Client VPN route timeout on route delete

[vmorkunas]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform CLI and Terraform AWS Provider Version

Terraform v0.12.29.
aws provider v3.20.0

Affected Resource(s)

aws_ec2_client_vpn_route

Terraform Configuration Files

resource "aws_ec2_client_vpn_route" "example" {
  client_vpn_endpoint_id = aws_ec2_client_vpn_endpoint.example.id
  destination_cidr_block = "0.0.0.0/0"
  target_vpc_subnet_id   = aws_ec2_client_vpn_network_association.example.subnet_id
}

Debug Output

Error: error deleting client VPN route "cvpn-endpoint-072473af39699d210,subnet-032aeab9ad7021d8f,172.36.0.0/16": timeout while waiting for resource to be gone (last state: 'deleting', timeout: 1m0s)

Panic Output

Expected Behavior

VPN route should be deleted.

Actual Behavior

It timeouts after 1 minute, due to timeout too low in the code. It should be 5-10 mins at least.

Steps to Reproduce

1. terraform apply

Important Factoids

It's not happening all the time, just sometimes.
Here is the source code line which needs to be fixed (other client vpn resources are already with an increased timeout)

terraform-provider-aws/aws/internal/service/ec2/waiter/waiter.go

Line 171 in dddf99b

ClientVpnRouteDeletedTimeout = 1 * time.Minute

Should be a quick fix

[adamboxman]

👍

[lukeyeager]

Whenever you look into this, I'm seeing issues when creating the route, too. It seems you need to wait until after the ClientVpnAssociation becomes active before trying to create the route.

...
aws_ec2_client_vpn_network_association.association: Creation complete after 6m4s [id=cvpn-assoc-XXX]

Error: error creating client VPN route "cvpn-endpoint-XXX,subnet-XXX,0.0.0.0/0": InvalidClientVpnActiveAssociationNotFound: No active associations are present for the target resource
specified
        status code: 400, request id: XXX

Running terraform apply a second time fixes the issue.

EDIT
It also appears to be fixed by adding an explicit dependency on the association to the route:

resource "aws_ec2_client_vpn_route" "route" {
  # ...
  depends_on = [aws_ec2_client_vpn_network_association.association]
}

[nitrocode]

@lukeyeager we have an explicit depends_on set here and it does not prevent this error message

https://github.com/cloudposse/terraform-aws-ec2-client-vpn/blob/543b6ae8ac6e0561980dec0491f6d0276e9ca1bb/main.tf#L216-L227

[ewbankkit]

Two things to do here:

1. Add configurable create and delete timeouts for aws_ec2_client_vpn_route to be used while waiting for the the route to reach the correct state
2. Retry the CreateClientVpnRoute call up to the standard EC2 propagation timeout (2 mins) when InvalidClientVpnActiveAssociationNotFound is returned

[github-actions]

This functionality has been released in v4.0.0 of the Terraform AWS Provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template. Thank you!

[jonathan-strzalka-saggs]

I am still seeing this bug even in v4.0.0

Nvm: found the custom timeout block https://www.terraform.io/language/resources/syntax#operation-timeouts

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.