[Bug]: ReplicationGroup.elasticache.aws.upbound.io/v1beta2 fails to sync when transitEncryptionEnabled is false

[alexinthesky]

Is there an existing issue for this?

• I have searched the existing issues

Affected Resource(s)

• elasticache.aws.upbound.io/v1beta2 ReplicationGroup

Resource MRs required to reproduce the bug

apiVersion: elasticache.aws.upbound.io/v1beta2
kind: ReplicationGroup
metadata:
  name: pr507-preview-redis
spec:
  forProvider:
    atRestEncryptionEnabled: "true"
    autoMinorVersionUpgrade: "true"
    automaticFailoverEnabled: true
    description: Redis pr507-preview-redis-with-replica
    engine: redis
    engineVersion: "7.0"
    multiAzEnabled: true
    nodeType: cache.t3.small
    numCacheClusters: 2
    parameterGroupName: default.redis7
    port: 6379
    region: eu-west-3
    securityGroupIdSelector:
      matchLabels:
        access: elasticache
    subnetGroupNameSelector:
      matchLabels:
        xnetworks: pr507-preview

Steps to Reproduce

apply the replicationgroup

What happened?

resource son't sync

Relevant Error Output Snippet

Normal   CreatedExternalResource       19m                   managed/elasticache.aws.upbound.io/v1beta2, kind=replicationgroup  Successfully requested creation of external resource
  Warning  CannotUpdateExternalResource  10m                   managed/elasticache.aws.upbound.io/v1beta2, kind=replicationgroup  async create failed: failed to create the resource: [{0 waiting for ElastiCache Replication Group (pr507-preview-redis) create: operation error ElastiCache: DescribeReplicationGroups, https response error StatusCode: 403, RequestID: e3096e84-3611-4080-88b4-ea1a5f2f5686, api error ExpiredToken: The security token included in the request is expired  []}]
  Warning  CannotUpdateExternalResource  10m                   managed/elasticache.aws.upbound.io/v1beta2, kind=replicationgroup  async update failed: failed to update the resource: [{0 modifying ElastiCache Replication Group (pr507-preview-redis) authentication: operation error ElastiCache: ModifyReplicationGroup, https response error StatusCode: 400, RequestID: 7789d1d4-031d-4af1-ba07-0048efcdd4e1, InvalidParameterValue: The AUTH token modification is only supported when encryption-in-transit is enabled.  []}]
  Warning  CannotUpdateExternalResource  10m                   managed/elasticache.aws.upbound.io/v1beta2, kind=replicationgroup  async update failed: failed to update the resource: [{0 modifying ElastiCache Replication Group (pr507-preview-redis) authentication: operation error ElastiCache: ModifyReplicationGroup, https response error StatusCode: 400, RequestID: 500b7d6c-856a-4562-bb23-151e8b8c5b4d, InvalidParameterValue: The AUTH token modification is only supported when encryption-in-transit is enabled.  []}]
  Warning  CannotUpdateExternalResource  10m                   managed/elasticache.aws.upbound.io/v1beta2, kind=replicationgroup  async update failed: failed to update the resource: [{0 modifying ElastiCache Replication Group (pr507-preview-redis) authentication: operation error ElastiCache: ModifyReplicationGroup, https response error StatusCode: 400, RequestID: 5f87b96b-eff8-4d2d-97b5-5338c577b969, InvalidParameterValue: The AUTH token modification is only supported when encryption-in-transit is enabled.  []}]
  Warning  CannotUpdateExternalResource  10m                   managed/elasticache.aws.upbound.io/v1beta2, kind=replicationgroup  async update failed: failed to update the resource: [{0 modifying ElastiCache Replication Group (pr507-preview-redis) authentication: operation error ElastiCache: ModifyReplicationGroup, https response error StatusCode: 400, RequestID: 341026d0-aa81-44ba-b5ec-ac81949e434c, InvalidParameterValue: The AUTH token modification is only supported when encryption-in-transit is enabled.  []}]
  Warning  CannotUpdateExternalResource  10m                   managed/elasticache.aws.upbound.io/v1beta2, kind=replicationgroup  async update failed: failed to update the resource: [{0 modifying ElastiCache Replication Group (pr507-preview-redis) authentication: operation error ElastiCache: ModifyReplicationGroup, https response error StatusCode: 400, RequestID: 93c99cea-a4e1-4fd4-ba91-3d5f3886a86d, InvalidParameterValue: The AUTH token modification is only supported when encryption-in-transit is enabled.  []}]
  Warning  CannotUpdateExternalResource  9m59s                 managed/elasticache.aws.upbound.io/v1beta2, kind=replicationgroup  async update failed: failed to update the resource: [{0 modifying ElastiCache Replication Group (pr507-preview-redis) authentication: operation error ElastiCache: ModifyReplicationGroup, https response error StatusCode: 400, RequestID: 4d6d6d4f-f2ab-449f-ab05-96ed030d9279, InvalidParameterValue: The AUTH token modification is only supported when encryption-in-transit is enabled.  []}]
  Warning  CannotUpdateExternalResource  9m58s                 managed/elasticache.aws.upbound.io/v1beta2, kind=replicationgroup  async update failed: failed to update the resource: [{0 modifying ElastiCache Replication Group (pr507-preview-redis) authentication: operation error ElastiCache: ModifyReplicationGroup, https response error StatusCode: 400, RequestID: 1ecc552c-762e-4d90-bd70-bc387f6993b8, InvalidParameterValue: The AUTH token modification is only supported when encryption-in-transit is enabled.  []}]
  Warning  CannotUpdateExternalResource  9m56s                 managed/elasticache.aws.upbound.io/v1beta2, kind=replicationgroup  async update failed: failed to update the resource: [{0 modifying ElastiCache Replication Group (pr507-preview-redis) authentication: operation error ElastiCache: ModifyReplicationGroup, https response error StatusCode: 400, RequestID: 31997516-2128-4e7e-9e53-1153537d1382, InvalidParameterValue: The AUTH token modification is only supported when encryption-in-transit is enabled.  []}]
  Warning  CannotUpdateExternalResource  30s (x13 over 9m53s)  managed/elasticache.aws.upbound.io/v1beta2, kind=replicationgroup  (combined from similar events): async update failed: failed to update the resource: [{0 modifying ElastiCache Replication Group (pr507-preview-redis) authentication: operation error ElastiCache: ModifyReplicationGroup, https response error StatusCode: 400, RequestID: c7df7c2f-ee90-4f70-9825-5b244db36d27, InvalidParameterValue: The AUTH token modification is only supported when encryption-in-transit is enabled.  []}]

Crossplane Version

1.15.2

Provider Version

1.19.0

Kubernetes Version

v1.29.12-eks-2d5f260

Kubernetes Distribution

EKS

Additional Info

No response

[alexinthesky]

/test-examples="examples/elasticache/v1beta2/replicationgroup.yaml"

[jeanduplessis]

@alexinthesky the /test-examples command on work on PRs.

[alexinthesky]

yup launched here weirdly enough

https://github.com/crossplane-contrib/provider-upjet-aws/actions/runs/13070127593/job/36469720998#step:8:6670
authTokenUpdateStrategy: ROTATEc got added to the specs and applied successfully without in-transit-encryption