aws_ec2_client_vpn_authorization_rule doesn't work with a group containing comma

[jBouyoud]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform CLI and Terraform AWS Provider Version

Terraform v0.14.7
+ provider registry.terraform.io/hashicorp/aws v3.34.0

Affected Resource(s)

• aws_ec2_client_vpn_authorization_rule

Terraform Configuration Files

tf import 'aws_ec2_client_vpn_authorization_rule.test' 'cvpn-endpoint-xxxxxxxxx,10.0.0.0/8,arn:aws:iam::xxxxxxxxx:role/my-role,arn:aws:iam::xxxxxxxxx:saml-provider/my-idp'

Debug Output

Error: unexpected format for ID ("cvpn-endpoint-xxxxxxxxx,10.0.0.0/8,arn:aws:iam::xxxxxxxxx:role/my-role,arn:aws:iam::xxxxxxxxx:saml-provider/my-idp"), expected endpoint-id,target-network-cidr or endpoint-id,target-network-cidr,group-id

And I've got the same kind of error when I trying to apply my config :

Error: error waiting for Client VPN authorization rule "cvpn-endpoint-xxxxxxxxxxx,10.0.0.0/8,arn:aws:iam::xxxxxxxxx:role/my-role,arn:aws:iam::xxxxxxxxx:saml-provider/my-idp" to be active: unexpected format for ID ("...."), expected endpoint-id,target-network-cidr or endpoint-id,target-network-cidr,group-id

Expected Behavior

Should be able to manager authorization rule containing commas.

Actual Behavior

Not be able to manage authorization rule containing commas.

Steps to Reproduce

Only import an existing aws_ec2_client_vpn_authorization_rule with group contains a comma.

tf import 'aws_ec2_client_vpn_authorization_rule.test' 'cvpn-endpoint-xxxxxxxxx,10.0.0.0/8,arn:aws:iam::xxxxxxxxx:role/my-role,arn:aws:iam::xxxxxxxxx:saml-provider/my-idp'

Important Factoids

N/A

References

N/A

[ewbankkit]

@jBouyoud Thanks for raising this issue.
Unfortunately when the aws_ec2_client_vpn_authorization_rule resource was first created, the comma character was chosen as the separator for the three parts of the "unique key" (id) for the resource.
Changing this now would be a major undertaking; I'm not sure if changing the format of the id attribute is even possible using standard state migration mechanisms.
The best we can currently do is add validation to the access_group_id argument to ensure that it includes no comma.

[github-actions]

This functionality has been released in v4.0.0 of the Terraform AWS Provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template. Thank you!

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.