Error: expected type to be one of [ipsec.1], got ipsec.1-aes256 - regression with aws_vpn_connection resource in provider, version 3.38.0

[ketzacoatl]

AFAICT, there seems to be a regression with the aws_vpn_connection resource in this provider.

Specifically, I think it's probably in 3.38.0 (3.37.0 is the last version that works in our testing).

I don't have an easy way to provide a full reproduction, however, the code in our module looks like:

resource "aws_vpn_connection" "main" {
  count               = var.create_connection == "true" ? 1 : 0
  vpn_gateway_id      = aws_vpn_gateway.main.id
  customer_gateway_id = var.customer_gateway_id
  type                = var.connection_type
  static_routes_only  = var.static_routes_only
  tags = merge(
    {
      "Name" = var.name
    },
    var.extra_tags,
  )

  // This lifecycle is needed when using fips 140-2 vpn enpoints, as an un-documented
  // `type` of `ipsec.1-aes256` must be provided. AWS does not report this type
  // back correctly, which causes TerraForm to erroneously detect a change.
  lifecycle {
    ignore_changes = [type]
  }
}

As noted in the code above, there is an undocumented type of ipsec.1-aes256 that may be returned from the AWS API.

The error thrown from the provider is:

Error: expected type to be one of [ipsec.1], got ipsec.1-aes256

This error exists for all versions of the provider from 3.38.0 up to and including the latest as of this writing (3.74.1).

If I use an older provider, I don't see the error and the modules work as expected. Switching to a version of the provider after 3.37.0 errors out as noted above. Using the latest provider also errors out.

In an effort to locate the problematic change, I've looked through the code, commits, MRs, and issues, but I haven't been successful.

This happens with all versions of Terraform we've tested with, including versions prior to 1.0, as well as 1.0.x and even the latest as of this writing (1.1.5).

[ketzacoatl]

Thanks for the triage @ewbankkit.

I'd be happy to inspect the git history a little closer, but would need assistance locating where the ipsec check for this resource is. Though it seems this is relevant:

terraform-provider-aws/internal/service/ec2/enum.go

Lines 163 to 171 in 8c3df0a

	const (
	VpnConnectionTypeIpsec1 = "ipsec.1"
	)
	func VpnConnectionType_Values() []string {
	return []string{
	VpnConnectionTypeIpsec1,
	}
	}

That leads me to

terraform-provider-aws/internal/service/ec2/vpn_connection.go

Lines 486 to 491 in 9c0b16c

	"type": {
	Type: schema.TypeString,
	Required: true,
	ForceNew: true,
	ValidateFunc: validation.StringInSlice(VpnConnectionType_Values(), false),
	},

[ketzacoatl]

I guess we need an entry for ipsec.1-aes256?

 	VpnConnectionTypeIpsec1Aes256 = "ipsec.1-aes256" 

and then including that VpnConnectionTypeIpsec1Aes256 in VpnConnectionType_Values()?

[ketzacoatl]

Awesome! I am not super familiar with golang, so I wasn't sure if there was some other update I was overlooking. I'm glad it was a simple fix! Thank you @ewbankkit!

[github-actions]

This functionality has been released in v4.1.0 of the Terraform AWS Provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template. Thank you!

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.