title: Terraform Out Of Sync
body: <p>I have an issue where my terraform is somehow not the same as what is deployed though I don't know why.  According to my git history, the file that manages Cognito User Pools hasn't changed since it was deployed, but terraform thinks it has and complains changes need to force a new resource.</p>
  
  <p>terraform version : <code>0.11.7</code></p>
  
  <p>AWS Provider Version : <code>1.14.1</code></p>
  
  <p>My Terraform <code>code</code> :</p>
  
  <pre><code>resource "aws_cognito_user_pool" "my_app" {
    name                          = "My App Pool"
  
    /* Fields that can work as aliases */
    alias_attributes              = [
      "email"
    ]
  
    /* Auto-verify these fields */
    auto_verified_attributes      = [
      "email"
    ]
  
    /* This is the template used to verify addresses / accounts */
    verification_message_template {
      default_email_option        = "CONFIRM_WITH_CODE"
    }
  
    admin_create_user_config {
      allow_admin_create_user_only = false
      invite_message_template {
        email_message             = &lt;&lt;EOF    
    {####}
    EOF
  
        email_subject             = "MyApp"
        sms_message               = "Welcome to MyApp.  Your username: {username} and password: {####}  Thank you!"
      }
    }
  
    email_verification_subject    = "MyApp's Confirmation Code"
    email_verification_message    = "Your confirmation code: {####}   Thank you."
  
  password_policy {
      minimum_length              = 8
      require_lowercase           = true
      require_numbers             = true
      require_symbols             = true
      require_uppercase           = true
  }
  
    schema {
      attribute_data_type         = "String"
      developer_only_attribute    = false
      mutable                     = true
      name                        = "email"
      required                    = true
    }
  
    schema {
      attribute_data_type         = "String"
      developer_only_attribute    = false
      mutable                     = true
      name                        = "custom1"
      required                    = false
    }
  
    schema {
      attribute_data_type         = "String"
      developer_only_attribute    = false
      mutable                     = true
      name                        = "custom2"
      required                    = false
    }
  
    tags {
      "name"                      = "MyApp"
      "Project"                   = "Terraform"
    }
  }
  </code></pre>
  
  <p>I get the following result :</p>
  
  <pre><code>  schema.3021841581.attribute_data_type:                              "String" =&gt; "" (forces new resource)
    schema.3021841581.developer_only_attribute:                         "false" =&gt; "false"
    schema.3021841581.mutable:                                          "true" =&gt; "false" (forces new resource)
    schema.3021841581.name:                                             "custom1" =&gt; "" (forces new resource)
    schema.3021841581.number_attribute_constraints.#:                   "0" =&gt; "0"
    schema.3021841581.required:                                         "false" =&gt; "false"
    schema.3021841581.string_attribute_constraints.#:                   "1" =&gt; "0" (forces new resource)
    schema.3021841581.string_attribute_constraints.0.max_length:        "" =&gt; ""
    schema.3021841581.string_attribute_constraints.0.min_length:        "" =&gt; ""
  </code></pre>
  
  <p>I tried <strong>terraform refresh</strong> and it didn't work.  </p>
  
  <p>Showing what's in the state by doing <strong>terraform state show</strong> gives this</p>
  
  <pre><code> schema.3021841581.attribute_data_type                              = String
   schema.3021841581.developer_only_attribute                         = false
   schema.3021841581.mutable                                          = true
   schema.3021841581.name                                             = custom1
   schema.3021841581.number_attribute_constraints.#                   = 0
   schema.3021841581.required                                         = false
   schema.3021841581.string_attribute_constraints.#                   = 1
  </code></pre>
  
  <p>So, my question :</p>
  
  <ol>
  <li><p>I know it's probably not ideal, but is there any way to ignore or skip over Cognito?  I don't want to change anything on that service, and need to protect it due to our users.</p></li>
  <li><p>Is there any way to figure out why it thinks there's a difference and resolve it without destroying my pool?</p></li>
  </ol>