Adding a GSI with a new key attribute to an existing DynamoDB table fails on provider-aws-dynamodb 2.x before v2.6.2 ("unused attributes")

Last updated: July 29, 2026

Issue

  • On provider-aws-dynamodb 2.x (before v2.6.2), adding a Global Secondary Index (GSI) that introduces a new key attribute to an existing DynamoDB Table fails during the provider's Observe/diff phase, before any AWS call

  • Error:

observe failed: cannot compute the instance diff:
failed to get *terraform.InstanceDiff:
all attributes must be indexed. Unused attributes: ["<new-attr>"]

  • The new attribute(s) are flagged "unused" even though each is a key of the GSI being added

  • Creating a Table with the GSI present from the start works; only in-place addition to an existing Table fails

  • Not fixable from the composition/claim side (attribute de-duplication and ordering make no difference)

  • The same operation succeeds on the 1.23.x line (e.g. v1.23.10)

Environment

  • Crossplane / UXP with official providers

  • provider-aws-dynamodb / upbound-provider-family-aws: 2.x releases prior to v2.6.2

  • DynamoDB Table (dynamodb.aws.upbound.io), adding a GSI whose key uses a newly introduced attribute

Resolution

  • Upgrade provider-aws-dynamodb (and the AWS provider family) to v2.6.2 or later

  • After upgrading, in-place GSI additions that introduce a new key attribute reconcile cleanly

  • Validated: confirmed to resolve the failure on affected tables

  • Release notes: https://marketplace.upbound.io/providers/upbound/provider-aws-dynamodb/v2.6.2?tab=releaseNotes

  • Note: v2.6.2 fixes this specific regression. It is not a claim that the full 2.x line matches 1.23.x behavior in every respect. If you observe other behavioral differences versus 1.23.x, report them separately.

Cause

  • A diff/validation regression introduced in the v1.x to v2.x provider transition (upjet v1 to v2 and terraform-provider-aws v5 to v6, where aws_dynamodb_table was refactored)

  • On an in-place UPDATE, the diff sees the new attribute but has not yet correlated the new GSI that uses it, so the attribute is flagged "unused" and validation fails at plan/Observe

  • On CREATE, the full desired state is validated at once, so creating a Table with the GSI already present works

  • Fixed in v2.6.2 by correctly correlating new key attributes with the GSI being added