[Bug]:aws_iam_account_alias data source fails when an AWS Account has no IAM alias

[gswallow]

Terraform Core Version

1.1.5

AWS Provider Version

3.22.0

Affected Resource(s)

The aws_iam_account_alias data source, when operating in a brand new AWS account where the administrator has not set an IAM alias yet, returns an error: "no IAM account alias found."

Yet there is a default alias which matches the 12-digit account number of the AWS account.

Expected Behavior

Perhaps a reasonable alternative is to return the 12-digit account ID when an account alias does not exist?

Actual Behavior

Terraform plan fails.

Relevant Error/Panic Output Snippet

Error: no IAM account alias found

   with module.bucket.data.aws_iam_account_alias.current,
   on .terraform/modules/bucket/terraform-backend-bucket/data.tf line 1, in data "aws_iam_account_alias" "current":
    1: data "aws_iam_account_alias" "current" {

Terraform Configuration Files

data "aws_iam_account_alias" "current" {}

Steps to Reproduce

run terraform plan in a new AWS account

Debug Output

No response

Panic Output

No response

Important Factoids

No response

References

No response

Would you like to implement a fix?

None

[github-actions]

Community Note

Voting for Prioritization

• Please vote on this issue by adding a 👍 reaction to the original post to help the community and maintainers prioritize this request.
• Please see our prioritization guide for information on how we prioritize.
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request.

Volunteering to Work on This Issue

• If you are interested in working on this issue, please leave a comment.
• If this would be your first contribution, please review the contribution guide.

[ascopes]

Bump for this; would be nice to see it get set to a null value so modules using this can ignore it.

data "aws_caller_identity" "me" {}
data "aws_iam_account_alias" "this_account" {}

module "foo" {
  source       = "..."
  account_name = coalesce(
    data.aws_iam_account_alias.this_account.account_alias,
    data.aws_caller_identity.me.account_id,
  )
}

[jose-pablo-camacho]

Confirm this is still an issue with Terraform v1.5.7 and AWS provider v5.70.0.

[rjhornsby]

The opposite of this is also true. Might be a separate issue, but certainly related.

TL;DR:

• if no alias is set, data will error out.
• if an alias has been set outside TF, resource will error out.

If the account already has an alias set, and you try to set one with resource "aws_iam_account_alias" "alias" you get back a 409 from the AWS API EntityAlreadyExists: The account alias my-account-alias already exists. I expected the resource to overwrite the existing value, similar to how it does for route53 records.

Yes, you could legitimately call this a problem with the AWS API and/or the design from the AWS side but regardless of where the fault lies, between the "does not exist" or "already exists" errors there's not a good way I can think of to manage the alias except to use the AWS API/CLI outside of terraform to ensure all of your accounts have the alias unset or set, and then use Terraform to read (data)/manage (resource) it.