Check tags are present on parameter group before update

[ryan-caarter]

Description

When ABAC is used to control modification of an RDS Parameter Group, IAM Eventual Consistency can block the update command when creating a Parameter Group as the tags used for ABAC haven't propagated to the resource in time for the update, and so an AccessDenied error can occur. We've found this to be an issue in multiple of our AWS accounts:

Error: modifying RDS Cluster Parameter Group (DB_NAME): operation error RDS: ModifyDBClusterParameterGroup, https response error StatusCode: 403, RequestID: 123456789, api error AccessDenied: User: arn:aws:sts::ACCOUNT_ID:assumed-role/ROLE_NAME/aws-go-sdk-123456789 is not authorized to perform: rds:ModifyDBClusterParameterGroup on resource: arn:aws:rds:REGION:ACCOUNT_ID:cluster-pg:DB_NAME-123456789 because no identity-based policy allows the rds:ModifyDBClusterParameterGroup action

There are a few options to fix this:

• Poll the tags existence and then call update - this isn't backward compatible as users would need rds: ListTagsForResource
• Add a wait before attempting the update - worse user experience for most users
• Retry for a good amount of time if AccessDenied is thrown. AWS says most resources are consistent within 5mins, this is too long, from our experience with tags, 10s should be plenty

Relations

Closes #0000

References

Output from Acceptance Testing

% make testacc TESTS=TestAccXXX PKG=ec2

...

[github-actions]

Community Note

Voting for Prioritization

• Please vote on this pull request by adding a 👍 reaction to the original post to help the community and maintainers prioritize this pull request.
• Please see our prioritization guide for information on how we prioritize.
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request.

For Submitters

• Review the contribution guide relating to the type of change you are making to ensure all of the necessary steps have been taken.
• For new resources and data sources, use skaff to generate scaffolding with comments detailing common expectations.
• Whether or not the branch has been rebased will not impact prioritization, but doing so is always a welcome surprise.

[github-actions]

Welcome @ryan-caarter 👋

It looks like this is your first Pull Request submission to the Terraform AWS Provider! If you haven’t already done so please make sure you have checked out our CONTRIBUTOR guide and FAQ to make sure your contribution is adhering to best practice and has all the necessary elements in place for a successful approval.

Also take a look at our FAQ which details how we prioritize Pull Requests for inclusion.

Thanks again, and welcome to the community! 😃