Why are there Terraform provider timeout errors when deploying multiple S3 sources in Panther?
Last updated: April 29, 2025
Issue
When deploying multiple S3 log sources simultaneously using the Terraform provider, I encountered the following error:
Could not create S3 Source, unexpected error: GraphQL mutation failed:
Message:Post "https://<...>/graphql": context deadline exceeded
(Client.Timeout exceeded while awaiting headers), Locations: [],
Extensions: map[code:request_error]Upon retrying the deployment, the previously failed sources returned a different error:
Could not create S3 Source, unexpected error: GraphQL mutation failed:
Message: Log source for account <account_id> with label <label> already onboarded,
Locations: [], Extensions: map[reportable:false]Resolution
To resolve these errors and deploy your S3 sources successfully:
Deploy in smaller batches (e.g., 2–3 sources at a time) to reduce the risk of timeout, especially on cold starts or initial deployments.
Manually update Terraform’s state by importing the existing resources. For reference, here’s the Terraform import guide.
Cause
There’s a 30-second timeout limit in a backend service that handles source creation requests. If too many sources are deployed at once, it can take longer than 30 seconds for the request to complete, especially if services are “cold” and need to spin up.
Even though the sources are usually created successfully in the backend, Terraform gets a timeout error and assumes they weren’t. As a result, it keeps trying to create them again on every run—leading to the drift.