-
Notifications
You must be signed in to change notification settings - Fork 9.8k
Fix misleading S3 Lifecycle rule warning #43590
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Fix misleading S3 Lifecycle rule warning #43590
Conversation
Community GuidelinesThis comment is added to every new Pull Request to provide quick reference to how the Terraform AWS Provider is maintained. Please review the information below, and thank you for contributing to the community that keeps the provider thriving! 🚀 Voting for Prioritization
Pull Request Authors
|
9f72d67 to
0b4b85b
Compare
|
✅ Thank you for correcting the previously detected issues! The maintainers appreciate your efforts to make the review process as smooth as possible. |
0b4b85b to
1fda0c5
Compare
Context & HistoryThe Terraform AWS Provider’s However, starting with changes introduced in PR #41662, users began seeing confusing warnings when using the documented empty filter syntax. The root issue lies in the mismatch between how AWS’s API enforces filters and how Terraform has historically handled them:
The provider’s validator logic did not distinguish between “no filter block” and “empty filter block” — both of which work fine at the AWS API level — and instead warned in both cases, creating a catch-22, no-win scenario for users. Problem SummaryReported in Bug #41710
Why It Happened
Effectively, the validator enforced a stricter contract than AWS itself, breaking the documented workflow. Timeline
Where Things Stand
✅ Bottom line: This is a validator misalignment issue, not an AWS API requirement. PR #43590 removes the problematic validator, ensuring empty filter blocks ( |
YakDriver
left a comment
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@johannes-gehrs Thank you for your contribution!
% make t T='TestAccS3BucketLifecycleConfiguration_filterWithPrefix|TestAccS3BucketLifecycleConfiguration_rule_NoFilterOrPrefix|TestAccS3BucketLifecycleConfiguration_filterWithEmptyPrefix|TestAccS3BucketLifecycleConfiguration_Filter_objectSizeGreaterThanToPrefix|TestAccS3BucketLifecycleConfiguration_Filter_objectSizeLessThanToPrefix|TestAccS3BucketLifecycleConfiguration_Filter_ObjectSizeGreaterThan|TestAccS3BucketLifecycleConfiguration_Filter_ObjectSizeGreaterThanZero|TestAccS3BucketLifecycleConfiguration_Filter_ObjectSizeLessThan|TestAccS3BucketLifecycleConfiguration_Filter_ObjectSizeRange|TestAccS3BucketLifecycleConfiguration_Filter_ObjectSizeRangeAndPrefix|TestAccS3BucketLifecycleConfiguration_Filter_PrefixToAnd|TestAccS3BucketLifecycleConfiguration_multipleRules_noFilterOrPrefix|TestAccS3BucketLifecycleConfiguration_RulePrefixToFilter|TestAccS3BucketLifecycleConfiguration_Filter_Tag|TestAccS3BucketLifecycleConfiguration_EmptyFilter_NonCurrentVersions|TestAccS3BucketLifecycleConfiguration_Update_filterWithAndToFilterWithPrefix' K=s3
make: Verifying source code with gofmt...
==> Checking that code complies with gofmt requirements...
make: Running acceptance tests on branch: 🌿 b-fix_misleading_lifecyle_rule_warning 🌿...
TF_ACC=1 go1.24.6 test ./internal/service/s3/... -v -count 1 -parallel 20 -run='TestAccS3BucketLifecycleConfiguration_filterWithPrefix|TestAccS3BucketLifecycleConfiguration_rule_NoFilterOrPrefix|TestAccS3BucketLifecycleConfiguration_filterWithEmptyPrefix|TestAccS3BucketLifecycleConfiguration_Filter_objectSizeGreaterThanToPrefix|TestAccS3BucketLifecycleConfiguration_Filter_objectSizeLessThanToPrefix|TestAccS3BucketLifecycleConfiguration_Filter_ObjectSizeGreaterThan|TestAccS3BucketLifecycleConfiguration_Filter_ObjectSizeGreaterThanZero|TestAccS3BucketLifecycleConfiguration_Filter_ObjectSizeLessThan|TestAccS3BucketLifecycleConfiguration_Filter_ObjectSizeRange|TestAccS3BucketLifecycleConfiguration_Filter_ObjectSizeRangeAndPrefix|TestAccS3BucketLifecycleConfiguration_Filter_PrefixToAnd|TestAccS3BucketLifecycleConfiguration_multipleRules_noFilterOrPrefix|TestAccS3BucketLifecycleConfiguration_RulePrefixToFilter|TestAccS3BucketLifecycleConfiguration_Filter_Tag|TestAccS3BucketLifecycleConfiguration_EmptyFilter_NonCurrentVersions|TestAccS3BucketLifecycleConfiguration_Update_filterWithAndToFilterWithPrefix' -timeout 360m -vet=off
2025/10/02 11:50:07 Creating Terraform AWS Provider (SDKv2-style)...
2025/10/02 11:50:07 Initializing Terraform AWS Provider (SDKv2-style)...
=== RUN TestAccS3BucketLifecycleConfiguration_rule_NoFilterOrPrefix
=== PAUSE TestAccS3BucketLifecycleConfiguration_rule_NoFilterOrPrefix
=== RUN TestAccS3BucketLifecycleConfiguration_filterWithPrefix
=== PAUSE TestAccS3BucketLifecycleConfiguration_filterWithPrefix
=== RUN TestAccS3BucketLifecycleConfiguration_filterWithEmptyPrefix
=== PAUSE TestAccS3BucketLifecycleConfiguration_filterWithEmptyPrefix
=== RUN TestAccS3BucketLifecycleConfiguration_Filter_objectSizeGreaterThanToPrefix
=== PAUSE TestAccS3BucketLifecycleConfiguration_Filter_objectSizeGreaterThanToPrefix
=== RUN TestAccS3BucketLifecycleConfiguration_Filter_objectSizeLessThanToPrefix
=== PAUSE TestAccS3BucketLifecycleConfiguration_Filter_objectSizeLessThanToPrefix
=== RUN TestAccS3BucketLifecycleConfiguration_Filter_ObjectSizeGreaterThan
=== PAUSE TestAccS3BucketLifecycleConfiguration_Filter_ObjectSizeGreaterThan
=== RUN TestAccS3BucketLifecycleConfiguration_Filter_ObjectSizeGreaterThanZero
=== PAUSE TestAccS3BucketLifecycleConfiguration_Filter_ObjectSizeGreaterThanZero
=== RUN TestAccS3BucketLifecycleConfiguration_Filter_ObjectSizeLessThan
=== PAUSE TestAccS3BucketLifecycleConfiguration_Filter_ObjectSizeLessThan
=== RUN TestAccS3BucketLifecycleConfiguration_Filter_ObjectSizeRange
=== PAUSE TestAccS3BucketLifecycleConfiguration_Filter_ObjectSizeRange
=== RUN TestAccS3BucketLifecycleConfiguration_Filter_ObjectSizeRangeAndPrefix
=== PAUSE TestAccS3BucketLifecycleConfiguration_Filter_ObjectSizeRangeAndPrefix
=== RUN TestAccS3BucketLifecycleConfiguration_Filter_PrefixToAnd
=== PAUSE TestAccS3BucketLifecycleConfiguration_Filter_PrefixToAnd
=== RUN TestAccS3BucketLifecycleConfiguration_multipleRules_noFilterOrPrefix
=== PAUSE TestAccS3BucketLifecycleConfiguration_multipleRules_noFilterOrPrefix
=== RUN TestAccS3BucketLifecycleConfiguration_RulePrefixToFilter
=== PAUSE TestAccS3BucketLifecycleConfiguration_RulePrefixToFilter
=== RUN TestAccS3BucketLifecycleConfiguration_Filter_Tag
=== PAUSE TestAccS3BucketLifecycleConfiguration_Filter_Tag
=== RUN TestAccS3BucketLifecycleConfiguration_EmptyFilter_NonCurrentVersions
=== PAUSE TestAccS3BucketLifecycleConfiguration_EmptyFilter_NonCurrentVersions
=== RUN TestAccS3BucketLifecycleConfiguration_Update_filterWithAndToFilterWithPrefix
=== PAUSE TestAccS3BucketLifecycleConfiguration_Update_filterWithAndToFilterWithPrefix
=== CONT TestAccS3BucketLifecycleConfiguration_rule_NoFilterOrPrefix
=== CONT TestAccS3BucketLifecycleConfiguration_Filter_ObjectSizeRange
=== CONT TestAccS3BucketLifecycleConfiguration_Filter_objectSizeLessThanToPrefix
=== CONT TestAccS3BucketLifecycleConfiguration_Filter_objectSizeGreaterThanToPrefix
=== CONT TestAccS3BucketLifecycleConfiguration_Filter_ObjectSizeGreaterThanZero
=== CONT TestAccS3BucketLifecycleConfiguration_RulePrefixToFilter
=== CONT TestAccS3BucketLifecycleConfiguration_Filter_ObjectSizeGreaterThan
=== CONT TestAccS3BucketLifecycleConfiguration_filterWithEmptyPrefix
=== CONT TestAccS3BucketLifecycleConfiguration_Update_filterWithAndToFilterWithPrefix
=== CONT TestAccS3BucketLifecycleConfiguration_Filter_PrefixToAnd
=== CONT TestAccS3BucketLifecycleConfiguration_EmptyFilter_NonCurrentVersions
=== CONT TestAccS3BucketLifecycleConfiguration_Filter_ObjectSizeLessThan
=== CONT TestAccS3BucketLifecycleConfiguration_filterWithPrefix
=== CONT TestAccS3BucketLifecycleConfiguration_Filter_Tag
=== CONT TestAccS3BucketLifecycleConfiguration_Filter_ObjectSizeRangeAndPrefix
=== CONT TestAccS3BucketLifecycleConfiguration_multipleRules_noFilterOrPrefix
