-
Notifications
You must be signed in to change notification settings - Fork 9.1k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Terraform sending incorrect parameters to AWS API when revoking security group rules #8769
Comments
This is still an issue as of provider version 2.16.0 |
It's still an issue with Terraform 0.12.20 and aws provider 2.50.0 |
The issue seems to be related to terraform 0.12. The same code successfully applies with terraform 0.11 but produces an error with terraform 0.12. Below is my minimal example:
When I change protocol (e.g. from In both cases I use AWS provider v2.32. |
I'm seeing a very strange behaviour with Terraform v0.12.24 + provider.aws v2.56.0. I ran $ terraform apply, didn't change anything, ran it again to verify that no changes would take place, but I was hit by the security group forcing replacement of my EC2 servers. It is the only security group present in my code, and it has only two ingress rules and one egress rule. What I couldn't understand is that inside the EC2 creation, Terraform can already recognise the existing security group ID, however it insists on replacing it.
It's worth mentioning that I have a root module, and three other modules root The security group variable is:
Here is security group code:
I am afraid this is very dangerous and invalidates many use cases involving EC2 and SG. |
I can confirm this is still an issue as of terraform v0.12.29 and provider.aws v3.0.0. We were using ingress rules instead of egress rules. Terraform was sending a delete command to AWS to delete a rule that didn't exist - a rule based on the new attributes rather than the old attributes like it should have been. I can recreate the problem by taking any existing security group rule and modifying the rule. Once it happens, I can run as many "terraform apply" as I want and the problem won't clear. It appears I can avoid the problem by changing the name of the security group rule when making the change - then terraform views the operation as a delete and a create, not a replace. The problem can also be avoided by first doing a delete, applying it, and then creating and applying. |
After further testing, it appears this doesn't impact all replacements as I previously though. It appears to only impact rules where the protocol is changed. Changes to the port, cidr, or description don't seem to impact it. When I change the protocol though (tried tcp -> all and tcp -> udp), I seem to be able to reproduce it 100% of the time. |
Marking this issue as stale due to inactivity. This helps our maintainers find and focus on the active issues. If this issue receives no comments in the next 30 days it will automatically be closed. Maintainers can also remove the stale label. If this issue was automatically closed and you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thank you! |
Bumping for visibility, any progress on this? |
This functionality has been released in v4.29.0 of the Terraform AWS Provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading. For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template. Thank you! |
I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues. |
This issue was originally opened by @bstrohmeyer as hashicorp/terraform#21437. It was migrated here as a result of the provider split. The original body of the issue is below.
Terraform Version
Terraform Configuration Files
subnets module:
Debug Output
Crash Output
Expected Behavior
Added new rule to security group:
Expected Terraform to add this rule to the existing security group.
Actual Behavior
This rule was added in the middle of the list, which then due to the design of the module would require terraform to delete the Egress rule as the list order was upset. This is expected and is reflected in the terraform plan:
There was an error on apply, however:
Upon investigation, it appears that terraform is sending the wrong parameters in the
RevokeSecurityGroupEgress
API call to AWS which results in the first error. From cloudtrail:"ipProtocol": "tcp",
is the new value of that security group rule as seen in the plan above, not the existing one. Terraform should be sending"ipProtocol": "-1",
in this request to revoke the existing rule. This then results in AWS being unable to match this egress rule to the existing one and it cannot delete it, further resulting in a duplicate security group rule error when it tries to recreate the egress rule.Steps to Reproduce
Add a security group rule to an existing security group that causes an egress rule to be deleted.
Additional Context
Terraform is running via docker via gitlab runner.
References
The text was updated successfully, but these errors were encountered: