[Bug]: Image Builder Container Recipe Resource Does not Update Target Repository Name

[clarkhathawayaltview]

Terraform Core Version

1.9.6

AWS Provider Version

5.72.0

Affected Resource(s)

aws_imagebuilder_container_recipe

Expected Behavior

When updating the 'repository_name' argument in the 'target_repository' argument configuration block, a standard plan & apply should update the target repository name in AWS for this container recipe.

Actual Behavior

The plan & apply phases are successful but the target repository name in AWS remains unchanged for this container recipe.

Relevant Error/Panic Output Snippet

N/A

Terraform Configuration Files

container-recipes.tf:

variable ecr-repository-name {
  type = string
}

variable node-version {
  type = string
  default = "20.18.0"
}

resource aws_imagebuilder_container_recipe aws-node {
  name    = "aws-node"
  version = "1.0.0"

  container_type = "DOCKER"
  parent_image   = "arn:aws:imagebuilder:us-east-1:aws:image/amazon-linux-2023-x86-latest/x.x.x"

  target_repository {
    repository_name = var.ecr-repository-name
    service         = "ECR"
  }

  component {
    component_arn = "arn:aws:imagebuilder:us-east-1:aws:component/aws-cli-version-2-linux/x.x.x"
  }

  component {
    component_arn = aws_imagebuilder_component.linux-utilities.arn
  }

  component {
    component_arn = aws_imagebuilder_component.node.arn
    parameter {
      name  = "VERSION"
      value = var.node-version
    }
  }

  dockerfile_template_data = <<EOF
    FROM {{{ imagebuilder:parentImage }}}
    {{{ imagebuilder:environments }}}
    {{{ imagebuilder:components }}}
    EOF
}

Steps to Reproduce

1. Using container-recipes.tf as part of a module, pass a value to the input ecr-repository-name. I am using it as part of a child module and am passing the name of an ECR repository resource defined in the root module.
2. Run a standard plan & apply
3. Pass a value for the input ecr-repository-name that differs from the target repository name in the AWS container recipe created in step 2
4. Avoid modifying any other image builder resources such as components or the pipeline for which this container recipe is used
5. Run another standard run & apply with the only change from steps 1 and 2 being the new value for the input ecr-repository-name. I changed this value by passing a string literal from the root module instead of my ECR resource name.
6. Observe that the target repository name is unchanged in AWS

Debug Output

No response

Panic Output

No response

Important Factoids

No response

References

No response

Would you like to implement a fix?

None

[github-actions]

Community Note

Voting for Prioritization

• Please vote on this issue by adding a 👍 reaction to the original post to help the community and maintainers prioritize this request.
• Please see our prioritization guide for information on how we prioritize.
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request.

Volunteering to Work on This Issue

• If you are interested in working on this issue, please leave a comment.
• If this would be your first contribution, please review the contribution guide.

[justinretzolk]

Hey @clarkhathawayaltview 👋 Thank you for taking the time to raise this! Are you able to supply debug logs (redacted as needed) for whoever picks this up to look into it? Looking at the relevant section of the codebase for that argument, I would suspect that making this type of change would force the resource to be recreated. If that's not happening (and I've not misunderstood what you're reporting), I suspect there may be other factors at play here.

[clarkhathawayaltview]

I don't think we have any debug logs we can supply at this time. The original body of the issue should be sufficient for reproducing it. We tested it several times before we opened the issue to be sure.

[justinretzolk]

@clarkhathawayaltview the provided sample configuration can't be planned/applied as is (particularly given that your reproduction notes indicated you're using the configuration within a child module). I absolutely understand if you're not able to supply debug logging -- we get that fairly often, and given the sensitive and sometimes transient nature of some of these issues, it's makes sense. That said, we're happy to look into this to see what we can find, you just may wind up getting further questions from whoever picks this up to look into it more.

A lingering question I have is whether, when planning, the plan logs indicate that the expected change would be made?

[clarkhathawayaltview]

I doubt that it being a child module is material here. You can probably run this as a root module. Those components can also be replaced with AWS managed components or removed entirely. The variable for the ECR repository name doesn't even need to be a real repository iirc. We heavily rely on this provider so I will be available if there are any more questions.

I know that HCP Terraform did indicate that the resource had been updated when I looked at the plan/apply UI.

[stefanfreitag]

Hi @clarkhathawayaltview , hi @justinretzolk.

If both of you are fine, I will try to reproduce the scenario with the steps mentioned.

Terraform and provider version are

$ terraform version
Terraform v1.9.6
on linux_amd64
+ provider registry.terraform.io/hashicorp/aws v5.72.0

Your version of Terraform is out of date! The latest version
is 1.9.8. You can update by downloading from https://www.terraform.io/downloads.html

Between the two terraform apply commands, the target repository name will change from aws_ecr_repository.repository_1.name to aws_ecr_repository.repository_2.name - this is similar to the update of the variable ecr-repository-name .

# Ensure that we have two existing ECR repositories we can use for the test
resource "aws_ecr_repository" "repository_1" {
  name = "repository_1"
}

resource "aws_ecr_repository" "repository_2" {
  name = "repository_2"
}

resource "aws_imagebuilder_container_recipe" "example" {
  name    = "example"
  version = "1.0.0"

  container_type = "DOCKER"
  parent_image   = "arn:aws:imagebuilder:eu-central-1:aws:image/amazon-linux-2023-x86-latest/x.x.x"

  target_repository {
    repository_name = aws_ecr_repository.repository_1.name
    service         = "ECR"
  }

  component {
    component_arn = "arn:aws:imagebuilder:eu-central-1:aws:component/aws-cli-version-2-linux/x.x.x"
  }

  dockerfile_template_data = <<EOF
    FROM {{{ imagebuilder:parentImage }}}
    {{{ imagebuilder:environments }}}
    {{{ imagebuilder:components }}}
    EOF
}

First terraform apply results in this output

  # aws_ecr_repository.repository_1 will be created
  + resource "aws_ecr_repository" "repository_1" {
      + arn                  = (known after apply)
      + id                   = (known after apply)
      + image_tag_mutability = "MUTABLE"
      + name                 = "repository_1"
      + registry_id          = (known after apply)
      + repository_url       = (known after apply)
      + tags_all             = (known after apply)
    }

  # aws_ecr_repository.repository_2 will be created
  + resource "aws_ecr_repository" "repository_2" {
      + arn                  = (known after apply)
      + id                   = (known after apply)
      + image_tag_mutability = "MUTABLE"
      + name                 = "repository_2"
      + registry_id          = (known after apply)
      + repository_url       = (known after apply)
      + tags_all             = (known after apply)
    }

  # aws_imagebuilder_container_recipe.example will be created
  + resource "aws_imagebuilder_container_recipe" "example" {
      + arn                      = (known after apply)
      + container_type           = "DOCKER"
      + date_created             = (known after apply)
      + dockerfile_template_data = <<-EOT
            FROM {{{ imagebuilder:parentImage }}}
                {{{ imagebuilder:environments }}}
                {{{ imagebuilder:components }}}
        EOT
      + encrypted                = (known after apply)
      + id                       = (known after apply)
      + name                     = "example"
      + owner                    = (known after apply)
      + parent_image             = "arn:aws:imagebuilder:eu-central-1:aws:image/amazon-linux-2023-x86-latest/x.x.x"
      + platform                 = (known after apply)
      + tags_all                 = (known after apply)
      + version                  = "1.0.0"

      + component {
          + component_arn = "arn:aws:imagebuilder:eu-central-1:aws:component/aws-cli-version-2-linux/x.x.x"
        }

      + target_repository {
          + repository_name = "repository_1"
          + service         = "ECR"
        }
    }

Plan: 3 to add, 0 to change, 0 to destroy

The change has been applied. Then I manually updated one line in the Terraform code

# Old 
# repository_name = aws_ecr_repository.repository_1.name
# New
 repository_name = aws_ecr_repository.repository_2.name

Second terraform apply results in this output

$ terraform apply
aws_ecr_repository.repository_2: Refreshing state... [id=repository_2]
aws_ecr_repository.repository_1: Refreshing state... [id=repository_1]
aws_imagebuilder_container_recipe.example: Refreshing state... [id=arn:aws:imagebuilder:eu-central-1:<redacted>:container-recipe/example/1.0.0]

Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols:
  ~ update in-place

Terraform will perform the following actions:

  # aws_imagebuilder_container_recipe.example will be updated in-place
  ~ resource "aws_imagebuilder_container_recipe" "example" {
        id                       = "arn:aws:imagebuilder:eu-central-1:<redacted>:container-recipe/example/1.0.0"
        name                     = "example"
        tags                     = {}
        # (13 unchanged attributes hidden)

      ~ target_repository {
          ~ repository_name = "repository_1" -> "repository_2"
            # (1 unchanged attribute hidden)
        }

        # (1 unchanged block hidden)
    }

Plan: 0 to add, 1 to change, 0 to destroy.

The update in the Terraform code triggers a change. Please let me know, if I need to review/ update the approach I took.

[github-actions]

Warning

This issue has been closed, meaning that any additional comments are hard for our team to see. Please assume that the maintainers will not see them.

Ongoing conversations amongst community members are welcome, however, the issue will be locked after 30 days. Moving conversations to another venue, such as the AWS Provider forum, is recommended. If you have additional concerns, please open a new issue, referencing this one where needed.

[github-actions]

This functionality has been released in v5.74.0 of the Terraform AWS Provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template. Thank you!

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.