--- PASS: TestAccS3BucketLifecycleConfiguration_multipleRules_noFilterOrPrefix (85.29s)
--- PASS: TestAccS3BucketLifecycleConfiguration_rule_NoFilterOrPrefix (85.91s)
--- PASS: TestAccS3BucketLifecycleConfiguration_Filter_ObjectSizeRangeAndPrefix (87.03s)
--- PASS: TestAccS3BucketLifecycleConfiguration_Filter_PrefixToAnd (163.60s)
--- PASS: TestAccS3BucketLifecycleConfiguration_Filter_ObjectSizeGreaterThanZero (165.68s)
--- PASS: TestAccS3BucketLifecycleConfiguration_Filter_Tag (165.87s)
--- PASS: TestAccS3BucketLifecycleConfiguration_filterWithEmptyPrefix (166.03s)
--- PASS: TestAccS3BucketLifecycleConfiguration_Filter_objectSizeLessThanToPrefix (166.09s)
--- PASS: TestAccS3BucketLifecycleConfiguration_Filter_ObjectSizeGreaterThan (166.23s)
--- PASS: TestAccS3BucketLifecycleConfiguration_filterWithPrefix (166.28s)
--- PASS: TestAccS3BucketLifecycleConfiguration_RulePrefixToFilter (166.56s)
--- PASS: TestAccS3BucketLifecycleConfiguration_Filter_ObjectSizeRange (166.56s)
--- PASS: TestAccS3BucketLifecycleConfiguration_Filter_objectSizeGreaterThanToPrefix (166.59s)
--- PASS: TestAccS3BucketLifecycleConfiguration_EmptyFilter_NonCurrentVersions (166.60s)
--- PASS: TestAccS3BucketLifecycleConfiguration_Filter_ObjectSizeLessThan (166.61s)
--- PASS: TestAccS3BucketLifecycleConfiguration_Update_filterWithAndToFilterWithPrefix (230.06s)
PASS
ok github.com/hashicorp/terraform-provider-aws/internal/service/s3 235.596s
ewbankkit
left a comment
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM 🚀.
|
Warning This Issue has been closed, meaning that any additional comments are much easier for the maintainers to miss. Please assume that the maintainers will not see them. Ongoing conversations amongst community members are welcome, however, the issue will be locked after 30 days. Moving conversations to another venue, such as the AWS Provider forum, is recommended. If you have additional concerns, please open a new issue, referencing this one where needed. |
|
This functionality has been released in v6.15.0 of the Terraform AWS Provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading. For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template. Thank you! |
|
I'm going to lock this pull request because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues. |
Rollback Plan
If a change needs to be reverted, we will publish an updated version of the library.
Changes to Security Controls
no security related changes as far as I can tell
Description
tl;dr
filter {}for bucket-wide lifecycle rules.filter {}(empty) and omittingfilterentirely triggered them.db5cf53b) added additional validation that made the problem worse - now users got warnings for both empty filters AND missing filtersRemoves the warning which makes the user provide either
filterorprefix.The documentation clearly states that omitting the filter rule is possible. In this respect, the TF resource differs from the AWS API, which requires a filter.
If no filter is set, then the provider code will set an empty filter
This PR also makes an attempt to improve the documentation for this aspect of the provider, bringing it in line with what the documentation actually says.
Relations
Closes #42714
Closes #43439
Closes #41917
Bottom line:
The issue affects users following the documented pattern of using
filter {}for bucket-wide lifecycle rules, with the problem persisting across multiple provider versions from v5.90.0 onwards.Issues:
Major Issues:
Closed but not fixed:
PRs:
Related Issues:
Timeline Summary
References
#41268 (comment)
Output from Acceptance Testing