[Bug]: aws_backup_restore_testing_selection's restore_metadata_overrides parameter can be an array too

[tmarlok88]

Terraform Core Version

4.6.0

AWS Provider Version

5.86.1

Affected Resource(s)

• aws_backup_restore_testing_selection

Expected Behavior

The restore_metadata_overrides expects a map of strings, however, it should allow arrays too.
Example: For an Aurora or documentDB, the I want to speify some metadata:

    {
      vpcSecurityGroupIds         = ["sg-1234567"]
    }

This should be allowed, but for the vpcSecurityGroupIds it requires a string.

The restore jobs cannot run with this setting.

Actual Behavior

The setting can be saved, but the restore job fails.
After

Relevant Error/Panic Output Snippet

│ Inappropriate value for attribute "restore_metadata_overrides": element
  │ "vpcSecurityGroupIds": string required.

Terraform Configuration Files

provider "aws" {
  region = "eu-central-1"
}

data "aws_iam_role" "backup_role" {
  name = "AWSServiceRoleForBackup"
}

resource "aws_backup_restore_testing_plan" "example" {
  name = "test_restore"
  recovery_point_selection {
    algorithm            = "LATEST_WITHIN_WINDOW"
    include_vaults       = ["*"]
    recovery_point_types = ["CONTINUOUS"]
  }

  schedule_expression = "cron(0 12 ? * * *)" # Daily at 12:00
}

resource "aws_backup_restore_testing_selection" "quarterly_dynamodb" {
  name                      = "some_name"
  restore_testing_plan_name = aws_backup_restore_testing_plan.example.name
  iam_role_arn              = data.aws_iam_role.backup_role.arn
  protected_resource_type   = "Aurora"

  # Match the same conditions as our backup selection
  protected_resource_conditions {
    string_equals {
      key   = "aws:ResourceTag/needs_backup"
      value = true
    }
  }

  restore_metadata_overrides = {
    vpcSecurityGroupIds = ["sg-1234567"]
  }
}

Steps to Reproduce

1. Apply the above terraform config. It will fail to execute.
2. remove the brackets from vpcSecurityGroupIds and apply again. it will succeed now.
3. Open the Restore test page in AWS Web ui, edit the testing selection and select an actual sec group ad save the config
4. execute a terraform plan. it will show a diffwhere it want to change the parameter back to a string

Debug Output

No response

Panic Output

No response

Important Factoids

No response

References

No response

Would you like to implement a fix?

Yes

[github-actions]

Community Note

Voting for Prioritization

• Please vote on this issue by adding a 👍 reaction to the original post to help the community and maintainers prioritize this request.
• Please see our prioritization guide for information on how we prioritize.
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request.

Volunteering to Work on This Issue

• If you are interested in working on this issue, please leave a comment.
• If this would be your first contribution, please review the contribution guide.

[tmarlok88]

After fiddling with the fix, I recognized that I can use jsonencode(["sg-12345"]) and that works.

[github-actions]

Warning

This issue has been closed, meaning that any additional comments are hard for our team to see. Please assume that the maintainers will not see them.

Ongoing conversations amongst community members are welcome, however, the issue will be locked after 30 days. Moving conversations to another venue, such as the AWS Provider forum, is recommended. If you have additional concerns, please open a new issue, referencing this one where needed.