[Bug]: FMS policy does not support multiple tags with same key but different value due to map type

[wites342]

Terraform Core Version

v1.10.5

AWS Provider Version

v5.84.0

Affected Resource(s)

aws_fms_policy

Terraform Configuration Files

resource "aws_fms_policy" "default" {
  name                               = "test-policy"
  exclude_resource_tags              = false
  remediation_enabled                = true
  delete_unused_fm_managed_resources = true
  resource_type_list                 = ["AWS::ElasticLoadBalancingV2::LoadBalancer"]
  resource_tags                      = {
    waf = "x1",
    waf = "x2",
    waf = "x3"
  }


  security_service_policy_data {
    type = "WAFV2"

    managed_service_data = jsonencode({
      type                                    = "WAFV2"
      sampledRequestsEnabledForDefaultActions = null
      preProcessRuleGroups                    = [{
    ruleGroupArn  = null
    ruleGroupType = "ManagedRuleGroup"
    overrideAction = {
      type = "NONE"
    }
    managedRuleGroupIdentifier = {
      vendorName           = "AWS"
      managedRuleGroupName = "AWSManagedRulesAmazonIpReputationList"
      version              = null
      versionEnabled       = null
    }
    sampledRequestsEnabled = null
    excludeRules           = null

  }]
      postProcessRuleGroups                   = []
      defaultAction = {
        type = "Allow"
      }
      overrideCustomerWebACLAssociation = false
      loggingConfiguration = {
        logDestinationConfigs = null
        loggingFilterConfigs  = null
        redactedFields        = []
      }
    })
  }



  tags = {
    Name = "test-policy"
  }
}

Expected Behavior

I was expecting to have listed all resource_tags defined. Also duplicated

Actual Behavior

It only lists last value of given tag key in the map and ommits all previous

Steps to Reproduce

Run terraform plan with given terraform config input

Important Factoids

Terraform plan:

Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols:
  + create

Terraform will perform the following actions:

  # aws_fms_policy.default will be created
  + resource "aws_fms_policy" "default" {
      + arn                                = (known after apply)
      + delete_all_policy_resources        = true
      + delete_unused_fm_managed_resources = true
      + exclude_resource_tags              = false
      + id                                 = (known after apply)
      + name                               = "test-policy"
      + policy_update_token                = (known after apply)
      + remediation_enabled                = true
      + resource_tags                      = {
          + "waf" = "x3"
        }
      + resource_type                      = (known after apply)
      + resource_type_list                 = [
          + "AWS::ElasticLoadBalancingV2::LoadBalancer",
        ]
      + tags                               = {
          + "Name" = "test-policy"
        }
      + tags_all                           = {
          + "Name" = "test-policy"
        }

      + security_service_policy_data {
          + managed_service_data = jsonencode(
                {
                  + defaultAction                           = {
                      + type = "Allow"
                    }
                  + loggingConfiguration                    = {
                      + logDestinationConfigs = null
                      + loggingFilterConfigs  = null
                      + redactedFields        = []
                    }
                  + overrideCustomerWebACLAssociation       = false
                  + postProcessRuleGroups                   = []
                  + preProcessRuleGroups                    = [
                      + {
                          + excludeRules               = null
                          + managedRuleGroupIdentifier = {
                              + managedRuleGroupName = "AWSManagedRulesAmazonIpReputationList"
                              + vendorName           = "AWS"
                              + version              = null
                              + versionEnabled       = null
                            }
                          + overrideAction             = {
                              + type = "NONE"
                            }
                          + ruleGroupArn               = null
                          + ruleGroupType              = "ManagedRuleGroup"
                          + sampledRequestsEnabled     = null
                        },
                    ]
                  + sampledRequestsEnabledForDefaultActions = null
                  + type                                    = "WAFV2"
                }
            )
          + type                 = "WAFV2"
        }
    }

Plan: 1 to add, 0 to change, 0 to destroy.

References

Already mentioned in #25880 but closed

Would you like to implement a fix?

None

[github-actions]

Community Note

Voting for Prioritization

• Please vote on this issue by adding a 👍 reaction to the original post to help the community and maintainers prioritize this request.
• Please see our prioritization guide for information on how we prioritize.
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request.

Volunteering to Work on This Issue

• If you are interested in working on this issue, please leave a comment.
• If this would be your first contribution, please review the contribution guide.