[Docs]: Terraform Import for OpenSearch VPC Endpoint Access

[aiell0]

Documentation Link

https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/opensearch_authorize_vpc_endpoint_access#import

Description

I am attempting to import some VPC authorizations for Opensearch and am confused on how to find the resource ID. The documentation says it is in the form authorize_vpc_endpoint_access-id-12345678. I do not know where to find the ID at the end. I assumed it was the account ID and when I try that I get the following error in my Terraform:

│ Error: setting AWS OpenSearch Authorize Vpc Endpoint Access ("authorize_vpc_endpoint_access-id-<account_id>"): operation error OpenSearch: ListVpcEndpointAccess, https response error StatusCode: 400, RequestID: 3348ce8d-3ee2-4997-a3b4-78403972c00f, api error ValidationException: 2 validation errors detected: Value 'authorize_vpc_endpoint_access-id-<account_id>' at 'domainName' failed to satisfy constraint: Member must satisfy regular expression pattern: [a-z][a-z0-9\-]+; Value 'authorize_vpc_endpoint_access-id-<account_id>' at 'domainName' failed to satisfy constraint: Member must have length less than or equal to 28
│ 
│ operation error OpenSearch: ListVpcEndpointAccess, https response error
│ StatusCode: 400, RequestID: 3348ce8d-3ee2-4997-a3b4-78403972c00f, api error
│ ValidationException: 2 validation errors detected: Value
│ 'authorize_vpc_endpoint_access-id-<account_id>' at 'domainName' failed to
│ satisfy constraint: Member must satisfy regular expression pattern:
│ [a-z][a-z0-9\-]+; Value 'authorize_vpc_endpoint_access-id-<account_id>' at
│ 'domainName' failed to satisfy constraint: Member must have length less
│ than or equal to 28
╵
Operation failed: failed running terraform plan (exit 1)

What is this ID supposed to be? And can that be referenced correctly in the docs?

References

Maybe related to #40614?

Would you like to implement a fix?

None

[github-actions]

Community Note

Voting for Prioritization

• Please vote on this issue by adding a 👍 reaction to the original post to help the community and maintainers prioritize this request.
• Please see our prioritization guide for information on how we prioritize.
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request.

Volunteering to Work on This Issue

• If you are interested in working on this issue, please leave a comment.
• If this would be your first contribution, please review the contribution guide.

[stefanfreitag]

Hi @aiell0!

Thanks for raising the issue!
I had a look into the source code the AWS API documentation.

The error message you see arises from the validations attached to the DomainName argument when executing ListVpcEndpointAccess.

In the source code I see that the domainName should be used when importing the resource.
Can you please check if this works for you?

I did a successful test with below code

data "aws_caller_identity" "current" {}

resource "aws_opensearch_authorize_vpc_endpoint_access" "test" {
  domain_name = "terraform-test"
  account     = data.aws_caller_identity.current.account_id
}

(the domain was created manually upfront and was in state "active")

