known after apply)
      + state             = (known after apply)
      + tags              = [
        ] -> (known after apply)
    }

  # awscc_networkmanager_global_network.cn will be created
  + resource "awscc_networkmanager_global_network" "cn" {
      + arn         = (known after apply)
      + description = "Global Network"
      + id          = (known after apply)
      + tags        = [
        ] -> (known after apply)
    }

Plan: 2 to add, 0 to change, 0 to destroy.

Actual Behavior

╷
│ Error: Invalid JSON string
│
│   with awscc_networkmanager_core_network.cn,
│   on main.tf line 5, in resource "awscc_networkmanager_core_network" "cn":
│    5: resource "awscc_networkmanager_core_network" "cn" {
│
│ unable to unmarshal JSON: unexpected end of JSON input

Steps to Reproduce

using awscc 0.34.0:

1. terraform plan

this does not happen in awscc 0.33.0!

Important Factoids

References

[breathingdust]

Hi @zhujik! There are some rough edges around the 'policy_document' attribute in this resource, while we work on a more long term fix we do have a guide on how to handle this correctly that should help you get unblocked:

https://registry.terraform.io/providers/hashicorp/aws/latest/docs/guides/using-aws-with-awscc-provider

[ewbankkit]

Relates #509.

[zhujik]

@breathingdust thank you for the reply. However, I get the same error in a full setup. My initial example is just a minimal compiling example of producing the error. Here is a full example:

resource "awscc_networkmanager_global_network" "cn" {
  description = "Global Network"
}

resource "awscc_networkmanager_core_network" "cn" {
  description       = "Core Network"
  global_network_id = awscc_networkmanager_global_network.cn.id
  policy_document   = jsonencode(jsondecode(data.aws_networkmanager_core_network_policy_document.cn.json))
}


data "aws_networkmanager_core_network_policy_document" "cn" {
  core_network_configuration {
    vpn_ecmp_support = false
    asn_ranges       = ["65012-65534"]

    edge_locations {
      location = "eu-west-1"
      asn      = 65012
    }

    edge_locations {
      location = "eu-north-1"
      asn      = 65013
    }
  }

  segments {
    name                          = "cn"
    description                   = "cnSegment"
    require_attachment_acceptance = true
  }

  attachment_policies {
    rule_number     = 100
    condition_logic = "or"

    conditions {
      type = "any"
    }
    action {
      association_method = "constant"
      segment            = "cn"
    }
  }
}

Produces:

$ terraform plan
data.aws_networkmanager_core_network_policy_document.cn: Reading...
data.aws_networkmanager_core_network_policy_document.cn: Read complete after 0s [id=2481843130]
╷
│ Error: Invalid JSON string
│
│   with awscc_networkmanager_core_network.cn,
│   on main.tf line 5, in resource "awscc_networkmanager_core_network" "cn":
│    5: resource "awscc_networkmanager_core_network" "cn" {
│
│ unable to unmarshal JSON: unexpected end of JSON input
╵

So either I am missing something crucial here, or the current version is broken somehow.

[manojkaushal]

Hey,

I have seen this issue and it is due to wrong formatting of the policy document. fixing it works.

[pablo19sc]

Hi:

I have the same issue and I validated that the JSON provided by the data source works as expected.

This is my data source definition:

data "aws_networkmanager_core_network_policy_document" "main" {
  
  core_network_configuration {
    vpn_ecmp_support = false
    asn_ranges       = ["64512-64520"]
    edge_locations {
      location = "us-east-1"
      asn      = 64512
    }
    edge_locations {
      location = "eu-west-1"
      asn = 64513
    }
  }

  segments {
    name = "prod"
    description = "Production traffic"
    require_attachment_acceptance = true
  }
  segments {
    name                          = "shared"
    description                   = "Shared Services"
    require_attachment_acceptance = false
  }

  segment_actions {
    action     = "share"
    mode       = "attachment-route"
    segment    = "shared"
    share_with = ["*"]
  }

  attachment_policies {
    rule_number     = 100
    condition_logic = "or"

    conditions {
      type     = "tag-value"
      operator = "equals"
      key      = "env"
      value    = "shared"
    }
    action {
      association_method = "constant"
      segment            = "shared"
    }
  }

  attachment_policies {
    rule_number     = 200
    condition_logic = "or"

    conditions {
      type     = "tag-value"
      operator = "equals"
      key      = "env"
      value    = "prod"
    }
    action {
      association_method = "constant"
      segment            = "prod"
    }
  }
}

Which returns the following JSON:

cwan_policy = <<EOT
{
  "version": "2021.12",
  "core-network-configuration": {
    "asn-ranges": [
      "64512-64520"
    ],
    "vpn-ecmp-support": false,
    "edge-locations": [
      {
        "location": "us-east-1",
        "asn": 64512
      },
      {
        "location": "eu-west-1",
        "asn": 64513
      }
    ]
  },
  "segments": [
    {
      "name": "prod",
      "description": "Production traffic",
      "isolate-attachments": false,
      "require-attachment-acceptance": true
    },
    {
      "name": "shared",
      "description": "Shared Services",
      "isolate-attachments": false,
      "require-attachment-acceptance": false
    }
  ],
  "attachment-policies": [
    {
      "rule-number": 100,
      "action": {
        "association-method": "constant",
        "segment": "shared"
      },
      "conditions": [
        {
          "type": "tag-value",
          "operator": "equals",
          "key": "env",
          "value": "shared"
        }
      ],
      "condition-logic": "or"
    },
    {
      "rule-number": 200,
      "action": {
        "association-method": "constant",
        "segment": "prod"
      },
      "conditions": [
        {
          "type": "tag-value",
          "operator": "equals",
          "key": "env",
          "value": "prod"
        }
      ],
      "condition-logic": "or"
    }
  ],
  "segment-actions": [
    {
      "action": "share",
      "mode": "attachment-route",
      "segment": "shared",
      "share-with": "*"
    }
  ]
}
EOT

I get the same error: "unable to unmarshal JSON: unexpected end of JSON input"

However, the JSON I got as output is correctly processed by Cloud WAN

[pablo19sc]

Hi @ewbankkit this is working with me with v0.33.0, but getting these errors in v0.34.0.

[ewbankkit]

Relates #685.
It looks like the JSONString PlanModifier is not handling the current value of policy_document being null, which it is when the resource is created.