AWS network ACL's and security groups keep loosing their rules on each alternating plan/apply. #8129
Comments
bernielomax
changed the title
|
It looks like Amazon is translating the values that Terraform is inserting, and Terraform isn't determining that the values are synonymous.
Try changing the protocol to "all" and "tcp" instead of "-1" and "6" in your configs, and see if that sidesteps the issue. |
|
I can confirm that I have been experiencing the same behavior with security groups. The first run works as expected, and then the 2nd run removes the rules that were applied using This might also be alleviated if we had the ability to attach security groups to running instances instead of having It would appear that terraform is comparing the Here's a relevant snippet of my https://gist.github.com/Bjorn248/892e7d7563cb86403f026dc99970ccd8 |
|
My problem where rules were alternating seem to be caused by using a mix of inline and seperate rules. I have since moved to all seperate rules and it now just refreshes the existing ruleset over every time i apply. I.e. destroys and creates the entire SG/ACL on each apply. |
|
@bernielomax, interesting...so would the solution for me be to create a placeholder empty security group, then attach that to the instance, and then define all required rules using |
|
Yeah thats what seemed to have worked for me. The other suggestion is take note of what the values are that are causing the refresh. I.e. "from value" => "to value". From what I have seen Terraform has a hard time determining differences between data types. i.e. "all" != "-1" or "-1" != -1 even though they are the same as far as AWS is concerned. So you need to make sure your to value (which is what is set in your TF template) matches what the from value which is what was set on the previous apply. I hope that makes sense. As far as this issue is concerned. The following is still relavent and seems to be a bug: ~ aws_network_acl.application_acl All my route tables continually being refreshed. I may have solved the ACL/SG problem using the method described above. |
|
I was able to resolve the route table issue using a similar fix. I declared my route table using a single inline default rule. It seems this was causing the route table to be continually refreshed with random diffs. I removed all inline rules and just used seperate "aws_route" resource's to declare all my route table entries. I think there are 3 options to fix this:
|
|
@bernielomax, I can confirm that the workaround you suggested does work. While this approach is not intuitive, it does at least serve as a working approach to get around this bug. Thanks for the suggestion! |
|
I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues. If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further. |
ghost
locked and limited conversation to collaborators
Hi,
I keep experiencing an issue where terraform keeps modifying my AWS ACL and SG's on every run. It keeps alternating between applying the ACL/SG rule or removing them. Heres some of the plan out put below. On this particular example it will then add my rules for application_acl and will remove the rules for the database_acl... It just keeps alternating between applying rules and removing them on each run! This was also happening on a previous version for me. Looks like this could possible be caused by the route tables refreshing every run?
My template looks like the following for these items:
Terraform Version
Terraform v0.7.0
Affected Resource(s)
Please list the resources as a list, for example:
The text was updated successfully, but these errors were encountered: