{"action":"created","issue":{"url":"https://api.github.com/repos/hashicorp/terraform/issues/10806","repository_url":"https://api.github.com/repos/hashicorp/terraform","labels_url":"https://api.github.com/repos/hashicorp/terraform/issues/10806/labels{/name}","comments_url":"https://api.github.com/repos/hashicorp/terraform/issues/10806/comments","events_url":"https://api.github.com/repos/hashicorp/terraform/issues/10806/events","html_url":"https://github.com/hashicorp/terraform/issues/10806","id":196172515,"number":10806,"title":"aws kms_key_id input validation doesn't allow empty string ","user":{"login":"danielnbarbosa","id":1261739,"avatar_url":"https://avatars.githubusercontent.com/u/1261739?v=3","gravatar_id":"","url":"https://api.github.com/users/danielnbarbosa","html_url":"https://github.com/danielnbarbosa","followers_url":"https://api.github.com/users/danielnbarbosa/followers","following_url":"https://api.github.com/users/danielnbarbosa/following{/other_user}","gists_url":"https://api.github.com/users/danielnbarbosa/gists{/gist_id}","starred_url":"https://api.github.com/users/danielnbarbosa/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/danielnbarbosa/subscriptions","organizations_url":"https://api.github.com/users/danielnbarbosa/orgs","repos_url":"https://api.github.com/users/danielnbarbosa/repos","events_url":"https://api.github.com/users/danielnbarbosa/events{/privacy}","received_events_url":"https://api.github.com/users/danielnbarbosa/received_events","type":"User","site_admin":false},"labels":[{"id":85946957,"url":"https://api.github.com/repos/hashicorp/terraform/labels/bug","name":"bug","color":"f7c6c7","default":true},{"id":127939518,"url":"https://api.github.com/repos/hashicorp/terraform/labels/provider/aws","name":"provider/aws","color":"bfdadc","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2016-12-16T22:56:57Z","updated_at":"2016-12-19T19:59:22Z","closed_at":null,"body":"### Terraform Version\r\nTerraform v0.8.1\r\n\r\n### Affected Resource(s)\r\nany resource that accepts a `kms_key_id` argument\r\n\r\n\r\n### Terraform Configuration Files\r\n```hcl\r\nvariable \"kms_key_ids\" {\r\n  type        = \"map\"\r\n  description = \"if storage_encrypted == 'false' then kms_key_ids = '' \"\r\n\r\n  default = {\r\n    \"false\" = \"\"\r\n  }\r\n}\r\n\r\nresource \"aws_db_instance\" \"papi\" {\r\n  identifier              = \"${var.environment_name}-papi\"\r\n  allocated_storage       = \"${var.papi_rds_allocated_storage}\"\r\n  engine                  = \"mysql\"\r\n  instance_class          = \"${var.papi_rds_instance_class}\"\r\n  storage_type            = \"gp2\"\r\n  storage_encrypted       = \"${var.papi_rds_storage_encrypted}\"\r\n  kms_key_id              = \"${lookup(var.kms_key_ids, var.papi_rds_storage_encrypted, aws_kms_key.papi_rds.arn)}\"\r\n  multi_az                = \"${var.papi_rds_multi_az}\"\r\n  name                    = \"xxxxxxxx\"\r\n  username                = \"xxxxxxxx\"\r\n  password                = \"${var.papi_rds_password_admin}\"\r\n  backup_retention_period = 30\r\n  publicly_accessible     = false\r\n  vpc_security_group_ids  = [\"${aws_security_group.papi_rds.id}\"]\r\n  parameter_group_name    = \"${aws_db_parameter_group.papi.name}\"\r\n  db_subnet_group_name    = \"${aws_db_subnet_group.papi.name}\"\r\n  skip_final_snapshot     = \"${var.papi_rds_skip_final_snapshot}\"\r\n  maintenance_window      = \"${var.papi_rds_maintenance_window}\"\r\n  backup_window           = \"${var.papi_rds_backup_window}\"\r\n}\r\n```\r\n\r\nNote that the above lookup can now be done more elegantly using a conditional like:\r\n```hcl\r\n  kms_key_id              = \"${var.papi_rds_storage_encrypted ? aws_kms_key.papi_rds.arn : \"\"}\"\r\n```\r\n\r\n### Expected Behavior\r\nPlan should succeed.\r\n\r\n### Actual Behavior\r\n```\r\nError running plan: 1 error(s) occurred:\r\n\r\n* module.named_common.aws_db_instance.papi: \"kms_key_id\" doesn't look like a valid ARN (\"^arn:aws:([a-zA-Z0-9\\\\-])+:([a-z]{2}-[a-z]+-\\\\d{1})?:(\\\\d{12})?:(.*)$\"): \"\"\r\n```\r\n\r\n### Steps to Reproduce\r\nPlease list the steps required to reproduce the issue, for example:\r\n1. `terraform plan`\r\n\r\n### Important Factoids\r\nThis is being done because I configure the databases differently depending on the environment.  In this case the RDS databases are encrypted in prod but not in dev.  `storage_encrypted` is configured with a variable so `kms_key_id` should only be set to an ARN if `storage_encrypted` is true.  If it is false then setting `kms_key_id` to an empty string works fine.  At least it did until the input validation requiring an ARN format was added.  The easy fix would be for the `kms_key_id` input validation to also allow an empty string as well.\r\n\r\nNote that I tried many different ways to work around this issue but could not get anything to work.  I have other modules that depend on the attributes of `aws_db_instance` so it's not straightforward to create duplicate resources, one for the unencrypted databases and one for the encrypted ones.\r\n"},"comment":{"url":"https://api.github.com/repos/hashicorp/terraform/issues/comments/268062708","html_url":"https://github.com/hashicorp/terraform/issues/10806#issuecomment-268062708","issue_url":"https://api.github.com/repos/hashicorp/terraform/issues/10806","id":268062708,"user":{"login":"danielnbarbosa","id":1261739,"avatar_url":"https://avatars.githubusercontent.com/u/1261739?v=3","gravatar_id":"","url":"https://api.github.com/users/danielnbarbosa","html_url":"https://github.com/danielnbarbosa","followers_url":"https://api.github.com/users/danielnbarbosa/followers","following_url":"https://api.github.com/users/danielnbarbosa/following{/other_user}","gists_url":"https://api.github.com/users/danielnbarbosa/gists{/gist_id}","starred_url":"https://api.github.com/users/danielnbarbosa/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/danielnbarbosa/subscriptions","organizations_url":"https://api.github.com/users/danielnbarbosa/orgs","repos_url":"https://api.github.com/users/danielnbarbosa/repos","events_url":"https://api.github.com/users/danielnbarbosa/events{/privacy}","received_events_url":"https://api.github.com/users/danielnbarbosa/received_events","type":"User","site_admin":false},"created_at":"2016-12-19T19:59:22Z","updated_at":"2016-12-19T19:59:22Z","body":"thanks @Ninir.  you made my day!"}}
{"actor":{"display_login":"danielnbarbosa"}}