Merge pull request #26631 from hashicorp/b-unsupported-instance-metadata-tags

resource/aws_instance: Handle regions where instance metadata tags are unsupported

Author: gdavison

.changelog/26631.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_instance: No longer fails when setting `metadata_options.instance_metadata_tags`
+```

internal/service/ec2/ec2_instance.go

@@ -443,7 +443,7 @@ func ResourceInstance() *schema.Resource {
 						"instance_metadata_tags": {
 							Type:         schema.TypeString,
 							Optional:     true,
-							Default:      ec2.InstanceMetadataTagsStateDisabled,
+							Computed:     true,
 							ValidateFunc: validation.StringInSlice(ec2.InstanceMetadataTagsState_Values(), false),
 						},
 					},
@@ -1672,9 +1672,13 @@ func resourceInstanceUpdate(d *schema.ResourceData, meta interface{}) error {
 					input.InstanceMetadataTags = aws.String(tfMap["instance_metadata_tags"].(string))
 				}
 
-				log.Printf("[DEBUG] Modifying EC2 Instance metadata options: %s", input)
 				_, err := conn.ModifyInstanceMetadataOptions(input)
+				if tfawserr.ErrMessageContains(err, errCodeUnsupportedOperation, "InstanceMetadataTags") {
+					log.Printf("[WARN] updating EC2 Instance (%s) metadata options: %s. Retrying without instance metadata tags.", d.Id(), err)
+					input.InstanceMetadataTags = nil
 
+					_, err = conn.ModifyInstanceMetadataOptions(input)
+				}
 				if err != nil {
 					return fmt.Errorf("updating EC2 Instance (%s) metadata options: %w", d.Id(), err)
 				}

internal/service/ec2/ec2_instance_test.go

@@ -4394,7 +4394,7 @@ func TestAccEC2Instance_metadataOptions(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config: testAccInstanceConfig_metadataOptions(rName),
-				Check: resource.ComposeTestCheckFunc(
+				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckInstanceExists(resourceName, &v),
 					resource.TestCheckResourceAttr(resourceName, "metadata_options.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "metadata_options.0.http_endpoint", "disabled"),
@@ -4405,7 +4405,7 @@ func TestAccEC2Instance_metadataOptions(t *testing.T) {
 			},
 			{
 				Config: testAccInstanceConfig_metadataOptionsUpdated(rName),
-				Check: resource.ComposeTestCheckFunc(
+				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckInstanceExists(resourceName, &v),
 					resource.TestCheckResourceAttr(resourceName, "metadata_options.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "metadata_options.0.http_endpoint", "enabled"),
@@ -4414,6 +4414,17 @@ func TestAccEC2Instance_metadataOptions(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "metadata_options.0.instance_metadata_tags", "enabled"),
 				),
 			},
+			{
+				Config: testAccInstanceConfig_metadataOptionsUpdatedAgain(rName),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckInstanceExists(resourceName, &v),
+					resource.TestCheckResourceAttr(resourceName, "metadata_options.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "metadata_options.0.http_endpoint", "enabled"),
+					resource.TestCheckResourceAttr(resourceName, "metadata_options.0.http_tokens", "optional"),
+					resource.TestCheckResourceAttr(resourceName, "metadata_options.0.http_put_response_hop_limit", "1"),
+					resource.TestCheckResourceAttr(resourceName, "metadata_options.0.instance_metadata_tags", "disabled"),
+				),
+			},
 			{
 				ResourceName:            resourceName,
 				ImportState:             true,
@@ -7691,6 +7702,31 @@ resource "aws_instance" "test" {
 `, rName))
 }
 
+func testAccInstanceConfig_metadataOptionsUpdatedAgain(rName string) string {
+	return acctest.ConfigCompose(
+		acctest.ConfigLatestAmazonLinuxHVMEBSAMI(),
+		testAccInstanceVPCConfig(rName, false, 0),
+		acctest.AvailableEC2InstanceTypeForRegion("t3.micro", "t2.micro"),
+		fmt.Sprintf(`
+resource "aws_instance" "test" {
+  ami           = data.aws_ami.amzn-ami-minimal-hvm-ebs.id
+  instance_type = data.aws_ec2_instance_type_offering.available.instance_type
+  subnet_id     = aws_subnet.test.id
+
+  tags = {
+    Name = %[1]q
+  }
+
+  metadata_options {
+    http_endpoint               = "enabled"
+    http_tokens                 = "optional"
+    http_put_response_hop_limit = 1
+    instance_metadata_tags      = "disabled"
+  }
+}
+`, rName))
+}
+
 func testAccInstanceConfig_enclaveOptions(rName string, enabled bool) string {
 	return acctest.ConfigCompose(
 		acctest.ConfigLatestAmazonLinuxHVMEBSAMI(),