[Bug]: aws_backup_selection `selection_tag` and `resources` do not interact as expected

Terraform Core Version

1.7.5

AWS Provider Version

5.86.0

Affected Resource(s)

• aws_backup_selection

Expected Behavior

Expected Behavior: Backup plan targets S3 buckets with the enable_backup = true tag.^1

Actual Behavior

Actual Behavior: Backup plan targets all S3 buckets AND all AWS resources with theenable_backup = true tag.

Terraform Configuration Files

resource "aws_backup_selection" "backup_selection_usw2" {
  provider = aws.usw2

  name         = "my-backup-plan"
  plan_id      = aws_backup_plan.s3_bucket_backup.id
  iam_role_arn = data.aws_iam_role.backup_default_role.arn

  resources = [
    "arn:aws:s3:::*"
  ]

  selection_tag {
    key   = "enable_backup"
    value = "true"
    type  = "STRINGEQUALS"
  }
}

Steps to Reproduce

1. Apply the given configuration.
2. Observe the AWS resources added to the AWS Vault of choice.

Debug Output

No response

Panic Output

No response

Important Factoids

No response

References

No response

Would you like to implement a fix?

None