[Bug]: aws_quicksight_folder folder permissions

[rhiser]

Terraform Core Version

1.5.0

AWS Provider Version

5.9.0

Affected Resource(s)

• aws_quicksight_folder

Expected Behavior

Resource aws_quicksight_folder and the object permissions should allow for more customized list of actions.

Actual Behavior

│ Error: updating QuickSight Folder (test) permissions: InvalidParameterValueException: ResourcePermission list contains unsupported permission sets [quicksight:DescribeFolder, quicksight:DescribeFolderPermissions] for this resource. Valid sets : [quicksight:DescribeFolder] or [quicksight:CreateFolder, quicksight:DescribeFolder, quicksight:UpdateFolder, quicksight:DeleteFolder, quicksight:CreateFolderMembership, quicksight:DeleteFolderMembership, quicksight:DescribeFolderPermissions, quicksight:UpdateFolderPermissions]
│ {
│   RespMetadata: {
│     StatusCode: 400,
│     RequestID: "f30fd416-8697-4999-8cde-017a0a7b112b"
│   },
│   Message_: "ResourcePermission list contains unsupported permission sets [quicksight:DescribeFolder, quicksight:DescribeFolderPermissions] for this resource. Valid sets : [quicksight:DescribeFolder] or [quicksight:CreateFolder, quicksight:DescribeFolder, quicksight:UpdateFolder, quicksight:DeleteFolder, quicksight:CreateFolderMembership, quicksight:DeleteFolderMembership, quicksight:DescribeFolderPermissions, quicksight:UpdateFolderPermissions]"
│ }
│
│   with module.quicksight.aws_quicksight_folder.test,
│   on modules/data_lake/quicksight/folders.tf line 12, in resource "aws_quicksight_folder" "test":
│   12: resource "aws_quicksight_folder" "test" {
│

Relevant Error/Panic Output Snippet

No response

Terraform Configuration Files

resource "aws_quicksight_folder" "test" {
  folder_id = "test"
  name      = "test"
  permissions {
    actions = [
      "quicksight:DescribeFolder",
      "quicksight:DescribeFolderPermissions",
    ]
    principal = aws_quicksight_group.manage_users["test"].arn
  }
}

Steps to Reproduce

terraform init
terraform apply

Debug Output

No response

Panic Output

No response

Important Factoids

I was able to update the folder permissions using AWS Api successfully.

 aws quicksight update-folder-permissions --aws-account-id xxx --folder-id test
{
    "Status": 200,
    "Arn": "arn:aws:quicksight:us-east-2:xxx:folder/test",
    "FolderId": "test",
    "Permissions": [],
    "RequestId": "9bab9c52-b09c-45b8-b0fe-72bedfe5c4b5"
}

aws quicksight update-folder-permissions --aws-account-id xxx --folder-id test --grant-permissions Principal=arn:aws:quicksight:us-east-1:xxx:group/default/test,Actions="quicksight:DescribeFolder"
{
    "Status": 200,
    "Arn": "arn:aws:quicksight:us-east-1:xxx:folder/test",
    "FolderId": "test",
    "Permissions": [
        {
            "Principal": "arn:aws:quicksight:us-east-1:xxx:group/default/test",
            "Actions": [
                "quicksight:DescribeFolder"
            ]
        }
    ],
    "RequestId": "736f9cc8-0da0-4a1e-9e79-04730d075867"
}

References

No response

Would you like to implement a fix?

None

[github-actions]

Community Note

Voting for Prioritization

• Please vote on this issue by adding a 👍 reaction to the original post to help the community and maintainers prioritize this request.
• Please see our prioritization guide for information on how we prioritize.
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request.

Volunteering to Work on This Issue

• If you are interested in working on this issue, please leave a comment.
• If this would be your first contribution, please review the contribution guide.

[justinretzolk]

Hey @rhiser 👋 Thank you for taking the time to raise this! It looks like this error is coming from the AWS API itself. Looking at your example of a similar action from the AWS CLI, I'm not sure that it's comparable to what you're trying to accomplish with Terraform.

Looking at the error message, the UpdateFolderPermissions reference, and your example from the AWS CLI, it appears to me that you have two options for valid actions values when updating the permissions:

• [quicksight:DescribeFolder]
• [quicksight:CreateFolder, quicksight:DescribeFolder, quicksight:UpdateFolder, quicksight:DeleteFolder, quicksight:CreateFolderMembership, quicksight:DeleteFolderMembership, quicksight:DescribeFolderPermissions, quicksight:UpdateFolderPermissions]

The former is what you used when successfully using the AWS CLI, and the latter of the two is what's used in the UpdateFolderPermissions documentation. It doesn't appear that the API allows for any other values, as far as I can tell. Can you test with that in mind and let me know if it resolves the issue?

[Mannyknp]

Hi, It is true that API itself expects a predefined set of permissions. But I am facing the same issue when I want to change the folder permission from
[quicksight:CreateFolder, quicksight:DescribeFolder, quicksight:UpdateFolder, quicksight:DeleteFolder, quicksight:CreateFolderMembership, quicksight:DeleteFolderMembership, quicksight:DescribeFolderPermissions, quicksight:UpdateFolderPermissions]
to
[quicksight:DescribeFolder]

as tf tries to delete the existing permissions excluding quicksight:DescribeFolder and runs into same issue.

module.quicksight.aws_quicksight_folder.departments["XXXX"] will be updated in-place
~ resource "aws_quicksight_folder" "XXXX" {
id = "abdbcba,xxx-xxx-xxx"
name = "XXXX"
tags = {}
# (9 unchanged attributes hidden)

  ~ permissions {
      ~ actions   = [
          - "quicksight:CreateFolder",
          - "quicksight:CreateFolderMembership",
          - "quicksight:DeleteFolder",
          - "quicksight:DeleteFolderMembership",
          - "quicksight:DescribeFolderPermissions",
          - "quicksight:UpdateFolder",
          - "quicksight:UpdateFolderPermissions",
            # (1 unchanged element hidden)
        ]
        # (1 unchanged attribute hidden)
    }
  + permissions {
      + actions   = [
          + "quicksight:CreateFolder",
          + "quicksight:CreateFolderMembership",
          + "quicksight:DeleteFolder",
          + "quicksight:DeleteFolderMembership",
          + "quicksight:DescribeFolder",
          + "quicksight:DescribeFolderPermissions",
          + "quicksight:UpdateFolder",
          + "quicksight:UpdateFolderPermissions",
        ]
      + principal = "arn:aws:quicksight:us-east-1:aaaaaaaa:group/default/xxx-xxxx"
    }
}

│ Error: updating QuickSight Folder (XXXX) permissions: InvalidParameterValueException: ResourcePermission list contains unsupported permission sets [quicksight:CreateFolderMembership, quicksight:CreateFolder, quicksight:UpdateFolderPermissions, quicksight:UpdateFolder, quicksight:DeleteFolder, quicksight:DeleteFolderMembership, quicksight:DescribeFolderPermissions] for this resource. Valid sets : [quicksight:DescribeFolder] or [quicksight:CreateFolder, quicksight:DescribeFolder, quicksight:UpdateFolder, quicksight:DeleteFolder, quicksight:CreateFolderMembership, quicksight:DeleteFolderMembership, quicksight:DescribeFolderPermissions, quicksight:UpdateFolderPermissions]
│ {
│ RespMetadata: {
│ StatusCode: 400,
│ RequestID: "yyyy-xxxx-asds-adsd-sdsds"
│ },
│ Message_: "ResourcePermission list contains unsupported permission sets [quicksight:CreateFolderMembership, quicksight:CreateFolder, quicksight:UpdateFolderPermissions, quicksight:UpdateFolder, quicksight:DeleteFolder, quicksight:DeleteFolderMembership, quicksight:DescribeFolderPermissions] for this resource. Valid sets : [quicksight:DescribeFolder] or [quicksight:CreateFolder, quicksight:DescribeFolder, quicksight:UpdateFolder, quicksight:DeleteFolder, quicksight:CreateFolderMembership, quicksight:DeleteFolderMembership, quicksight:DescribeFolderPermissions, quicksight:UpdateFolderPermissions]"
│ }

[Mannyknp]

Hi, Do we have any update on the issue?

