Terraform更新aws_ssm_association触发ValidationException错误排查

已成功部署以下Terraform代码：

resource "aws_ssm_association" "webssmassoc" {
name = "arn:aws:ssm:eu-west-1:*********:document/a4s-bl-automation"
association_name = "${var.service_name}-dt-webserver-association"
parameters = {
  AssumeRole = aws_iam_role.dt_automation_role.arn
  InstanceId = data.aws_instance.webinstance.id
}
apply_only_at_cron_interval = true
schedule_expression = "cron(0 14 ? * ${local.dayOfWeek} *)"
}

修改schedule_expression后执行terraform plan，Terraform正确检测到变更：

# aws_ssm_association.webssmassoc will be updated in-place
  ~ resource "aws_ssm_association" "webssmassoc" {
        id                          = "0b9ee1a4-6011-4a9c-9055-2cca172b061e"
        name                        = "arn:aws:ssm:eu-west-1:497882509041:document/a4s-oneagent-reboot-automation"
      ~ schedule_expression         = "cron(0 14 ? * TUE *)" -> "cron(0 15 ? * TUE *)"
        # (6 unchanged attributes hidden)

        # (1 unchanged block hidden)
    } 

但执行terraform apply时触发错误：

│ Error: Error updating SSM association: ValidationException: Must specify both Automation Target Parameter Name and Targets   
│       status code: 400, request id: e4e80ff6-1235-4355-9221-2031a1fb922d
│
│   with aws_ssm_association.webssmassoc,
│   on main.tf line 118, in resource "aws_ssm_association" "webssmassoc":
│  118: resource "aws_ssm_association" "webssmassoc" {

补充信息：关联的文档为自动化文档，使用的Provider是hashicorp/aws v4.33.0，Terraform版本为v1.1.5。

这不是Terraform的Bug，是AWS SSM API的预期行为。

原因：更新SSM关联的schedule_expression时，AWS的UpdateAssociation API会重新验证整个关联配置。对于自动化类型的SSM文档，API强制要求必须同时指定automation_target_parameter_name和targets参数——即使创建关联时你通过parameters里的InstanceId直接指定了实例，更新调度触发API调用时，完整验证逻辑会要求补充这两个字段。

Terraform的plan阶段仅对比本地状态与配置的差异，不会提前调用AWS API做完整参数验证，因此只检测到schedule_expression的变更，未发现参数缺失问题；直到apply阶段调用AWS API时才触发验证报错。

在aws_ssm_association资源中补充automation_target_parameter_name和targets配置，示例如下：

resource "aws_ssm_association" "webssmassoc" {
  name                     = "arn:aws:ssm:eu-west-1:*********:document/a4s-bl-automation"
  association_name         = "${var.service_name}-dt-webserver-association"
  parameters = {
    AssumeRole = aws_iam_role.dt_automation_role.arn
    InstanceId = data.aws_instance.webinstance.id
  }
  apply_only_at_cron_interval = true
  schedule_expression         = "cron(0 15 ? * ${local.dayOfWeek} *)"
  
  # 补充API要求的参数
  automation_target_parameter_name = "InstanceId"
  targets {
    key    = "InstanceIds"
    values = [data.aws_instance.webinstance.id]
  }
}

内容的提问来源于stack exchange，提问作者bala