aws_apprunner_vpc_connector doesn't support update

[moizdhanji]

I am using aws_apprunner_service with the aws_apprunner_vpc_connector. All works well with the vpc connector as long as tags are not used. The moment tags are added, it throws the following error:

Error: doesn't support update
  with aws_apprunner_vpc_connector.default, \
  on main.tf line 68, in resource "aws_apprunner_vpc_connector" "default": \
  68: resource "aws_apprunner_vpc_connector" "default" {

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform CLI and Terraform AWS Provider Version

Terraform v1.2.6
on windows_amd64
+ provider registry.terraform.io/hashicorp/aws v4.26.0
+ provider registry.terraform.io/hashicorp/time v0.8.0

Your version of Terraform is out of date! The latest version
is 1.2.7. You can update by downloading from https://www.terraform.io/downloads.html

Affected Resource(s)

• aws_apprunner_vpc_connector
• aws_apprunner_service

Terraform Configuration Files

resource "aws_apprunner_vpc_connector" "default" {
  vpc_connector_name = "private-vpc-connector"
  subnets            = aws_subnet.private_subnet.*.id
  security_groups    = [aws_security_group.vpc_connector.id]
  tags = { Name = "private-vpc-connector" }
  lifecycle {
    create_before_destroy = true
  }
}

resource "aws_security_group" "vpc_connector" {
  name        = "vpc-connector-sg"
  description = "Default security group to allow inbound/outbound from the VPC"
  vpc_id      = aws_vpc.default.id
  depends_on  = [aws_vpc.default]

  ingress {
    from_port = "0"
    to_port   = "0"
    protocol  = "-1"
    self      = true
  }

  egress {
    from_port = "0"
    to_port   = "0"
    protocol  = "-1"
    self      = "true"
  }
}

resource "aws_vpc" "default" {
  cidr_block           = "10.0.0.0/24"
  instance_tenancy     = "default"
  enable_dns_support   = "true" #gives you an internal domain name
  enable_dns_hostnames = "true" #gives you an internal host name
  enable_classiclink   = "false"
}

variable "private_subnets_cidr" {
  type    = list(string)
  default = ["10.0.0.0/27", "10.0.0.32/27", "10.0.0.64/27"]
}

variable "availability_zones" {
  type    = list(string)
  default = ["us-east-1a", "us-east-1b", "us-east-1c"]
}

/* Private subnet */
resource "aws_subnet" "private_subnet" {
  vpc_id                  = aws_vpc.default.id
  count                   = 3
  cidr_block              = element(var.private_subnets_cidr, count.index)
  availability_zone       = element(var.availability_zones, count.index)
  map_public_ip_on_launch = false
}

/* Routing table for private subnet */
resource "aws_route_table" "private" {
  vpc_id = aws_vpc.default.id
}

resource "aws_route_table_association" "private" {
  count          = length(var.private_subnets_cidr)
  subnet_id      = element(aws_subnet.private_subnet.*.id, count.index)
  route_table_id = aws_route_table.private.id
}
/*==== VPC's Default Security Group ======*/
resource "aws_security_group" "default" {
  name        = "vpc-default-sg"
  description = "Default security group to allow inbound/outbound from the VPC"
  vpc_id      = aws_vpc.default.id
  depends_on  = [aws_vpc.default]

  ingress {
    from_port = "0"
    to_port   = "0"
    protocol  = "-1"
    self      = true
  }

  egress {
    from_port = "0"
    to_port   = "0"
    protocol  = "-1"
    self      = "true"
  }
}

Debug Output

aws_apprunner_vpc_connector.default: Modifying... [id=arn:aws:apprunner:us-east-1:304768801460:vpcconnector/private-vpc-connector/1/8888daff5c44426b9fd990b733724b1e]

Error: doesn't support update

  with aws_apprunner_vpc_connector.default,
  on main.tf line 68, in resource "aws_apprunner_vpc_connector" "default":
  68: resource "aws_apprunner_vpc_connector" "default" {

Panic Output

Expected Behavior

Just like other resources, the aws_apprunner_vpc_connector resource should support updates to the tags.

Actual Behavior

Updates to tags are not accepted by aws_apprunner_vpc_connector resource.

Steps to Reproduce

1. Create a resource block for aws_apprunner_vpc_connector along with name, subnet, security group and tags.
2. terraform apply
3. Change values in tags and reapply using terraform apply

References

apprunner_vpc_connector

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.