cloudposse / cloudposse/atmos

plan-diff fails on RDS instances due to latest_restorable_time drift between plan and apply

Open
#2,088 3 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
Go
Stars
1.4k
Forks
175
Avg merge
2d 25m
Merged PRs (30d)
143

Description

We need an allow list so that you can just specify things that you expect to vary at the Atmos level.

We have a list there already with something like content base 64 and all of that. So you want to make it configurable.

Because there's an unlimited number of these exceptions that could happen. Also, it could depend on the situational context or the organizational context. Like they tolerate these things to vary.

SmithRx will just disable plan-diff for now. We should confirm two things:

A) do they want us to fix it?

B) would next week we be fine?

C) an estimate like a few hours

### Describe the Bug

The `plan-diff` command produces false-positive failures on PRs that include RDS resources. The `latest_restorable_time` attribute on `aws_db_instance` is a computed value that updates server-side every \~5 minutes. Because the value changes between when `terraform plan` runs and when `plan-diff` runs, a spurious diff is detected even though no actual infrastructure changes were made. This cannot be worked around with `ignore_changes` in the lifecycle block because `latest_restorable_time` is a read-only computed attribute ([hashicorp/terraform#29543]()). Bare RDS instances (`aws_db_instance`) are affected; Aurora PostgreSQL instances are not, despite also exposing `latest_restorable_time`.

### Expected Behavior

`plan-diff` should not flag volatile computed attributes like `latest_restorable_time` as meaningful differences. PRs touching RDS resources should not fail due to time-based drift in read-only attributes.

### Steps to Reproduce

1. Run `atmos terraform plan portal/rds -s plat-usw2-qa -out=/tmp/rdsplan.tfplan`
2. Wait approximately 6–7 minutes
3. Run `atmos terraform plan-diff portal/rds -s plat-usw2-qa --orig=/tmp/rdsplan.tfplan`
4. Observe the diff on `latest_restorable_time` even though nothing was changed

### Screenshots

```
Diff Output
===========

Resources:
-----------

module.rds_instance.aws_db_instance.default[0]
~ latest_restorable_time: 2026-02-17T22:02:50Z => 2026-02-17T22:07:50Z
```

### Environment

*No response*

### Additional Context

*No response*

Contributor guide

Open the contributing guide

Research direction

Start with the `plan-diff` command and reproduce the RDS case using the provided Terraform plan and wait interval. Trace how computed attribute differences are classified, then verify that `latest_restorable_time` no longer causes a false-positive failure while meaningful infrastructure differences still appear.

Written by the indexing model from the issue text.

Assessment

Tech stack
go, terraform
Domain
cli, devops, infrastructure
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.