okta_push_group fails with HTTP 400 when linking AWS IAM Identity Center groups by name

[scocchi-hs]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request.
• Please do not leave +1 or me too comments, they generate extra noise for issue followers and do not help prioritize the request.
• If you are interested in working on this issue or have submitted a pull request, please leave a comment.
  Before submitting a bug report, we ask that you first search existing issues and pull requests to see if someone else may have experienced the same issue or may have already submitted a fix for it. This helps to keep all relevant information in one place, including any potential workarounds.

A Note on Terraform Core Issues

We also ask that you consider whether your issue may be related to Terraform Core. If you are running into one of the following scenarios, we recommend opening an issue in the Terraform Core repository instead:

• Configuration Language or resource ordering issues
• State and State Backend issues
• Provisioner issues
• Registry issues
• Issues that span resources across multiple providers

Terraform Version & Okta Provider Version(s)

Terraform v1.8.5
on macos/arm64

• provider registry.terraform.io/providers/okta/okta/ v6.12.0
• provider registry.terraform.io/providers/okta/okta/ v6.13.0

Affected Resource(s)

okta_push_group

Can this be done in the Admin UI?

Yes

Can this be done in the actual API call?

No

Customer Information

Organization Name: harmonicsecurity
Paid Customer: yes

Terraform Configuration

resource "okta_group" "test_okta_scim" { 
    name = "test-okta-scim" 
} 

resource "okta_push_group" "test_okta_scim" { 
    app_id            = okta_app_saml.aws_iam_identity_center.id 
    source_group_id   = okta_group.test_okta_scim.id 
    target_group_name = "test-okta" 
    status            = "ACTIVE" 

    delete_target_group_on_destroy = false
}

Debug Output

https://gist.github.com/scocchi-hs/c485f1c40101c6664103e58cbe678980

Expected Behavior

One of the following should work reliably:

• target_group_name should link the source Okta group to the existing AWS IAM Identity Center application group, as documented.
• An APP_GROUP referenced through target_group_id should remain discoverable after the push group mapping is created.
• The provider should support an idempotent way to manage an existing push group mapping without requiring a transient APP_GROUP data source.

Actual Behavior

• Linking by target_group_name fails with HTTP 400.

Steps to reproduce

1. Configure the AWS IAM Identity Center application in Okta.
2. Enable SCIM provisioning.
3. Ensure the target group already exists in AWS IAM Identity Center.
4. In the Okta Admin Console, open: Applications → AWS IAM Identity Center → Push Groups
5. Click Refresh App Groups.
6. Wait for the refresh to complete successfully.
7. Confirm that the existing AWS IAM Identity Center group, for example test-okta, is available in Okta as an APP_GROUP.
8. Create the terraform configuration above and run terraform apply

Workaround

The mapping can be created successfully by resolving the existing application group by ID and passing it as target_group_id.

resource "okta_group" "test_okta_scim" {
  name = "test-okta-scim"
}

data "okta_group" "test_okta" {
  name = "test-okta"
  type = "APP_GROUP"
}

resource "okta_push_group" "test_okta_scim" {
  app_id                         = okta_app_saml.aws_iam_identity_center.id
  source_group_id                = okta_group.test_okta_scim.id
  target_group_id                = data.okta_group.test_okta.id
  status                         = "ACTIVE"
  delete_target_group_on_destroy = false
}

The workaround succeeds only on the first terraform apply.

On subsequent runs, Terraform can no longer resolve the APP_GROUP:

│ Error: group with name "test-okta" and type "APP_GROUP" does not exist
│
│   with data.okta_group.test_okta,
│   on aws_groups.tf line 74, in data "okta_group" "test_okta":
│   74: data "okta_group" "test_okta" {
│

After the push group mapping is created, the application group reference is no longer available through the Okta API. The group also disappears from the Okta UI.

The resulting push group mapping remains active, but the Terraform configuration is no longer refreshable or idempotent because the data source fails before Terraform can evaluate the existing resource.

Important Factoids

• The AWS IAM Identity Center application is configured to use Okta SCIM provisioning.
• To match the documented behavior for target_group_name, the "Rename app groups to match group name in Okta" option is disabled.
• Before reproducing the issue, existing AWS IAM Identity Center groups are imported into Okta using Push Groups → Refresh App Groups, making them available as APP_GROUPs.

References

No response