hashicorp/terraform-provider-aws

Unable to update a RAM share to use the latest version of a custom permission

Open

#46,219 opened on Jan 29, 2026

 (3 comments) (3 reactions) (0 assignees)Go (10,310 forks)github user discovery
good first issuenew-resourceservice/ram

Repository metrics

Stars
 (11,045 stars)
PR merge metrics
 (PR metrics pending)

Description

Terraform and AWS Provider Version

Terraform v1.14.3
on darwin_arm64

AWS Provider v 6.29.0

Affected Resource(s) or Data Source(s)

aws_ram_permission aws_ram_resource_share

Expected Behavior

Updating the policy on an aws_ram_permission that is attached to an aws_ram_resource_share should update the version of the policy to the latest to match what is applied.

Actual Behavior

When updating the policy on the policy_template arugment for this resource, the resource is updated, which creates a new version of the policy in AWS. However the version the share is using is not updated to the latest/default. There also seems to be no way to force an update on the aws_ram_resource_share resource to the latest version. The only way to update the version is via the console or AWS CLI

Relevant Error/Panic Output

No response

Sample Terraform Configuration

resource "aws_ram_permission" "r53_profile_associate_resources" {

  name          = "R53ProfileResAssoc"
  resource_type = "route53profiles:Profile"
  policy_template = jsonencode({
    Effect = "Allow"
    Action = [
      "route53profiles:GetProfile",
      "route53profiles:GetProfileResourceAssociation",
      "route53profiles:ListProfileResourceAssociations",
      "route53profiles:AssociateResourceToProfile",
      "route53profiles:DisassociateResourceFromProfile",
      "route53profiles:UpdateProfileResourceAssociation"
    ]
  })

}


resource "aws_ram_resource_share" "r53_profiles" {
  name                      = "route53-inspection-profiles"
  allow_external_principals = false
  permission_arns           = [aws_ram_permission.r53_profile_associate_resources.arn]
}

Steps to Reproduce

  1. Deploy a custom RAM permission and attach it to a resource share
  2. Update the permission's policy to include more/less permissions
  3. The update will apply and a new version of that policy will deploy, but will not attach to the resource share

Debug Logging

GenAI / LLM Assisted Development

n/a

Important Facts and References

No response

Would you like to implement a fix?

No

Contributor guide