`aws_guardduty_organization_configuration_feature` `additional_configuration` perpetual diff recreating resource

[dpiddock]

Terraform and AWS Provider Version

Terraform v1.13.4
on darwin_arm64
+ provider registry.terraform.io/hashicorp/aws v6.18.0

Affected Resource(s) or Data Source(s)

• aws_guardduty_organization_configuration_feature

Expected Behavior

"No changes. Your infrastructure matches the configuration."

Actual Behavior

A diff is produced on every plan, wanting to replace the resource:

  # aws_guardduty_organization_configuration_feature.guardduty must be replaced
-/+ resource "aws_guardduty_organization_configuration_feature" "guardduty" {
      ~ id          = "<<redacted>>/RUNTIME_MONITORING" -> (known after apply)
        name        = "RUNTIME_MONITORING"
        # (3 unchanged attributes hidden)

      ~ additional_configuration {
          ~ name        = "ECS_FARGATE_AGENT_MANAGEMENT" -> "EC2_AGENT_MANAGEMENT" # forces replacement
            # (1 unchanged attribute hidden)
        }
      ~ additional_configuration {
          ~ name        = "EC2_AGENT_MANAGEMENT" -> "ECS_FARGATE_AGENT_MANAGEMENT" # forces replacement
            # (1 unchanged attribute hidden)
        }

        # (1 unchanged block hidden)
    }

Relevant Error/Panic Output

No response

Sample Terraform Configuration

Click to expand configuration

resource "aws_guardduty_detector" "guardduty" {}

resource "aws_guardduty_organization_configuration" "guardduty" {
  # Gets a bit messy with Terraform
  auto_enable_organization_members = "NONE"

  detector_id = aws_guardduty_detector.guardduty.id
}

resource "aws_guardduty_organization_configuration_feature" "runtime_monitoring" {
  detector_id = aws_guardduty_detector.guardduty.id
  name        = "RUNTIME_MONITORING"
  auto_enable = "NONE"

  dynamic "additional_configuration" {
    for_each = toset(["EC2_AGENT_MANAGEMENT", "ECS_FARGATE_AGENT_MANAGEMENT", "EKS_ADDON_MANAGEMENT"])
    iterator = ac
    content {
      name        = ac.key
      auto_enable = "NONE"
    }
  }

  depends_on = [aws_guardduty_organization_configuration.guardduty]
}

Steps to Reproduce

1. Have an AWS organization
2. Apply the plan
3. Plan again to see a diff recreating the aws_guardduty_organization_configuration_feature resource

Debug Logging

Click to expand log output

GenAI / LLM Assisted Development

n/a

Important Facts and References

Having the additional_configuration blocks in the "correct" order removes the diff:

resource "aws_guardduty_organization_configuration_feature" "runtime_monitoring" {
  detector_id = aws_guardduty_detector.guardduty.id
  name        = "RUNTIME_MONITORING"
  auto_enable = "NONE"

  additional_configuration {
    name        = "ECS_FARGATE_AGENT_MANAGEMENT"
    auto_enable = "NONE"
  }

  additional_configuration {
    name        = "EC2_AGENT_MANAGEMENT"
    auto_enable = "NONE"
  }

  additional_configuration {
    name        = "EKS_ADDON_MANAGEMENT"
    auto_enable = "NONE"
  }

  depends_on = [aws_guardduty_organization_configuration.guardduty]
}

Similar issue was fixed for aws_guardduty_detector_feature in #44627

Would you like to implement a fix?

No

[github-actions]

Community Guidelines

This comment is added to every new Issue to provide quick reference to how the Terraform AWS Provider is maintained. Please review the information below, and thank you for contributing to the community that keeps the provider thriving! 🚀

Voting for Prioritization

• Please vote on this Issue by adding a 👍 reaction to the original post to help the community and maintainers prioritize it.
• Please see our prioritization guide for additional information on how the maintainers handle prioritization.
• Please do not leave +1 or other comments that do not add relevant new information or questions; they generate extra noise for others following the Issue and do not help prioritize the request.

Volunteering to Work on This Issue

• If you are interested in working on this issue, please leave a comment.
• If this would be your first contribution, please review the contribution guide.
• For new resources and data sources, use skaff to generate scaffolding with comments detailing common expectations.