[Bug]: SageMaker App Image Config: API rejects valid UID/GID pairs defined in provider schema

Terraform Core Version

1.10.4

AWS Provider Version

5.84.0

Affected Resource(s)

• resource aws_sagemaker_app_image_config

Expected Behavior

The AWS Provider schema explicitly allows certain UID/GID combinations for SageMaker App Image Config's file_system_config, but the AWS API rejects these valid combinations.

In app_image_config.go, the schema validation allows:

"default_gid": {
    Type:         schema.TypeInt,
    Optional:     true,
    Default:      100,
    ValidateFunc: validation.IntInSlice([]int{0, 100}),
},
"default_uid": {
    Type:         schema.TypeInt,
    Optional:     true,
    Default:      1000,
    ValidateFunc: validation.IntInSlice([]int{0, 1000}),
},

However, when attempting to use the [0,0] pair which should be valid according to the schema, the API rejects it:

Error: updating SageMaker App Image Config: operation error SageMaker: UpdateAppImageConfig, https response error StatusCode: 400, RequestID: ace80b14-653d-47c0-8225-01aa5cd43ad7, api error ValidationException: Unsupported FileSystemConfig parameters. Only supported values of DefaultUId and DefaultGID are 1000 and 100 respectively

Additionally, AWS documentation suggests that other UID combinations (like 1001) should be valid for migration scenarios: https://docs.aws.amazon.com/sagemaker/latest/dg/studio-updated-migrate-lcc.html

Actual Behavior

The provider rejects the [0,0] UID/GID pair with a validation error, suggesting only [1000,100] is valid. This appears to be incorrect validation in the provider rather than an AWS API limitation.

Relevant Error/Panic Output Snippet

Terraform Configuration Files

resource "aws_sagemaker_app_image_config" "gpu" {
  app_image_config_name = "gpu"
  jupyter_lab_image_config {
    file_system_config {
      default_uid = 0
      default_gid = 0
    }
  }
}

Steps to Reproduce

resource "aws_sagemaker_app_image_config" "example" {
  app_image_config_name = "example"
  jupyter_lab_image_config {
    file_system_config {
      default_uid = 0
      default_gid = 0
    }
  }
}

Debug Output

DEBUG provider.terraform-provider-aws_v5.84.0_x5: [DEBUG] SageMaker App Image Config update config:
HTTP Request Body:
{"AppImageConfigName":"baseline-staging-cpu","JupyterLabAppImageConfig":{"ContainerConfig":{"ContainerEnvironmentVariables":{"JUPYTER_ENABLE_LAB":"yes"}},"FileSystemConfig":{"DefaultGid":0,"DefaultUid":0,"MountPath":"/home/sagemaker-user"}}}

  │ Error: updating SageMaker App Image Config: operation error SageMaker: UpdateAppImageConfig, https response error StatusCode: 400, RequestID: ace80b14-653d-47c0-8225-01aa5cd43ad7, api error ValidationException: Unsupported FileSystemConfig parameters. Only supported values of DefaultUId and DefaultGID are 1000 and 100 respectively
  │
  │   with module.baseline.aws_sagemaker_app_image_config.cpu,
  │   on ../../../../modules/aws/baseline/main.tf line 315, in resource "aws_sagemaker_app_image_config" "cpu":
  │  315: resource "aws_sagemaker_app_image_config" "cpu" {
  │

Panic Output

No response

Important Factoids

The AWS Provider schema explicitly allows certain UID/GID combinations for SageMaker App Image Config's file_system_config, but the AWS API rejects these valid combinations.

In app_image_config.go, the schema validation allows:

"default_gid": {
    Type:         schema.TypeInt,
    Optional:     true,
    Default:      100,
    ValidateFunc: validation.IntInSlice([]int{0, 100}),
},
"default_uid": {
    Type:         schema.TypeInt,
    Optional:     true,
    Default:      1000,
    ValidateFunc: validation.IntInSlice([]int{0, 1000}),
},

However, when attempting to use the [0,0] pair which should be valid according to the schema, the API rejects it:

Error: updating SageMaker App Image Config: operation error SageMaker: UpdateAppImageConfig, https response error StatusCode: 400, RequestID: ace80b14-653d-47c0-8225-01aa5cd43ad7, api error ValidationException: Unsupported FileSystemConfig parameters. Only supported values of DefaultUId and DefaultGID are 1000 and 100 respectively

Additionally, AWS documentation suggests that other UID combinations (like 1001) should be valid for migration scenarios: https://docs.aws.amazon.com/sagemaker/latest/dg/studio-updated-migrate-lcc.html

References

https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/sagemaker_app_image_config#default_gid-1 https://docs.aws.amazon.com/sagemaker/latest/dg/studio-updated-migrate-lcc.html

Would you like to implement a fix?

None