[BUG] Lex Bot Resource Creation/Update Fails with Provider State Inconsistency Error

[fakhtar]

Issue: Lex Bot Resource Creation/Update Fails with Provider State Inconsistency Error

Description

When creating or updating an awscc_lex_bot resource, the provider fails during terraform apply with a state inconsistency error related to the bot_locales attribute. The error occurs both during initial creation and subsequent updates of the bot but the bot is created successfully.

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment
• The resources and data sources in this provider are generated from the CloudFormation schema, so they can only support the actions that the underlying schema supports. For this reason submitted bugs should be limited to defects in the generation and runtime code of the provider. Customizing behavior of the resource, or noting a gap in behavior are not valid bugs and should be submitted as enhancements to AWS via the CloudFormation Open Coverage Roadmap.

Terraform CLI and Terraform AWS Cloud Control Provider Version

• Terraform AWSCC Provider Version: 1.19.0 (also reproduced in 1.17.0)
• Terraform Version: hashicorp/terraform:1.9.6 running docker contains in GitLab CI CD pipeline.
• AWS Region: us-east-1

terraform -v
Terraform v1.9.6
on linux_amd64

Affected Resource(s)

• awscc_lex_bot

Terraform Configuration Files

terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
    awscc = {
      source  = "hashicorp/awscc"
      version = "~> 1.19.0"
    }
  }
  backend "s3" {}
}


provider "awscc" {
  region = var.region
  assume_role = {
    role_arn = var.resource_role_arn
  }
}

provider "aws" {
  region = var.region
  assume_role {
    role_arn = var.resource_role_arn
  }
}

resource "awscc_lex_bot" "demo_lexv2_bot" {
  name     = "botTest"
  role_arn = aws_iam_role.lex_role.arn
  data_privacy = {
    child_directed = false
  }
  idle_session_ttl_in_seconds = 300
  auto_build_bot_locales      = true
  bot_locales = [
    {
      locale_id                = "en_US",
      nlu_confidence_threshold = 0.7,
      voice_settings = {
        engine   = "standard"
        voice_id = "Kevin"
      },
      intents = [
        {
          name = "Sales",
          sample_utterances = [
            {
              utterance = "sales"
            }
          ],
          dialog_code_hook = {
            enabled = false
          },
          fulfillment_code_hook = {
            enabled = false
          }
        },
        {
          name = "Finance",
          sampleUtterances = [
            {
              utterance = "finance"
            }
          ],
          dialogCodeHook = {
            enabled = false
          },
          fulfillment_codeHook = {
            enabled = false
          }
        },
        {
          name        = "FallbackIntent",
          description = "Default intent when no other intent matches",
          dialog_code_hook = {
            enabled = false
          },
          fulfillment_code_hook = {
            enabled = false
          },
          parent_intent_signature = "AMAZON.FallbackIntent"
        }
      ]
    }
  ]
}

resource "aws_iam_role" "lex_role" {
  name = "lex_bot_role"

  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = "sts:AssumeRole"
        Effect = "Allow"
        Principal = {
          Service = "lexv2.amazonaws.com"
        }
      }
    ]
  })
}

Debug Output

Including 2 Gist
Default
https://gist.github.com/fakhtar/aeefd167a90c0a7396e8f0dafc426cc2
Log Level TRACE
https://gist.github.com/fakhtar/deb7880618ddc2285050e8d46c6aead8

Panic Output

Expected Behavior

1. Configure the AWSCC provider:

provider "awscc" {
  region = var.region
  assume_role = {
    role_arn = var.resource_role_arn
  }
}

2. Create a minimal Lex bot configuration:

resource "awscc_lex_bot" "demo_lexv2_bot" {
  name     = "botTest"
  role_arn = aws_iam_role.lex_role.arn
  data_privacy = {
    child_directed = false
  }
  idle_session_ttl_in_seconds = 300
  auto_build_bot_locales      = true
  bot_locales = [
    {
      locale_id                = "en_US"
      nlu_confidence_threshold = 0.7
      voice_settings = {
        engine   = "standard"
        voice_id = "Kevin"
      }
      intents = [
        {
          name = "Sales"
          sample_utterances = [
            {
              utterance = "sales"
            }
          ]
          dialog_code_hook = {
            enabled = false
          }
          fulfillment_code_hook = {
            enabled = false
          }
        },
        {
          name        = "FallbackIntent"
          description = "Default intent when no other intent matches"
          dialog_code_hook = {
            enabled = false
          }
          fulfillment_code_hook = {
            enabled = false
          }
          parent_intent_signature = "AMAZON.FallbackIntent"
        }
      ]
    }
  ]
}

