[Bug]: Plugin crashes with invalid memory address or nil pointer dereference when trying to set delegated admin for FMS

[bebold-jhr]

Terraform Core Version

1.9

AWS Provider Version

5.66.0

Affected Resource(s)

• aws_fms_admin_account

Expected Behavior

Either sets the delegated admin correctly or at least shows a meaningful error.

Actual Behavior

Crashes with panic.

Relevant Error/Panic Output Snippet

Stack trace from the terraform-provider-aws_v5.66.0_x5 plugin:
panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x1 addr=0x0 pc=0x11944372]
goroutine 159 [running]:
github.com/hashicorp/terraform-provider-aws/internal/service/fms.resourceAdminAccountCreate({0x18162a88, 0xc0027fb620}, 0xc000d5e480, {0x1604cfa0, 0xc004d0a820})
	github.com/hashicorp/terraform-provider-aws/internal/service/fms/admin_account.go:63 +0xf2
github.com/hashicorp/terraform-provider-aws/internal/provider.New.(*wrappedResource).Create.interceptedHandler[...].func8(0xc000d5e480?, {0x1604cfa0?, 0xc004d0a820})
	github.com/hashicorp/terraform-provider-aws/internal/provider/intercept.go:113 +0x283
github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema.(*Resource).create(0x18162a88?, {0x18162a88?, 0xc0027fabd0?}, 0xd?, {0x1604cfa0?, 0xc004d0a820?})
	github.com/hashicorp/terraform-plugin-sdk/v2@v2.34.0/helper/schema/resource.go:801 +0x7a
github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema.(*Resource).Apply(0xc001dc0c40, {0x18162a88, 0xc0027fabd0}, 0xc001d46d00, 0xc000d5e300, {0x1604cfa0, 0xc004d0a820})
	github.com/hashicorp/terraform-plugin-sdk/v2@v2.34.0/helper/schema/resource.go:937 +0xa69
github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema.(*GRPCProviderServer).ApplyResourceChange(0xc004cec300, {0x18162a88?, 0xc0027fab10?}, 0xc0027f8230)
	github.com/hashicorp/terraform-plugin-sdk/v2@v2.34.0/helper/schema/grpc_provider.go:1153 +0xd5c
github.com/hashicorp/terraform-plugin-mux/tf5muxserver.(*muxServer).ApplyResourceChange(0xc000039340, {0x18162a88?, 0xc0027fa840?}, 0xc0027f8230)
	github.com/hashicorp/terraform-plugin-mux@v0.16.0/tf5muxserver/mux_server_ApplyResourceChange.go:36 +0x193
github.com/hashicorp/terraform-plugin-go/tfprotov5/tf5server.(*server).ApplyResourceChange(0xc00223d360, {0x18162a88?, 0xc0027d7e00?}, 0xc0014fdb20)
	github.com/hashicorp/terraform-plugin-go@v0.23.0/tfprotov5/tf5server/server.go:865 +0x3bc
github.com/hashicorp/terraform-plugin-go/tfprotov5/internal/tfplugin5._Provider_ApplyResourceChange_Handler({0x15e684e0, 0xc00223d360}, {0x18162a88, 0xc0027d7e00}, 0xc001555800, 0x0)
	github.com/hashicorp/terraform-plugin-go@v0.23.0/tfprotov5/internal/tfplugin5/tfplugin5_grpc.pb.go:518 +0x1a6
google.golang.org/grpc.(*Server).processUnaryRPC(0xc0003e0c00, {0x18162a88, 0xc0027d7d70}, {0x181d4840, 0xc004e50000}, 0xc0027f5320, 0xc004db4c30, 0x21c37318, 0x0)
	google.golang.org/grpc@v1.66.0/server.go:1393 +0xe11
google.golang.org/grpc.(*Server).handleStream(0xc0003e0c00, {0x181d4840, 0xc004e50000}, 0xc0027f5320)
	google.golang.org/grpc@v1.66.0/server.go:1804 +0xe8b
google.golang.org/grpc.(*Server).serveStreams.func2.1()
	google.golang.org/grpc@v1.66.0/server.go:1029 +0x7f
created by google.golang.org/grpc.(*Server).serveStreams.func2 in goroutine 39
	google.golang.org/grpc@v1.66.0/server.go:1040 +0x125
Error: The terraform-provider-aws_v5.66.0_x5 plugin crashed!
This is always indicative of a bug within the plugin. It would be immensely
helpful if you could report the crash with the plugin's maintainers so that it
can be fixed. The output above should help diagnose the issue.

Terraform Configuration Files

resource "aws_organizations_organization" "this" {
  aws_service_access_principals = [
    #...
    "fms.amazonaws.com",
  ]
  feature_set = "ALL"
  #...
}

resource "aws_fms_admin_account" "this" {
  depends_on = [
    aws_organizations_organization.this
  ]
  account_id = "####"
}

Steps to Reproduce

• terraform apply

Debug Output

No response

Panic Output

No response

Important Factoids

No response

References

No response

Would you like to implement a fix?

No

[github-actions]

Community Note

Voting for Prioritization

• Please vote on this issue by adding a 👍 reaction to the original post to help the community and maintainers prioritize this request.
• Please see our prioritization guide for information on how we prioritize.
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request.

Volunteering to Work on This Issue

• If you are interested in working on this issue, please leave a comment.
• If this would be your first contribution, please review the contribution guide.

[jar-b]

terraform-provider-aws/internal/service/fms/admin_account.go

Lines 59 to 64 in 38140be

	// Ensure there is not an existing FMS Admin Account.
	output, err := findAdminAccount(ctx, conn)
	if !tfresource.NotFound(err) {
	return sdkdiag.AppendErrorf(diags, "FMS Admin Account (%s) already associated: import this Terraform resource to manage", aws.ToString(output.AdminAccount))
	}