Getting "diffs didn't match during apply" when creating SQS Queues

[erutherford]

Terraform Version

v0.6.16

Affected Resource(s)

SQS Queues

Terraform Configuration Files

# Topic config
resource "aws_sns_topic" "topic" {
  name = "${element(split(",", var.devs), count.index)}-topic"
  count = "${length(split(",", var.devs))}"
  provider = "aws.development"
  policy = <<EOF
{
  "Version": "2008-10-17",
  "Statement": [
    {
      "Sid": "GrantAccessForMgmtDevAcct",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::${lookup(var.aws_accts, "management")}:user/${element(split(",", var.devs), count.index)}"
      },
      "Action": [
        "SNS:Subscribe",
        "SNS:ListSubscriptionsByTopic",
        "SNS:DeleteTopic",
        "SNS:GetTopicAttributes",
        "SNS:Publish",
        "SNS:RemovePermission",
        "SNS:AddPermission",
        "SNS:Receive",
        "SNS:SetTopicAttributes"
      ],
      "Resource": "arn:aws:sns:${var.aws_region}:${lookup(var.aws_accts, "development")}:${element(split(",", var.devs), count.index)}-topic"
    }
  ]
}
EOF
}

# Queue Config
resource "aws_sqs_queue" "queue" {
  name = "${element(split(",", var.devs), count.index)}-queue"
  count = "${length(split(",", var.devs))}"
  provider = "aws.development"
  policy = <<EOF
{
  "Version": "2012-10-17",
  "Id": "arn:aws:sqs:${var.aws_region}:${lookup(var.aws_accts, "development")}:${element(split(",", var.devs), count.index)}-queue/SQSDefaultPolicy",
  "Statement": [
    {
      "Sid": "GrantAccessForMgmtDevAcct",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::${lookup(var.aws_accts, "management")}:user/${element(split(",", var.devs), count.index)}"
      },
      "Action": "SQS:*",
      "Resource": "arn:aws:sqs:${var.aws_region}:${lookup(var.aws_accts, "development")}:${element(split(",", var.devs), count.index)}-queue"
    },
    {
      "Sid": "GrantAccessForSNSTopic",
      "Effect": "Allow",
      "Principal": {
        "AWS": "*"
      },
      "Action": "SQS:SendMessage",
      "Resource": "arn:aws:sqs:${var.aws_region}:${lookup(var.aws_accts, "development")}:${element(split(",", var.devs), count.index)}-queue",
      "Condition": {
        "ArnEquals": {
          "aws:SourceArn": aws:SourceArn: "${element(aws_sns_topic.queue.*.arn, count.index)}"
        }
      }
    }
  ]
}
EOF
}

Debug Output

https://gist.github.com/erutherford/45f04c908f1008d3e727fc16f147c28b

Expected Behavior

When I run terraform apply I'd expect it to create the SNS Topic, then grab the arn from that topic and substitute that into the SQS run.

Actual Behavior

It throws an error asking me to file a bug.

Steps to Reproduce

Try to reference the arn for an SNS topic in a SQS config

This throws the error This is a bug with Terraform and should be reported as a GitHub Issue.

aws:SourceArn: "${element(aws_sns_topic.queue.*.arn, count.index)}"

Important Factoids

1. It looks like this only happens if the SNS Topic doesn't already exist and is created in the same run. I was able to use this config successfully when the SNS topic already existed.

I can work around this by mapping the arn out manually.

arn:aws:sns:${var.aws_region}:${lookup(var.aws_accts, "development")}:${element(split(",", var.devs), count.index)}-topic

References

None that I could find

[spanktar]

Duplicates #6488

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.