Hi, It is true that API itself expects a predefined set of permissions. But I am facing the same issue when I want to change the folder permission from [quicksight:CreateFolder, quicksight:DescribeFolder, quicksight:UpdateFolder, quicksight:DeleteFolder, quicksight:CreateFolderMembership, quicksight:DeleteFolderMembership, quicksight:DescribeFolderPermissions, quicksight:UpdateFolderPermissions] to [quicksight:DescribeFolder]

as tf tries to delete the existing permissions excluding quicksight:DescribeFolder and runs into same issue.

module.quicksight.aws_quicksight_folder.departments["XXXX"] will be updated in-place ~ resource "aws_quicksight_folder" "XXXX" { id = "abdbcba,xxx-xxx-xxx" name = "XXXX" tags = {} # (9 unchanged attributes hidden)

  ~ permissions {
      ~ actions   = [
          - "quicksight:CreateFolder",
          - "quicksight:CreateFolderMembership",
          - "quicksight:DeleteFolder",
          - "quicksight:DeleteFolderMembership",
          - "quicksight:DescribeFolderPermissions",
          - "quicksight:UpdateFolder",
          - "quicksight:UpdateFolderPermissions",
            # (1 unchanged element hidden)
        ]
        # (1 unchanged attribute hidden)
    }
  + permissions {
      + actions   = [
          + "quicksight:CreateFolder",
          + "quicksight:CreateFolderMembership",
          + "quicksight:DeleteFolder",
          + "quicksight:DeleteFolderMembership",
          + "quicksight:DescribeFolder",
          + "quicksight:DescribeFolderPermissions",
          + "quicksight:UpdateFolder",
          + "quicksight:UpdateFolderPermissions",
        ]
      + principal = "arn:aws:quicksight:us-east-1:aaaaaaaa:group/default/xxx-xxxx"
    }
}

│ Error: updating QuickSight Folder (XXXX) permissions: InvalidParameterValueException: ResourcePermission list contains unsupported permission sets [quicksight:CreateFolderMembership, quicksight:CreateFolder, quicksight:UpdateFolderPermissions, quicksight:UpdateFolder, quicksight:DeleteFolder, quicksight:DeleteFolderMembership, quicksight:DescribeFolderPermissions] for this resource. Valid sets : [quicksight:DescribeFolder] or [quicksight:CreateFolder, quicksight:DescribeFolder, quicksight:UpdateFolder, quicksight:DeleteFolder, quicksight:CreateFolderMembership, quicksight:DeleteFolderMembership, quicksight:DescribeFolderPermissions, quicksight:UpdateFolderPermissions] │ { │ RespMetadata: { │ StatusCode: 400, │ RequestID: "yyyy-xxxx-asds-adsd-sdsds" │ }, │ Message_: "ResourcePermission list contains unsupported permission sets [quicksight:CreateFolderMembership, quicksight:CreateFolder, quicksight:UpdateFolderPermissions, quicksight:UpdateFolder, quicksight:DeleteFolder, quicksight:DeleteFolderMembership, quicksight:DescribeFolderPermissions] for this resource. Valid sets : [quicksight:DescribeFolder] or [quicksight:CreateFolder, quicksight:DescribeFolder, quicksight:UpdateFolder, quicksight:DeleteFolder, quicksight:CreateFolderMembership, quicksight:DeleteFolderMembership, quicksight:DescribeFolderPermissions, quicksight:UpdateFolderPermissions]" │ }

[shubhanshurastogi]

I also face the same issue when permitting Topic

I get the error as above for Topic