aws_macie2_member: abnormal behavior of `email` parameter when member is from AWS Organization

[posquit0]

trafficstars

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform CLI and Terraform AWS Provider Version

> terraform version
Terraform v1.2.0
on darwin_arm64
+ provider registry.terraform.io/hashicorp/aws v4.25.0

Your version of Terraform is out of date! The latest version
is 1.2.6. You can update by downloading from https://www.terraform.io/downloads.html

Affected Resource(s)

• aws_macie2_member

Terraform Configuration Files

Please include all Terraform configurations required to reproduce the bug. Bug reports without a functional reproduction may be closed without investigation.

resource "aws_macie2_account" "admin" {
  provider = aws.admin
}

resource "aws_macie2_organization_admin_account" "master" {
  provider = aws.master

  admin_account_id = "${admin-id}"
  depends_on       = [aws_macie2_account.admin]
}

resource "aws_macie2_member" "org_member" {
  provider = aws.org-member
  account_id                            = "${org-member-id}"
  email                                 = "${org-member-email}"
  depends_on                            = [aws_macie2_account.admin]
}

Debug Output

Panic Output

Expected Behavior

No changes. Your infrastructure matches the configuration.

Terraform has compared your real infrastructure against your configuration and found no differences, so no changes are needed.

Apply complete! Resources: 0 added, 0 changed, 0 destroyed.

Outputs:

Actual Behavior

-/+ resource "aws_macie2_member" "this" {
      ~ administrator_account_id = "911145092815" -> (known after apply)
      ~ arn                      = "arn:aws:macie2:ap-northeast-2:xxxxxxxx:member/yyyyyyyy" -> (known after apply)
      + email                    = "[email protected]" # forces replacement
      ~ id                       = "yyyyyyyy" -> (known after apply)
      ~ invite                   = true -> (known after apply)
      ~ invited_at               = "0001-01-01T00:00:00Z" -> (known after apply)
      ~ master_account_id        = "xxxxxxxxxxxx" -> (known after apply)
      ~ relationship_status      = "Enabled" -> (known after apply)
        tags                     = {
...
        }
      ~ tags_all                 = {
...
        } -> (known after apply)
      ~ updated_at               = "2022-08-10T14:03:26Z" -> (known after apply)
        # (2 unchanged attributes hidden)
    }

Steps to Reproduce

1. terraform apply
2. Again execute terraform apply
3. You can see the destroy and re-create terraform plan.