`aws_elasticache_serverless_cache` Security Group Ids are incorrectly optional.

Terraform and AWS Provider Version

terraform --version
Terraform v1.11.2
on darwin_arm64
+ provider registry.terraform.io/grafana/grafana v3.25.3
+ provider registry.terraform.io/hashicorp/aws v5.100.0

Your version of Terraform is out of date! The latest version
is 1.12.2. You can update by downloading from https://www.terraform.io/downloads.html

Affected Resource(s) or Data Source(s)

• aws_elasticache_serverless_cache

Expected Behavior

It should create an aws_elasticache_serverless_cache with the default vpc security group.

Actual Behavior

It fails to create an aws_elasticache_serverless_cache with the default aws vpc security group.

Relevant Error/Panic Output

resource "aws_elasticache_serverless_cache" "this" {
      + arn                      = (known after apply)
      + create_time              = (known after apply)
      + daily_snapshot_time      = (known after apply)
      + description              = "An example Valkey cache"
      + endpoint                 = (known after apply)
      + engine                   = "valkey"
      + full_engine_version      = (known after apply)
      + id                       = (known after apply)
      + major_engine_version     = "8"
      + name                     = "valkey-dolphin-dev"
      + reader_endpoint          = (known after apply)
      + security_group_ids       = []
      + snapshot_retention_limit = 5
      + status                   = (known after apply)
      + subnet_ids               = [
          + "subnet-02151b946ac1671b4",
          + "subnet-08f35f7afd35a351e",
          + "subnet-0d50bc38f84783a42",
        ]
    }

Plan: 1 to add, 0 to change, 0 to destroy.

Do you want to perform these actions?
  Terraform will perform the actions described above.
  Only 'yes' will be accepted to approve.

  Enter a value: yes

module.valkey.aws_elasticache_serverless_cache.this: Creating...
module.valkey.aws_elasticache_serverless_cache.this: Still creating... [10s elapsed]
module.valkey.aws_elasticache_serverless_cache.this: Still creating... [20s elapsed]
module.valkey.aws_elasticache_serverless_cache.this: Still creating... [30s elapsed]
module.valkey.aws_elasticache_serverless_cache.this: Still creating... [40s elapsed]
module.valkey.aws_elasticache_serverless_cache.this: Still creating... [50s elapsed]
module.valkey.aws_elasticache_serverless_cache.this: Still creating... [1m0s elapsed]
module.valkey.aws_elasticache_serverless_cache.this: Still creating... [1m10s elapsed]
module.valkey.aws_elasticache_serverless_cache.this: Still creating... [1m20s elapsed]
module.valkey.aws_elasticache_serverless_cache.this: Still creating... [1m30s elapsed]
module.valkey.aws_elasticache_serverless_cache.this: Still creating... [1m40s elapsed]
╷
│ Error: Provider produced inconsistent result after apply
│
│ When applying changes to module.valkey.aws_elasticache_serverless_cache.this, provider "provider[\"registry.terraform.io/hashicorp/aws\"]" produced an
│ unexpected new value: .security_group_ids: actual set element cty.StringVal("sg-0cfac4733977eae5f") does not correlate with any element in plan.
│
│ This is a bug in the provider, which should be reported in the provider's own issue tracker.
╵
╷
│ Error: Provider produced inconsistent result after apply
│
│ When applying changes to module.valkey.aws_elasticache_serverless_cache.this, provider "provider[\"registry.terraform.io/hashicorp/aws\"]" produced an
│ unexpected new value: .security_group_ids: length changed from 0 to 1.
│
│ This is a bug in the provider, which should be reported in the provider's own issue tracker.
╵
Releasing state lock. This may take a few moments...

Sample Terraform Configuration

locals {
  vpc_cidr = "10.10.0.0/16"
}

module "vpc" {
  source  = "terraform-aws-modules/vpc/aws"
  version = "5.19.0"

  name = "cache-vpc-${local.environment}"
  cidr = local.vpc_cidr

  azs             = ["ap-southeast-2a", "ap-southeast-2b", "ap-southeast-2c"]
  private_subnets = ["10.10.1.0/24", "10.10.2.0/24", "10.10.3.0/24"]
  public_subnets  = ["10.10.101.0/24", "10.10.102.0/24", "10.10.103.0/24"]

  enable_nat_gateway = true
  single_nat_gateway = true
}

resource "aws_elasticache_serverless_cache" "this" {
  name        = "Example"
  description = "descriptoin"

  engine               = "valkey"
  major_engine_version = 8

  subnet_ids         = module.vpc.public_subnets
  security_group_ids = []

  snapshot_retention_limit = 5
}

Steps to Reproduce

I simplified the code a bit.

1. terraform apply

Debug Logging

GenAI / LLM Assisted Development

n/a

Important Facts and References

The issue is that in aws_elasticache_serverless_cache the security_group_ids input is optional. Probably don't make it optional.

Would you like to implement a fix?

No