and output

❯ terraform import aws_opensearch_authorize_vpc_endpoint_access.test terraform-test
2024-12-27T22:08:48.410+0100 [INFO]  Terraform version: 1.10.2
2024-12-27T22:08:48.411+0100 [INFO]  Go runtime version: go1.23.3
2024-12-27T22:08:48.411+0100 [INFO]  CLI args: []string{"terraform", "import", "aws_opensearch_authorize_vpc_endpoint_access.test", "terraform-test"}
2024-12-27T22:08:48.411+0100 [INFO]  Loading CLI configuration from /home/stefan/.terraform.d/credentials.tfrc.json
2024-12-27T22:08:48.411+0100 [INFO]  CLI command args: []string{"import", "aws_opensearch_authorize_vpc_endpoint_access.test", "terraform-test"}
2024-12-27T22:08:48.970+0100 [INFO]  provider: configuring client automatic mTLS
2024-12-27T22:08:49.152+0100 [INFO]  provider.terraform-provider-aws_v5.82.1_x5: configuring server automatic mTLS: timestamp="2024-12-27T22:08:49.151+0100"
2024-12-27T22:08:50.348+0100 [INFO]  provider: plugin process exited: plugin=.terraform/providers/registry.terraform.io/hashicorp/aws/5.82.1/linux_amd64/terraform-provider-aws_v5.82.1_x5 id=45276
2024-12-27T22:08:50.350+0100 [INFO]  provider: configuring client automatic mTLS
2024-12-27T22:08:50.517+0100 [INFO]  provider.terraform-provider-aws_v5.82.1_x5: configuring server automatic mTLS: timestamp="2024-12-27T22:08:50.517+0100"
2024-12-27T22:08:50.638+0100 [INFO]  provider.terraform-provider-aws_v5.82.1_x5: Retrieved credentials: tf_provider_addr=registry.terraform.io/hashicorp/aws tf_rpc=ConfigureProvider @module=aws.aws-base tf_aws.credentials_source=EnvConfigCredentials tf_mux_provider="*schema.GRPCProviderServer" tf_req_id=9c974f9c-a2ec-a079-75af-d48047cfaf4d @caller=github.com/hashicorp/aws-sdk-go-base/v2@v2.0.0-beta.59/logging/tf_logger.go:39 timestamp="2024-12-27T22:08:50.638+0100"
2024-12-27T22:08:50.788+0100 [INFO]  provider.terraform-provider-aws_v5.82.1_x5: Retrieved caller identity from STS: @module=aws.aws-base tf_mux_provider="*schema.GRPCProviderServer" tf_provider_addr=registry.terraform.io/hashicorp/aws tf_req_id=9c974f9c-a2ec-a079-75af-d48047cfaf4d tf_rpc=ConfigureProvider @caller=github.com/hashicorp/aws-sdk-go-base/v2@v2.0.0-beta.59/logging/tf_logger.go:39 timestamp="2024-12-27T22:08:50.788+0100"
data.aws_caller_identity.current: Reading...
data.aws_caller_identity.current: Read complete after 0s [id=<redacted>]
aws_opensearch_authorize_vpc_endpoint_access.test: Importing from ID "terraform-test"...
aws_opensearch_authorize_vpc_endpoint_access.test: Import prepared!
  Prepared aws_opensearch_authorize_vpc_endpoint_access for import
aws_opensearch_authorize_vpc_endpoint_access.test: Refreshing state...
2024-12-27T22:08:51.096+0100 [INFO]  provider: plugin process exited: plugin=.terraform/providers/registry.terraform.io/hashicorp/aws/5.82.1/linux_amd64/terraform-provider-aws_v5.82.1_x5 id=45316
2024-12-27T22:08:51.096+0100 [INFO]  Writing state output to:

Import successful!

The resources that were imported are shown above. These resources are now in
your Terraform state and will henceforth be managed by Terraform.

[kahlstrm]

Hi, coming to shine some light to this issue, as I'm also encountering this.
terraform import aws_opensearch_authorize_vpc_endpoint_access.test terraform-test is an insufficient usage of the resource, as I'd guess the expected usage of the resource would be:

resource "aws_opensearch_authorize_vpc_endpoint_access" "test-account1" {
  domain_name = "terraform-test"
  account     = "<some-other-account-id1>"
)
resource "aws_opensearch_authorize_vpc_endpoint_access" "test-account2" {
  domain_name = "terraform-test"
  account     = "<some-other-account-id2>"
)

This way, it would be required to specify more than the domain name in the ID. As @aiell0 points out, the docs have this format of authorize_vpc_endpoint_access-id-12345678, which just plain and simple doesn't seem to work.
I have tried domainName-12345678 and domainName-id-12345678 and none of these seem to work, as they seem to all think the domainName-12345678 in its entirety is the domainName 🤔