awscc_bedrock_guardrail : optional policy configs in sensitive information and word policy fail apply

[quixoticmonk]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment
• The resources and data sources in this provider are generated from the CloudFormation schema, so they can only support the actions that the underlying schema supports. For this reason submitted bugs should be limited to defects in the generation and runtime code of the provider. Customizing behavior of the resource, or noting a gap in behavior are not valid bugs and should be submitted as enhancements to AWS via the CloudFormation Open Coverage Roadmap.

Terraform CLI and Terraform AWS Cloud Control Provider Version

• Terraform CLI : Terraform v1.7.4
• provider version : registry.terraform.io/hashicorp/awscc v0.75.0

Affected Resource(s)

• awscc_bedrock_guardrail

Terraform Configuration Files

Terraform apply fails on the guardrail creation when user provides one of the following configurations.

Terraform configuration 2

resource "awscc_bedrock_guardrail" "example" {
  name                      = "example_guardrail"
  blocked_input_messaging   = "Blocked input"
  blocked_outputs_messaging = "blocked output"
  description               = "Example guardrail"

  word_policy_config = {
    managed_word_lists_config = [{
      type = "PROFANITY"
    }]
  }

}

variable "kms_key_arn" {
  type    = string
  default = "value"
}

Terraform configuration 2

resource "awscc_bedrock_guardrail" "example" {
  name                      = "example_guardrail"
  blocked_input_messaging   = "Blocked input"
  blocked_outputs_messaging = "blocked output"
  description               = "Example guardrail"


  sensitive_information_policy_config = {
    pii_entities_config = [
      {
        action = "BLOCK"
        type   = "NAME"
      },
      {
        action = "BLOCK"
        type   = "DRIVER_ID"
      },
      {
        action = "ANONYMIZE"
        type   = "USERNAME"
      },
    ]
  }


}

variable "kms_key_arn" {
  type    = string
  default = "value"
}

Debug Output

Panic Output

Expected Behavior

• Expected the guardrail to be created with the managed words list provided in the word_policy_config. Both the inputs are defined as optional in the schema.

Actual Behavior

Error message on terraform apply.

For configuration 1

awscc_bedrock_guardrail.example: Creating...
╷
│ Error: AWS SDK Go Service Operation Incomplete
│
│   with awscc_bedrock_guardrail.example,
│   on main.tf line 1, in resource "awscc_bedrock_guardrail" "example":
│    1: resource "awscc_bedrock_guardrail" "example" {
│
│ Waiting for Cloud Control API service CreateResource operation completion returned: waiter state transitioned to FAILED. StatusMessage: Cannot invoke
│ "java.util.List.stream()" because "wordConfigs" is null. ErrorCode: InternalFailure

For configuration 2

Plan: 1 to add, 0 to change, 0 to destroy.
awscc_bedrock_guardrail.example: Creating...
╷
│ Error: AWS SDK Go Service Operation Incomplete
│
│   with awscc_bedrock_guardrail.example,
│   on main.tf line 1, in resource "awscc_bedrock_guardrail" "example":
│    1: resource "awscc_bedrock_guardrail" "example" {
│
│ Waiting for Cloud Control API service CreateResource operation completion returned: waiter state transitioned to FAILED. StatusMessage: Cannot invoke
│ "java.util.List.stream()" because "regexConfigs" is null. ErrorCode: InternalFailure

Steps to Reproduce

1. terraform apply on either configuration

Important Factoids

None

References

[quixoticmonk]

The resource gets provisioned if all the optional inputs tied to a specific policy config is provided.

Example :

  word_policy_config = {
    managed_word_lists_config = [{
      type = "PROFANITY"
    }]
    words_config = [{
      text = "HATE"
    }]
  }