Remove JSON object via AWS Update* API to prevent Terraform from recreating the resource-CodePudding

I have an AWS SageMaker domain in my account created via Terraform. The resource was modified outside of Terraform. The modification was the equivalent of the following:

aws sagemaker update-domain --domain-id d-domainid123 --default-user-settings '{"KernelGatewayAppSettings": { "CustomImages": [ { ... } ] } }'

Ever since, all terraform plan operations want to replace the AWS SageMaker domain:

  # module.main.aws_sagemaker_domain.default must be replaced
-/  resource "aws_sagemaker_domain" "default" {
      ~ arn                                            = "arn:aws:sagemaker:eu-central-1:000111222333:domain/d-domainid123" -> (known after apply)
      ...
        # (6 unchanged attributes hidden)
      ~ default_user_settings {
            # (2 unchanged attributes hidden)
          - kernel_gateway_app_settings { # forces replacement
               - custom_images = [ ... ]
            }
        }
    }

My goal is to reconcile the situation without Terraform or me needing to create a new domain. I can't modify the Terraform sources to match the state of the SageMaker domain because that would force the recreation of domains in other accounts provisioned from the same Terraform source code.

I want to issue an aws CLI command that updates the domain and removes the "KernelGatewayAppSettings": { ... } key completely from the "DefaultUserSettings" of the SageMaker domain. Is there a way to do this?

I tried the following, but the empty object is still there, so they did not work.

aws sagemaker update-domain --domain-id d-domainid123 --default-user-settings '{"KernelGatewayAppSettings": {} }'
aws sagemaker update-domain --domain-id d-domainid123 --default-user-settings '{"KernelGatewayAppSettings": null }'

# Still:
aws sagemaker describe-domain --domain-id d-domainid123
{
    "DomainArn": ...,
    "DomainId": ...,
    ...
    "DefaultUserSettings": {
        "ExecutionRole": "arn:aws:iam::0001112233444:role/SageMakerStudioExecutionRole",
        "SecurityGroups": [
            "..."
        ],
        "KernelGatewayAppSettings": {
            "CustomImages": []
        }
    },
    ...
}

CodePudding user response：

One option you have is to use the lifecycle meta argument to ignore out-of-band changes to the resource.

  lifecycle {
    ignore_changes = [
      default_user_settings
    ]
  }