aws_db_instance read replica created with wrong security group

[hashibot]

This issue was originally opened by @jdubeau123 as hashicorp/terraform#8758. It was migrated here as part of the provider split. The original body of the issue is below.

---

It looks like terraform is creating a db instance from the configs below with the wrong security group. I'm passing in a specific security group id that is from a non-default security group I have created, but upon initial creation of the aws_db_instance it actually has the VPC default security group instead of the one I specified.

Terraform Version

Terraform v0.7.1

Affected Resource(s)

• aws_db_instance

Terraform Configuration Files

variable "db_sg_id" {}

variable "name" {}

variable "vpc_id" {}

variable "db_readonly_subnet_ids" {
  type = "list"
}

variable "db_readonly_instance_class" {}

variable "db_master_arn" {}

variable "db_readonly_num_instances" {}

resource "aws_db_instance" "db_readonly" {
  count                   = "${var.db_readonly_num_instances}"
  instance_class          = "${var.db_readonly_instance_class}"
  publicly_accessible     = false
  replicate_source_db     = "${var.db_master_arn}"
  vpc_security_group_ids  = ["${var.db_sg_id}"]
  backup_retention_period = 0
  db_subnet_group_name    = "${aws_db_subnet_group.slave_postgres.name}"
}

resource "aws_db_subnet_group" "slave_postgres" {
  name        = "postgres_slave_subnet_group"
  description = "Subnets for read replica"
  subnet_ids  = ["${var.db_readonly_subnet_ids}"]

  tags {
    Name = "${var.name}_postgres_slave_subnet_group"
  }
}

Expected Behavior

aws_db_instance should have been created with the specified (non-default) security group.

Actual Behavior

It was actually created with the VPC default security group

Steps to Reproduce

"terraform apply" after specifying variables

Important Factoids

This aws_db_instance is in a different region than the replicate_source_db. I also have a read-only slave that is in the same region as the replicate_source_db, and this one is created with the correct security group.

[radeksimko]

Thanks for the report. Reproduced using the following config:

data "aws_availability_zones" "available" {}

resource "aws_vpc" "main" {
  cidr_block = "10.11.0.0/16"
}

resource "aws_subnet" "db" {
  count = 3
  cidr_block = "10.11.${count.index}.0/24"
  availability_zone = "${data.aws_availability_zones.available.names[count.index]}"
  vpc_id = "${aws_vpc.main.id}"
}

resource "aws_internet_gateway" "igw" {
  vpc_id = "${aws_vpc.main.id}"
}

resource "aws_route_table" "r" {
  vpc_id = "${aws_vpc.main.id}"

  route {
    cidr_block = "0.0.0.0/0"
    gateway_id = "${aws_internet_gateway.igw.id}"
  }
}

resource "aws_route_table_association" "a" {
  count = 3
  subnet_id      = "${aws_subnet.db.*.id[count.index]}"
  route_table_id = "${aws_route_table.r.id}"
}

resource "aws_security_group" "db" {
  name = "tf-test"
  vpc_id = "${aws_vpc.main.id}"
}

resource "aws_db_subnet_group" "db" {
  name        = "tf_test_subnet_group"
  description = "Subnets for db"
  subnet_ids  = ["${aws_subnet.db.*.id}"]
}

resource "aws_db_instance" "master" {
  allocated_storage    = 10
  storage_type         = "gp2"
  engine               = "postgres"
  engine_version       = "9.6.5"
  instance_class       = "db.t2.micro"
  name                 = "mydb"
  username             = "foo"
  password             = "barbarbarbar"
  db_subnet_group_name = "${aws_db_subnet_group.db.name}"
  parameter_group_name = "default.postgres9.6"
  backup_retention_period = 1
  apply_immediately   = true
  skip_final_snapshot = true
}

resource "aws_db_instance" "slave" {
  count                   = 2
  instance_class          = "db.t2.micro"
  publicly_accessible     = false
  replicate_source_db     = "${aws_db_instance.master.id}"
  vpc_security_group_ids  = ["${aws_security_group.db.id}"]
  backup_retention_period = 0
  skip_final_snapshot = true
}

[elblivion]

Hi, we routinely get this same issue with cross-region replicas, looks like the security group is ignored and we always get the default. A subsequent plan/apply fixes this.

[bflad]

The fix for this has been merged into master and will release with version 1.34.0 of the AWS provider, likely later today.

[bflad]

This has been released in version 1.34.0 of the AWS provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thanks!