Elastic Beanstalk environment forces update on each apply #1471
Comments
|
I narrowed it down to an issue with these two setting options. My current workaround is to just comment them out: setting {
namespace = "aws:elasticbeanstalk:application"
name = "Application Healthcheck URL"
value = "HTTP:80/elb-status"
} setting {
namespace = "aws:autoscaling:launchconfiguration"
name = "SSHSourceRestriction"
value = "tcp, 22, 22, ${var.bastion_security_group}"
} |
|
One of the side effects of this ends up being a security critical issue. Not being able to configure |
radeksimko
added
the
service/elasticbeanstalk
|
I'm having this issue as well. I can't not use the Application Healthcheck URL without compromising my deployment, so I'm stuck letting it update every environment on each apply. |
|
This also happens with the |
|
Terraform v0.11.7
But running into issues with: |
|
I'm also facing the same issue, any update or work around? |
|
It's annoying to wait 10 min for beanstalk update even there no changes |
|
+1 - Also facing this issue which causes unnecessary deployment time. |
|
+1 I'm having this issue as well <> terraform version
|
|
Any update on this? Having the same issue when using aws:autoscaling:launchconfiguration IamInstanceProfile setting. I have to give an instance profile. Is there any workaround to suppress updates? |
|
Same problems... Really a PITA |
|
@mitchellh Any chance of getting some official word on this? It's a pretty big usability issue. |
|
I have to agree that this is pretty serious, it's completely crippling my IaC, not only does this apply every time for no reason, it also prevents other resources from being updated because it fails to update constantly with: This is pretty much unusable for my purposes. |
|
Any updates??? Seems like IamInstanceProfile and SecurityGroups settings force this change... *Edit
|
|
Another important point for the This will trigger an update, so do not use it: while this WILL NOT: |
|
So I found a bug in the beanstalk API almost a year ago that essentially meant they were returning null values in certain situations with SSHSourceRestriction. They emailed me this morning say it should be fixed now, perhaps it'll solve this problem. |
|
I have this issues with many other elements. see below (- & +) removing and adding.
|
@krunalsabnis this is because you have a space between the first and the second subnet, after the comma. |
|
I observed ultra strange behavior - the post by @GarlicDipping prompted me to try this, so thanks! My EB deployment had a bunch of custom settings, and each Terraform apply would re-apply these settings as a no-op. These were settings like subnets, sgs, load balancer settings, service role, instance profile, etc. I changed only the Previous: Update: In a different EB app, this trick didn't resolve the problem. |
|
Adding |
Similar to @krunalsabnis I get this for every setting when applying terraform to Beanstalk environment Using terraform v 0.12.6. |
|
Bug is present in Two changes work around it for me:
Working version: |
|
Faced exact same issue. What solved the issue for me (these are not my solutions, found them from reading this and other posts):
Hope these help :) |
|
Same issue here when trying to use setting {
namespace = "aws:elb:policies:backendencryption"
name = "PublicKeyPolicyNames"
value = "backendkey"
resource = ""
}
setting {
namespace = "aws:elb:policies:backendencryption"
name = "InstancePorts"
value = "443"
resource = ""
}
setting {
namespace = "aws:elb:policies:backendkey"
name = "PublicKey"
value = tls_self_signed_cert.backend.cert_pem
resource = ""
}EDIT: To fix this issue, the public key must be passed instead of the certificate and it must be formatted to contain only the raw key: setting {
namespace = "aws:elb:policies:backendencryption"
name = "PublicKeyPolicyNames"
value = "backendkey"
resource = ""
}
setting {
namespace = "aws:elb:policies:backendencryption"
name = "InstancePorts"
value = "443"
resource = ""
}
setting {
namespace = "aws:elb:policies:backendkey"
name = "PublicKey"
value = replace(replace(tls_private_key.backend.public_key_pem, "/-----[A-Z ]+-----/", ""), "/\\s/", "")
resource = ""
} |
|
As others have mentioned, you need to watch out for spaces in your subnets. In addition the subnets appear to be sorted alphabetically. setting {
namespace = "aws:ec2:vpc"
name = "Subnets"
value = join(",", sort(var.private_subnets))
resource = ""
}where |
|
One other thing I just noticed was that when you have lists of things (subnets, security groups), sometimes they come back in a different order than your TF config specifies, so it detects a diff every time. Reorder the entries in the value to match what's coming back, and it should be set. That, plus the |
I think this happens because related -> hashicorp/terraform#27880 |
|
This is still an issue in |
|
seems like the workaround from #1471 (comment) works for almost all cases. |
It does not work in my case whatsoever. |
|
does it work after the first apply? have been using it for a few months and not had any of the same issues. there seem to be some underlying implicit configuration setting that happens that will update the state transparently on future plans, but plans have no updates. |
Great question. I have an app that was created from the start using Terraform that I'll add |
|
yea, not sure there is a good way to automate that process, but there's only so many settings to go through, so it may be bearable for manual review if you only have a few environments. 🤷 |
|
A workaround that seems to have worked for my team is adding @g4rb1 correct me if I'm wrong. |
Every time I use this option it causes my beanstalk to require an update. if i comment it out it works fine. I'd like to make sure its included, any way to resolve this? Also I'm not specifying the keypair setting, i'm wondering does it need to be used in conjunction with the keypair setting to work? |
|
Adding |
|
Any idea how to fix DBSubnets ? |
|
depending on how you are supplying the subnets you might need to sort them. sorting them fixed my issue with subnets changing. EG: sort(["subnet-1", "subnet-2"]) |
|
@snipergotya I am already sorting the subnets |
|
@khavishbhundoo try then to do a terraform plan -out plan.out
terraform show -json plan.out > plan.json |
|
All i can see is the setting with the proper subnet in the json |
But what about the previous value that was stored? can you found it and paste it here? |
|
There is no value for |
|
Maybe trying hardcoding the values in different order to test and understand what is the expected format? try these values: Keep in mind that the underlying issue is that the format used to store the values could be different to how terraform is displaying the data. I'm out of ideas, but good luck! |
|
@nueces I found out what the problem was. Actually I don't have an RDS attached to the environment as part of my infra but was setting the
|
|
Even though I applied all suggestions in this thread, I still had the issue with: it wants changes all the time. I even tried to change name f the security group to start with "aaa" to ensure it is first in order when sorting with default security group, but nope, doesn't help. |
|
Huh, it seems the problem with |
|
The issue is still valid as of Jan 2024, regardless of the workarounds mentioned above. Is there really nothing to be done about it? |
|
The issue is still valid as of Feb 2024 |
I solved it with
|
|
Yup beanstalk is still a pain in terraform (June 2024). I managed to fix all my issues with the above mentioned solutions apart from: resulting from: PS: |
|
Like @wosiu, I had the same issue, where the - setting {
- name = "SecurityGroups" -> null
- namespace = "aws:autoscaling:launchconfiguration" -> null
- value = "my-custom-group,awseb-e-axyhk2fb5a-stack-AWSEBSecurityGroup-EjnP0DRwqyFQ" -> null
# (1 unchanged attribute hidden)
}
+ setting {
+ name = "SecurityGroups"
+ namespace = "aws:autoscaling:launchconfiguration"
+ value = "my-custom-group"
# (1 unchanged attribute hidden)
}The solution here was to simply add the default security group myself: data "aws_security_group" "default_eb_group" {
tags = {
"aws:cloudformation:logical-id" = "AWSEBSecurityGroup"
"elasticbeanstalk:environment-name" = "my-env-name"
}
}
resource "aws_elastic_beanstalk_environment" "default" {
name = "my-env-name"
// ...
setting {
namespace = "aws:autoscaling:launchconfiguration"
name = "SecurityGroups"
value = "my-custom-group,${data.aws_security_group.default_eb_group.name}"
resource = ""
}
}This works because:
This, combined with the
Site note: You currently can't prevent Elastic Beanstalk from creating its default security group: aws/elastic-beanstalk-roadmap#44 (comment). |
and others
Hello,
Every time I run
terraform applymy elastic beanstalk environment is marked for update, which in turn re-creates my environment. This is clearly undesirable behavior.Terraform Version
Affected Resource(s)
Terraform Configuration Files
Output
Expected Behavior
No change should be detected
Actual Behavior
Terraform thinks I've made a change
Steps to Reproduce
terraform applyterraform applyagain with no changesThe text was updated successfully, but these errors were encountered: