r/aws_ssm_parameter: v6.58.0 regression when name starts with /

[ewbankkit]

Rollback Plan

If a change needs to be reverted, we will publish an updated version of the library.

Changes to Security Controls

Are there any changes to security controls (access controls, encryption, logging) in this pull request? If so, explain.

Description

There is a regression for the aws_ssm_parameter resource between v6.57.1 and v6.58.0 if name starts with / (as is common: https://docs.aws.amazon.com/systems-manager/latest/userguide/sysman-paramstore-hierarchies.html).

• For resources created with a version prior to v6.58.0 the first terraform plan after upgrade reports Unexpected Identity Change errors
• For resources created with v6.58.0 the first terraform plan after create reports that the resource needs replacement as the name attribute values has changed

If I create via the AWS Console and call the AWS API directly:

% aws ssm get-parameter --name "/Environment/TypeOfComputer/Application/Data"
{
    "Parameter": {
        "Name": "/Environment/TypeOfComputer/Application/Data",
        "Type": "String",
        "Value": "Some stuff",
        "Version": 1,
        "LastModifiedDate": "2026-08-06T10:39:23.215000-04:00",
        "ARN": "arn:aws:ssm:us-west-2:123456789012:parameter/Environment/TypeOfComputer/Application/Data",
        "DataType": "text"
    }
}
% aws ssm describe-parameters
{
    "Parameters": [
        {
            "Name": "/Environment/TypeOfComputer/Application/Data",
            "ARN": "arn:aws:ssm:us-west-2:123456789012:parameter/Environment/TypeOfComputer/Application/Data",
            "Type": "String",
            "LastModifiedDate": "2026-08-06T10:39:23.215000-04:00",
            "LastModifiedUser": "arn:aws:sts::123456789012:assumed-role/terraform_team1_dev-developer/kewbank@hashicorp.com",
            "Version": 1,
            "Tier": "Standard",
            "Policies": [],
            "DataType": "text"
        }
    ]
}

New acceptance tests

• TestAccSSMParameter_NameStartsWithForwardSlash_v6571 runs with v6.57.1 only and verifies that name retains the leading / in state, but arn format does not (which matches the AWS API)
• TestAccSSMParameter_NameStartsWithForwardSlash_v6580 runs with v6.58.0 only and shows that both name and arn format have the leading / removed in state. It also shows the ForceNew behavior

Relations

Relates #49304.

Output from Acceptance Testing

% make testacc TESTS=TestAccXXX PKG=ec2

...

[github-actions]

Community Guidelines

This comment is added to every new Pull Request to provide quick reference to how the Terraform AWS Provider is maintained. Please review the information below, and thank you for contributing to the community that keeps the provider thriving! 🚀

Voting for Prioritization

• Please vote on this Pull Request by adding a 👍 reaction to the original post to help the community and maintainers prioritize it.
• Please see our prioritization guide for additional information on how the maintainers handle prioritization.
• Please do not leave +1 or other comments that do not add relevant new information or questions; they generate extra noise for others following the Pull Request and do not help prioritize the request.

Pull Request Authors

• Review the contribution guide relating to the type of change you are making to ensure all of the necessary steps have been taken.
• Whether or not the branch has been rebased will not impact prioritization, but doing so is always a welcome surprise.