3. Run terraform plan
4. Run terraform apply
5. Bot creation should complete successfully without errors.

Actual Behavior

Steps to Reproduce

1. Configure the AWSCC provider:

provider "awscc" {
  region = var.region
  assume_role = {
    role_arn = var.resource_role_arn
  }
}

2. Create a minimal Lex bot configuration:

resource "awscc_lex_bot" "demo_lexv2_bot" {
  name     = "botTest"
  role_arn = aws_iam_role.lex_role.arn
  data_privacy = {
    child_directed = false
  }
  idle_session_ttl_in_seconds = 300
  auto_build_bot_locales      = true
  bot_locales = [
    {
      locale_id                = "en_US"
      nlu_confidence_threshold = 0.7
      voice_settings = {
        engine   = "standard"
        voice_id = "Kevin"
      }
      intents = [
        {
          name = "Sales"
          sample_utterances = [
            {
              utterance = "sales"
            }
          ]
          dialog_code_hook = {
            enabled = false
          }
          fulfillment_code_hook = {
            enabled = false
          }
        },
        {
          name        = "FallbackIntent"
          description = "Default intent when no other intent matches"
          dialog_code_hook = {
            enabled = false
          }
          fulfillment_code_hook = {
            enabled = false
          }
          parent_intent_signature = "AMAZON.FallbackIntent"
        }
      ]
    }
  ]
}

3. Run terraform plan (completes successfully)
4. Run terraform apply (fails with above error)

Steps to Reproduce

Important Factoids

• The error occurs consistently across multiple provider versions (1.17.0, 1.19.0)
• The issue manifests both during initial creation and updates of the bot
• terraform plan completes successfully, suggesting the configuration is valid
• The error appears to be related to state handling within the provider, specifically around the bot_locales attribute
• The error occurs in both CI/CD pipeline and is expected to reproduce locally

Possible Impact

This issue prevents the creation and management of Lex bots through Terraform, requiring manual intervention or alternative approaches.

References

• #0000

[quixoticmonk]

Thank you for opening the issue @fakhtar . Let me get back to you on this.

�[31m│�[0m �[0m"slot_type_values":cty.List(cty.Object(map[string]cty.Type{"sample_value":cty.Object(map[string]cty.Type{"value":cty.String}),
�[31m│�[0m �[0m"synonyms":cty.List(cty.Object(map[string]cty.Type{"value":cty.String}))})),
�[31m│�[0m �[0m"value_selection_setting":cty.Object(map[string]cty.Type{"advanced_recognition_setting":cty.Object(map[string]cty.Type{"audio_recognition_strategy":cty.String}),
�[31m│�[0m �[0m"regex_filter":cty.Object(map[string]cty.Type{"pattern":cty.String}),

[quixoticmonk]

The bot does get created in the region, but with null responses for most of the state references.

aws cloudcontrol get-resource --type-name AWS::Lex::Bot --identifier 4YGGNV1VCE
{
    "TypeName": "AWS::Lex::Bot",
    "ResourceDescription": {
        "Identifier": "4YGGNV1VCE",
        "Properties": "{\"IdleSessionTTLInSeconds\":300,\"Id\":\"4YGGNV1VCE\",\"Arn\":\"arn:aws:lex:us-east-1:############:bot/4YGGNV1VCE\",\"RoleArn\":\"arn:aws:iam::############:role/lex_bot_role\",\"Name\":\"botTest\",\"DataPrivacy\":{\"ChildDirected\":false}}"
    }
}

[fakhtar]

That is correct @quixoticmonk . I am seeing the same.

[kjackson03]

I'm seeing this same error related to the stack/stackset resource. The statckset resources are created, but with null responses in the state file.

I'm picking back up on an old project, but saw this error back in version 1.6 of the awscc provider (now trying to use v1.23).

When applying changes to awscc_cloudformation_stack_set.hub_networking_stack, provider "provider["registry.terraform.io/hashicorp/awscc"]" produced an unexpected new value:
│ .stack_instances_group: was
│ cty.SetVal([]cty.Value{cty.ObjectVal(map[string]cty.Value{"deployment_targets":cty.ObjectVal(map[string]cty.Value{"account_filter_type":cty.StringVal("INTERSECTION"),
│ "accounts":cty.SetVal([]cty.Value{cty.StringVal("339712941579")}), "accounts_url":cty.UnknownVal(cty.String),
│ "organizational_unit_ids":cty.SetVal([]cty.Value{cty.StringVal("r-q0ti")})}),
│ "parameter_overrides":cty.UnknownVal(cty.Set(cty.Object(map[string]cty.Type{"parameter_key":cty.String, "parameter_value":cty.String}))),
│ "regions":cty.SetVal([]cty.Value{cty.StringVal("us-east-1")})})}), but now null.