User.Run calls userExists(name), then update() calls missingGroups() which calls user.Lookup(name) again. If the user is removed externally between the two lookups, the second fails and the resource errors.
The window is tiny and the failure is clean (any config management tool fails if the system mutates underneath it mid-run), so this is low priority. But the second lookup is avoidable: userExists could return the looked-up *user.User and update/missingGroups could reuse it.
Found during the code review of the AMI builder resources branch.
User.RuncallsuserExists(name), thenupdate()callsmissingGroups()which callsuser.Lookup(name)again. If the user is removed externally between the two lookups, the second fails and the resource errors.The window is tiny and the failure is clean (any config management tool fails if the system mutates underneath it mid-run), so this is low priority. But the second lookup is avoidable:
userExistscould return the looked-up*user.Userandupdate/missingGroupscould reuse it.Found during the code review of the AMI builder resources branch.