SQS operations from the Terraform/Pulumi AWS provider take exactly ~25s each on 2026.x images (CLI is sub-second); with skip_requesting_account_id, SNS GetTopicAttributes 500s into multi-hour retry hangs

[ztawfique]

Current behavior

Two related problems on 2026.x images (reproduced on 2026.7.1 and a recent dev build, both started with an auth token), using the Pulumi AWS provider (embeds terraform-provider-aws; reproduced on 7.32.0 and 7.40.0):

1. Every SQS operation from the provider takes almost exactly 25 seconds. aws.sqs.Queue creates and aws.sqs.QueuePolicy attachments each take ~25s. The AWS CLI against the same running instance completes the equivalent calls sub-second, and the same program against legacy localstack/localstack:3 (3.8.1) is also sub-second. This happens with a correctly resolved account ID (no skip_requesting_account_id).

2. With aws:skipRequestingAccountId: "true" in the stack config, SNS topic creation never completes. The provider's post-create GetTopicAttributes call fails with:

InternalError: exception while calling sns.GetTopicAttributes: '' is not a valid AWS account ID

The provider retries this 25 times with growing backoff, retained container logs from one affected environment show single topics failing after 3103s and 3192s (~52 minutes) of retries, which presents as an indefinite hang. Removing skip_requesting_account_id fixes the topics (0.14s). I'm aware the docs stopped recommending that flag (localstack-docs#359); reporting it because a 500 + provider retry storm turns a config issue into a multi-hour silent hang, a clear 4xx error would fail fast instead.

Expected behavior

Provider-originated SQS operations complete in roughly the same time as the equivalent CLI calls, an empty account ID produces a fast, clear client error rather than a retried 500.

Steps to reproduce

Minimal Pulumi program (Python):

import pulumi_aws as aws

key = aws.kms.Key("key", enable_key_rotation=True)
topic = aws.sns.Topic("topic", name="repro-topic", kms_master_key_id=key.arn)
queue = aws.sqs.Queue("queue", name="repro-queue")

Stack config (issue 1, note no skip_requesting_account_id):

config:
  aws:region: eu-west-1
  aws:accessKey: test
  aws:secretKey: test
  aws:skipCredentialsValidation: "true"

1. docker run -d -p 4566:4566 -e LOCALSTACK_AUTH_TOKEN=... -e SERVICES=sns,sqs,kms,iam,sts localstack/localstack:2026.7.1
2. pulumi up with AWS_ENDPOINT_URL=http://localhost:4566 (file backend).
3. Observe the queue takes ~25s (topic and key are fast). aws --endpoint-url http://localhost:4566 sqs create-queue --queue-name cli-q returns immediately.
4. For issue 2: add aws:skipRequestingAccountId: "true" to the config and re-run, the topic now hangs in the GetTopicAttributes retry loop with the 500 above.

Environment

• LocalStack 2026.7.1:3eefc2927 (auth token configured), also a 2026.5 dev build, also reproduced on localstack-pro:latest from a second, unrelated project (provider 7.32.0)
• Not affected: localstack/localstack:3 (3.8.1)
• Pulumi CLI v3.251.0, pulumi-aws 7.40.0 / 7.32.0, running in the pulumi/pulumi:latest container
• macOS, Docker Desktop, aarch64
• SERVICES=sns,sqs,kms,iam,sts

Notes

The uniform ~25s on SQS regardless of operation suggests an internal retry/timeout on some auxiliary step for provider-shaped requests. Happy to re-run with DEBUG=1 / LS_LOG=trace and attach logs.

[viren-nadkarni]

Hi @ztawfique, thank you for the report.

I was able to reproduce issue 1 against AWS too, so it's not a LocalStack bug. I think this wait present by design in Terraform to accommodate SQS's eventual consistency.

For issue 2, I made a small fix to LocalStack to make it return HTTP 4xx when invalid account IDs or unsupported regions are part of the request. This will prevent IaS frameworks from going into indefinite retries.

Let us know if you have any other issues.