aws_vpn_connection sometimes tunnel options are inverted and forces replacement

[MRinalducci]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform CLI and Terraform AWS Provider Version

❯ terraform -v
Terraform v0.14.3
+ provider registry.terraform.io/hashicorp/aws v3.22.0

Affected Resource(s)

• aws_vpn_connection

Terraform Configuration Files

Please include all Terraform configurations required to reproduce the bug. Bug reports without a functional reproduction may be closed without investigation.

resource "aws_vpc" "vpc" {
  cidr_block = "10.0.0.0/16"
}

resource "aws_vpn_gateway" "vpn_gateway" {
  vpc_id = aws_vpc.vpc.id
}

resource "aws_customer_gateway" "customer_gateway" {
  bgp_asn    = 65000
  ip_address = "172.0.0.1"
  type       = "ipsec.1"
}

resource "aws_vpn_connection" "vpn_prod" {
  vpn_gateway_id      = aws_vpn_gateway.vpn_gateway.id
  customer_gateway_id = aws_customer_gateway.customer_gateway.id
  type                = "ipsec.1"
  static_routes_only  = true
  tunnel1_inside_cidr = "169.254.10.0/30"
  tunnel2_inside_cidr = "169.254.10.4/30"

  tags = {
    Name      = "vpn_prod"
    CreatedBy = "terraform"
  }
}

Debug Output

None.

Panic Output

None.

Expected Behavior

No invertion of tunnel options.

Actual Behavior

Sometimes when the provider creates the AWS VPN connection, AWS inverts tunnel1 and tunnel2 order (order seems related to Outside IP Address when assigned by AWS).
Thats implies when planning again that the VPN connection will be replaced.
Below an example with Inside IPv4 CIDR which forces replacement.

~ tunnel1_inside_cidr                  = "169.254.10.4/30" -> "169.254.10.0/30" # forces replacement
~ tunnel2_inside_cidr                  = "169.254.10.0/30" -> "169.254.10.4/30" # forces replacement

Steps to Reproduce

1. terraform apply
2. terraform plan
3. If no changes, try again until you see the changes (terraform destroy)

Important Factoids

This is occuring since adding refresh of tunnel options with PR #14740.
But this invertion bug seems to be present way before this PR.

References

• Add VPN options and enable acceleration to aws_vpn_connection resource #14740
• Add VPN options and enable acceleration to aws_vpn_connection resource #14740 (comment)

[ewbankkit]

@MRinalducci Thanks for raising this issue.
It has already been noticed in #396. I'm going to close this one as a duplicate so that we can concentrate discussion in the linked issue.
Please add any additional comments there.

[MRinalducci]

@ewbankkit Sorry didn't see this old issue 😉

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thanks!