provider fails to update enable_accelerated_recovery in route53 hosted zone

[vchepkov]

Terraform and AWS Provider Version

Terraform v1.14.1

Affected Resource(s) or Data Source(s)

resource aws_route53_zone

Expected Behavior

Added attribute enable_accelerated_recovery aws_route53_zone resource that uses

for_each = toset(var.public_zones)

Expected zones to be updated

Actual Behavior

apply failed with the following messages:

Error: updating Route53 Hosted Zone (XXX) accelerated recovery: updating Route53 Hosted Zone (XXX) accelerated recovery: operation error Route 53: UpdateHostedZoneFeatures, https response error StatusCode: 400, RequestID: xxx, LimitsExceeded: Accelerated recovery can only be updated for 1 hosted zone at a time

Relevant Error/Panic Output

Sample Terraform Configuration

resource "aws_route53_zone" "public_zones" {
  for_each = toset(var.public_zones)
  name     = each.key

  delegation_set_id           = aws_route53_delegation_set.public.id
  enable_accelerated_recovery = true

  lifecycle {
    prevent_destroy = true
  }
}

Steps to Reproduce

no special steps, regular terraform init/apply

Debug Logging

Click to expand log output

GenAI / LLM Assisted Development

n/a

Important Facts and References

No response

Would you like to implement a fix?

No

[github-actions]

Community Guidelines

This comment is added to every new Issue to provide quick reference to how the Terraform AWS Provider is maintained. Please review the information below, and thank you for contributing to the community that keeps the provider thriving! 🚀

Voting for Prioritization

• Please vote on this Issue by adding a 👍 reaction to the original post to help the community and maintainers prioritize it.
• Please see our prioritization guide for additional information on how the maintainers handle prioritization.
• Please do not leave +1 or other comments that do not add relevant new information or questions; they generate extra noise for others following the Issue and do not help prioritize the request.

Volunteering to Work on This Issue

• If you are interested in working on this issue, please leave a comment.
• If this would be your first contribution, please review the contribution guide.
• For new resources and data sources, use skaff to generate scaffolding with comments detailing common expectations.

[tabito-hara]

@vchepkov

Thank you for your report.
As the error message you encountered indicated, this behavior is due to an AWS API limitation.

Accelerated recovery can only be updated for 1 hosted zone at a time

This cannot be controlled on the AWS Provider side, because the Provider does not have awareness of relationships between hosted zones.

As a workaround, you can apply changes sequentially by targeting each hosted zone:

• Use the -target option to run terraform apply per public zone:

  $ terraform apply -target 'aws_route53_zone.public_zones["key1"]'
  $ terraform apply -target 'aws_route53_zone.public_zones["key2"]'
  ...

[vchepkov]

That would be impractical, since one would have to maintain a specialized git ops configuration to implement it.

[tabito-hara]

@vchepkov

I understand what you mean.
As far as I recognize, there is nothing we can do from the AWS Provider side.
(Relationship between resources is managed by Terraform core, rather than the Provider)

One option would be to ask AWS to relax this limitation on the API.

As another workaround, you can use depends_on to enforce serial operations, for example:

resource "aws_route53_zone" "public_zones1" {
  name = var.public_zones["key1"]

  delegation_set_id           = aws_route53_delegation_set.public.id
  enable_accelerated_recovery = true

  lifecycle {
    prevent_destroy = true
  }
}

resource "aws_route53_zone" "public_zones2" {
  name = var.public_zones["key2"]

  delegation_set_id           = aws_route53_delegation_set.public.id
  enable_accelerated_recovery = true

  lifecycle {
    prevent_destroy = true
  }

  depends_on = [aws_route53_zone.public_zones1]
}

resource "aws_route53_zone" "public_zones3" {
  name = var.public_zones["key3"]

  delegation_set_id           = aws_route53_delegation_set.public.id
  enable_accelerated_recovery = true

  lifecycle {
    prevent_destroy = true
  }

  depends_on = [aws_route53_zone.public_zones2]
}

# ...

This should enforce serial operations during apply, while for_each cannot be used.

[ewbankkit]

@tabito-hara We could use the GlobalMutexKV mechanism to ensure that for a single terraform apply run only 1 one at at time is updated. See e.g. internal/service/connect/contact_flow.go.

[tabito-hara]

@ewbankkit Thank you for your information.
I understand that a mutex lock ensures that only one process can use the connection at a time.
By using it, serial operation can be achieved.

I will try to work on this.