-
Notifications
You must be signed in to change notification settings - Fork 9.5k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
provider/aws: Cleanup the Lambda ENI deletion fails on destroy (after update Terraform to v0.7.11) #10272
Comments
Having this same problem, but with |
Just ran into this myself. Same issue with Lambda plus VPC config. I was able to solve it by importing the related ENI by hand:
After this |
Right now, I am seeing this issue with v0.8.5, and I believe it's because the requesterid in my case isn't what the code is searching for in builtin/providers/aws/resource_aws_security_group.go
But in the case of my ENI, I can see it's got a requester-id of
|
So if I understand that correctly, the RequesterId no longer has the string "awslambda_" in it, therefore, the ENI does not get picked up for deletion. I'm not sure what value to replace "awslambda_" with. |
I can't find (nor can I remember) why RequesterId was even added here (most likely as an extra safety net to make sure we don't delete the wrong ENI), but deleteLingeringLambdaENIs only gets called when resourceAwsSecurityGroupDelete is called, and the filters are "security group-id" and "description", so it should be "good enough". I still don't know who added "awslambda_" to the requestor-id (terraform? or AWS?), but I removed that filter and things seem to be working fine. I'll create a PR shortly. |
Here is the PR for this issue: #11849 |
I don't suppose anyone has come up with a clever workaround for this issue for the moment that allows destroy to work seamlessly? |
What version of terraform are you using? It's been fixed for quite a while now. This issue used to bite us big time, but ever since the fix went in, destroys work just fine. |
The PR doesn't seem to be merged which is why I'm asking - I'm on 0.8.8 right now and seeing this behaviour. |
ah, you're right. i'm using terraform built from the branch that has the fix. Looks like there are merge conflicts with base now :( I'll try to resolve those conflicts so that we can re-request this PR. |
I resolved the conflicts and asked for the PR to be merged: #11849 |
This is definitely still broken in Terraform 0.9.x. If you use Terraform to a) create a lambda function, b) give that lambda function access to a VPC, and c) attach a security group to that lambda function, then |
I am having the very same issue on 0.9.10 . Was this closed because we have a resolution/workaround ? If yes, what is the workaround ? |
I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues. If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further. |
Hi there,
I was running v0.7.8 and recently upgraded to v0.7.11 (without jumping to 0.7.9 or 0.7.10 first). It seems that GH-5767 came back at some point between those versions.
Basically we have an SNS topic that triggers a lambda function within a VPC, if at least once this lambda function is used, the ENI attached to it won't get removed and the destroy command will fail and we'll need to remove the rest of the VPC components by hand.
Also need to mention that between upgrade 0.7.8 -> 0.7.11 I did not even touch the code, neither from the lambda function nor the terraform config files.
Should you need any additional info please let me know.
Thanks a lot in advance! (and sorry if I forgot to add some info, first issue on TF here!)
Terraform Version
Affected Resource(s)
Terraform Configuration Files
I will just add some example code as there is some sensitive information on mine, but this should be enough to check out.
Panic Output
Expected Behavior
The terraform destroy command should have succeeded without issues (like it did on 0.7.8 before I upgraded to 0.7.11)
Actual Behavior
The lambda ENI should have been removed and it was not even detached.
Steps to Reproduce
References
Issue (exactly same issue):
PRs that fixed this in the past:
The text was updated successfully, but these errors were encountered: