aws_security_group changes on every apply #1487
Comments
|
Hey there @bodgit – unfortunately I can't reproduce this. I'm using this configuration: I use a VPC here because when copying your example directly and attempting in EC2 Classic, I got errors about using Here's my And follow up I noticed in your output that with vs. Unfortunately I can't say why that's happening, as I can't reproduce it with (nearly) the same configuration. Are there any other details you might have? Can you reproduce with my example that includes the VPC? |
catsby
added
bug
|
On a hunch from your observation, I tried removing the ICMP rule from each of the problem security groups, (there's about 4 in the account that all exhibit this annoying problem) and then I don't get any changes reported on further runs. As soon as I restore the ICMP rule in each security group then I get changes on every run again. Looking at the diff, it always shows the ICMP rule is effectively removed and re-added again whilst the other rules don't change even though they're shown in the diff. |
Unfortunately that's how diffs in sets are shown 😦 |
|
No The ingress {
from_port = 8
to_port = -1
protocol = "icmp"
cidr_blocks = [
"10.0.0.0/8",
"172.16.0.0/12",
"192.168.0.0/18",
]
}and now the security group doesn't change on each apply. Looking at the ICMP codes shows even though type 8 code 0 is specifically ICMP echo request, there are no other codes assigned for that type so it's safe to specify -1 here. I tried removing the rule and adding it again and it doesn't seem to matter if I specify 0 or -1 for What's strange is that I'm setting |
|
Hello, This appears to be the same issue I'm having. If I should open a separate issue please let me know and I will do so, but this appears to exhibit the same behavior. (Terraform v0.10.8) resource "aws_security_group" "IPWhitelist" {
name = "TestTerraformBug"
description = "Allow traffic from certain trusted external points."
vpc_id = "vpc-deadbeef"
ingress {
description = "IP1"
from_port = 0
to_port = 0
protocol = -1
cidr_blocks = ["1.2.3.4/32"]
}
ingress {
description = "IP2"
from_port = 0
to_port = 0
protocol = -1
cidr_blocks = ["5.6.7.8/32"]
}
egress {
from_port = 0
to_port = 0
protocol = "-1"
cidr_blocks = ["0.0.0.0/0"]
}
tags = {
Name = "Test-sg"
}
} |
|
@tprobinson hey there, you're 2 ingress rules are the same rule, try this instead: AWS uses the combination of |
|
Hey @bodgit sorry to say that I get the same results in several regions , including |
|
@catsby That's fine. I figure it only warrants a small documentation update, if anything, now I've worked out the cause. |
|
@catsby That's great info, thank you. What if I have different ingress blocks with the same ports/protocols but different CIDR and different description? For example I want an external vendor to access 443 from the internet by using their CIDR block, and also allow 443 from the local network. I want a different description for each. Is this not possible without it recreating the rule set on each apply? |
|
Any update on this? I'm especially interested to know how to combine the similar rules into one rule with multiple CIDR blocks, but still support different descriptions per each CIDR block? This is supported by the AWS API, but is not possible with the TF configuration format for inline rules. |
|
I'm currently having this exact same issue, with the exception that the Security Group always wants to modify if I have a self-rule in my rules list, like this: ingress { If I comment out the above rule, I get "No changes", but if the rule is in, I constantly have an SG that wants to modify itself. I tried adding the rule with security_groups = ["sg-xxxxxxxx"] and I get the same behavior. |
|
I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues. If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thanks! |
ghost
locked and limited conversation to collaborators
breathingdust
removed
the
waiting-response
Terraform Version
0.10.2
Affected Resource(s)
Terraform Configuration Files
Given an example security group:
Expected Behavior
Once this security group is created on the first apply it shouldn't change on subsequent applies.
Actual Behavior
The security group changes on every apply, I get diffs like this:
I can see that it's literally just reordering the same rules, you can even see that with
ingress.3651061505andingress.717457828above none of the values are actually different. On the next run it will change them again.Steps to Reproduce
terraform applyReferences
There are numerous other bug reports about constantly changing aws_security_groups whereby the problem is usually a CIDR block that has unnecessary host bits set that are cleared by the mask or that the same ingress rule is specified multiple times for separate CIDR blocks rather than one rule with multiple CIDR blocks. I don't believe I've made either of those mistakes, but then I can't believe someone else hasn't run into this, it's not a terribly complicated resource.
The text was updated successfully, but these errors were encountered: