aws_ec2_client_vpn_endpoint timeout is too low

[juanbecerra]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform Version

Terraform v0.11.11

• provider.aws v2.1.0
• provider.local v1.1.0

Affected Resource(s)

• aws_ec2_client_vpn_endpoint

Terraform Configuration Files

# Copy-paste your Terraform configurations here - for large Terraform configs,
# please use a service like Dropbox and share a link to the ZIP file. For
# security, you can also encrypt the files using our GPG public key: https://keybase.io/hashicorp

resource "aws_ec2_client_vpn_endpoint" "ts_vpn" {
description = "ACME Client VPN"
server_certificate_arn = "${aws_acm_certificate.vpn_server_cert.arn}"
client_cidr_block = "11.50.0.0/22"
authentication_options {
type = "directory-service-authentication"
active_directory_id = "${var.ldap_id}"
}
connection_log_options {
enabled = false
}
}

Debug Output

Panic Output

Expected Behavior

Resource Created

Actual Behavior

aws_ec2_client_vpn_endpoint.ts_vpn: Error creating Client VPN endpoint: timeout while waiting for state to become 'success' (timeout: 1m0s)

Steps required to reproduce the issue

1. terraform apply

Important Factoids

References

• #0000

[juanbecerra]

Need to either increase the timeout in the code or implement the resource to use the timeouts block as per https://www.terraform.io/docs/configuration/resources.html#timeouts

[bflad]

Hi @juanbecerra 👋 Sorry for the trouble here. We currently have a 1 minute retry timeout around this error:

OperationNotPermitted: Endpoint cannot be created while another endpoint is being created

However since the Terraform error didn't include the above error in its output, it seems like this may be some other issue in your environment such as EC2 throttling. If you enable debug logging, e.g. TF_LOG=debug terraform plan, you should be able to see what the AWS Go SDK is automatically retrying on.

Generally speaking, increasing the timeout or offering a customizable timeout will only rarely help operators other than having the same error being retried by the AWS Go SDK for a longer amount of time, usually ending in a more frustrating user experience since the error is not being returned to the Terraform resource code. A definite bug here is that we need to add an extra conditional to properly retry the request outside the resource.Retry() block timeboxing to allow the AWS Go SDK errors to propagate so they correctly are returned to the operator instead of just the "empty" timeout error. That said, we may be ambivalent in customizing this particular timeout though since it is more suited towards allowing operators to work in high utilization environments instead of dealing with eventual consistency issues.

[bflad]

We may also want to consider having the Terraform AWS Provider EC2 session use the AWS Go SDK retry mechanism for the above error instead of utilizing any sort of timeout, e.g.

https://github.com/terraform-providers/terraform-provider-aws/blob/9f14ef76bb0eee9d536d5b14e0844ea9f611a14f/aws/config.go#L524-L529

This simplifies the code in this case and allows operators to choose their threshold of retry tolerance via the provider max_retries configuration.

[bflad]

Fix submitted: #9558

[bflad]

The timeout removal has been merged and will release with version 2.22.0 of the Terraform AWS Provider, tomorrow. 👍

[ghost]

This has been released in version 2.22.0 of the Terraform AWS provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template for triage. Thanks!

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thanks!