# Changing AWS resouce name

**URL:** <https://discuss.hashicorp.com/t/changing-aws-resouce-name/75196>\
**Category:** AWS\
**Created:** [May 27, 2025, 12:05pm UTC](https://discuss.hashicorp.com/t/changing-aws-resouce-name/75196 "2025-05-27T12:05:37Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![bnjay](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/bnjay/32/45770_2.png) [@bnjay](https://discuss.hashicorp.com/u/bnjay)\
**Post date:** [May 27, 2025, 12:05pm UTC](https://discuss.hashicorp.com/t/changing-aws-resouce-name/75196/1 "2025-05-27T12:05:37Z")

</div>

I’d like to change the data protection of a log group in AWS. Initially I used the following code pattern, but found that there was a racing issue.

The first resource - name\_a already exists. name\_b is a new one. The resource - name\_a is used for another log group, but I’d like to change one log group only this time, which controlled by counting the variable.

```auto
resource "aws_cloudwatch_log_data_protection_policy" "name_a" {
  count = var.protect_a ? 1:0
  log_group_name = var.log_group_name
  policy_document = file("/a/path/to/json.file")
}

resource "aws_cloudwatch_log_data_protection_policy" "name_b" {
  count = var.protect_b ? 1:0
  log_group_name = var.log_group_name
  policy_document = file("/a/path/to/new_json.file")
}

```

Terraform Plan shows destruction of name\_a and creation of name\_b. When applying the changes occasionally destruction (name\_a) completes after creation (name\_b), which ends up wiping out the data protection policy. It looks like there is a racing issue.

I tried another method by adding depends\_on name\_a hoping that creation will wait for completion of destruction, but often I get an error - self reference name\_a (destroy).

```auto
resource "aws_cloudwatch_log_data_protection_policy" "name_a" {
  count = var.protect_a ? 1:0
  log_group_name = var.log_group_name
  policy_document = file("/a/path/to/json.file")
}

resource "aws_cloudwatch_log_data_protection_policy" "name_b" {
  count = var.protect_b ? 1:0
  log_group_name = var.log_group_name
  policy_document = file("/a/path/to/new_json.file")
  depends_on = [
    aws_cloudwatch_log_data_protection_policy.name_a
  ]
}

```

I also tried adding null\_resource with depends\_on name\_a and another depends\_on null\_resource in the name\_b resource block. At one time it seemed to be working fine, but then started throwing up the same self reference error. Because I tried so many little variations and cannot show the exact code pattern here, but in principle I added another block of null\_resource as I described.

```auto
resource "aws_cloudwatch_log_data_protection_policy" "name_a" {
  count = var.protect_a ? 1:0
  log_group_name = var.log_group_name
  policy_document = file("/a/path/to/json.file")
}

resource "aws_cloudwatch_log_data_protection_policy" "name_b" {
  count = var.protect_b ? 1:0
  log_group_name = var.log_group_name
  policy_document = file("/a/path/to/new_json.file")
  depends_on = [
    null_resource.wait_for_deletion
  ]
}

resouce "null_resouce" "wait_for_deletion" {
  count = strcontains(var.log_group_name, "a_name") ? 1:0
  triggers = {
    removed = var.protect_a && !var.protect_b ? "present" : "removed"
  }
  depends_on = [
    aws_cloudwatch_log_data_protection_policy.name_a
  ]
}

```

A more better reliable approach would be a two-step one - terraform apply to delete the existing one then another apply to add a new one. Or, manually change the state, ie, move the existing one to name\_b then apply the new json file.

But, is there a reliable way to achieve this in one run?

Appreciate your inputs and help

---

<div class="post-metadata">

**Author:** ![acwwat](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/acwwat/32/41481_2.png) [@acwwat](https://discuss.hashicorp.com/u/acwwat)\
**Post date:** [June 12, 2025, 4:20am UTC](https://discuss.hashicorp.com/t/changing-aws-resouce-name/75196/2 "2025-06-12T04:20:40Z")

</div>

Is there a reason why you need to keep two separate `aws_cloudwatch_log_data_protection_policy` resources?

Here’s one design that works. You just need to pass in the policy name `policy_a` or `policy_b`, or `null` if not applying one, as the `policy_name` variable value.

`main.tf`:

```terraform
variable "policy_name" {
  type = string
  nullable = true
}

resource "aws_cloudwatch_log_group" "example" {
  name = "/example/log-group"
}

resource "aws_cloudwatch_log_data_protection_policy" "example" {
  count = var.policy_name != null ? 1 : 0
  log_group_name = aws_cloudwatch_log_group.example.name
  policy_document = file("${path.module}/${var.policy_name}.json")
}

```

`policy_a.json`:

```json
{
    "Name": "PolicyA",
    "Version": "2021-06-01",
    "Statement": [
        {
            "Sid": "Audit",
            "DataIdentifier": [
                "arn:aws:dataprotection::aws:data-identifier/EmailAddress"
            ],
            "Operation": {
                "Audit": {
                    "NoFindingsDestination": {}
                }
            }
        },
        {
            "Sid": "Redact",
            "DataIdentifier": [
                "arn:aws:dataprotection::aws:data-identifier/EmailAddress"
            ],
            "Operation": {
                "Deidentify": {
                    "MaskConfig": {}
                }
            }
        }
    ]
}

```

`policy_b.json`:

```json
{
    "Name": "PolicyB",
    "Version": "2021-06-01",
    "Statement": [
        {
            "Sid": "Audit",
            "DataIdentifier": [
                "arn:aws:dataprotection::aws:data-identifier/CreditCardNumber"
            ],
            "Operation": {
                "Audit": {
                    "NoFindingsDestination": {}
                }
            }
        },
        {
            "Sid": "Redact",
            "DataIdentifier": [
                "arn:aws:dataprotection::aws:data-identifier/CreditCardNumber"
            ],
            "Operation": {
                "Deidentify": {
                    "MaskConfig": {}
                }
            }
        }
    ]
}

```