[Bug]: Importing aws_lb_listener and aws_lb_target_group incorrectly sets defaults for absent optional values

[flostadler]

Terraform Core Version

1.5.7

AWS Provider Version

5.62.0

Affected Resource(s)

aws_lb_listener, aws_alb_listener, aws_lb_target_group, aws_alb_target_group

Expected Behavior

When importing a Listener, optional attributes like default_action.forward.stickiness.duration are getting set to the types default value (e.g. 0 for number or "" for string).

Actual Behavior

Those attributes shouldn't be set at all when their corresponding field in the SDK response is not set because the default values are not valid for most of the attributes.
E.g.

• 0 is not valid for duration (https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lb_listener#duration)
• 0 is not valid for order (https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lb_listener#order)

This is happening because fields of the API response are casted to primitive types before first checking whether they're non-nil. E.g.

terraform-provider-aws/internal/service/elbv2/listener.go

Lines 1170 to 1171 in 3724def

	names.AttrEnabled: aws.ToBool(config.Enabled),
	names.AttrDuration: aws.ToInt32(config.DurationSeconds),

A similar bug existed for create/update and was fixed here: https://github.com/hashicorp/terraform-provider-aws/pull/35671/files#diff-eeba380b8533b2e177f0bab8c04a32da3d34c417a7655baef7b4aabdeb244564R933-R938

Running terraform apply after the import corrects the attributes that were wrongly set to state.

Relevant Error/Panic Output Snippet

No response

Terraform Configuration Files

terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
    }
  }
}

provider "aws" {
  region = "eu-central-1"
}

variable "vpc_id" {
  description = "The VPC ID"
  type        = string
}

resource "aws_security_group" "allowTls" {
  description = "Allow TLS inbound traffic and all outbound traffic"
  vpc_id      = var.vpc_id

  tags = {
    Name = "allow_tls"
  }
}

data "aws_subnets" "public" {
  filter {
    name   = "vpc-id"
    values = [var.vpc_id]
  }

  tags = {
    SubnetType = "Public"
  }
}

resource "aws_lb" "my_lb" {
  name               = "my-lb"
  internal           = true
  load_balancer_type = "application"
  security_groups    = [aws_security_group.allowTls.id]
  subnets            = toset(data.aws_subnets.public.ids)
}

resource "aws_lb_target_group" "my_tg" {
  name        = "my-tg"
  port        = 80
  protocol    = "HTTP"
  vpc_id      = var.vpc_id
  target_type = "ip"
}

resource "aws_lb_listener" "my_listener" {
  load_balancer_arn = aws_lb.my_lb.arn
  port              = 80

  default_action {
    type             = "forward"
    target_group_arn = aws_lb_target_group.my_tg.arn
  }
}

# resource "aws_lb_listener" "test_import" {
#     load_balancer_arn = aws_lb.my_lb.arn
#     port              = 80

#     default_action {
#         type             = "forward"
#         target_group_arn = aws_lb_target_group.my_tg.arn
#     }
# }

# import {
#     to = aws_lb_listener.test_import
#     id = aws_lb_listener.my_listener.arn
# }

Steps to Reproduce

Run terraform apply, then uncomment the resource at the bottom and run import with the output of the listener ARN.
E.g:

terraform import aws_lb_listener.test_import "arn:aws:elasticloadbalancing:eu-central-1:REDACTED:listener/app/my-lb/e672f33357b85da8/9c0e1f22b3e3c10e"

Now run terraform apply again and you'll see the that attributes like stickiness duration have been wrongly set in the state and show a diff:

  # aws_lb_listener.test_import will be updated in-place
  ~ resource "aws_lb_listener" "test_import" {
        id                = "arn:aws:elasticloadbalancing:eu-central-1:616138583583:listener/app/my-lb/e672f33357b85da8/9c0e1f22b3e3c10e"
        tags              = {}
        # (5 unchanged attributes hidden)

      ~ default_action {
          + target_group_arn = "arn:aws:elasticloadbalancing:eu-central-1:616138583583:targetgroup/my-tg/10da087e29abe9cd"
            # (2 unchanged attributes hidden)

          - forward {
              - stickiness {
                  - duration = 0 -> null
                  - enabled  = false -> null
                }
              - target_group {
                  - arn    = "arn:aws:elasticloadbalancing:eu-central-1:616138583583:targetgroup/my-tg/10da087e29abe9cd" -> null
                  - weight = 1 -> null
                }
            }
        }
    }

Debug Output

No response

Panic Output

No response

Important Factoids

No response

References

No response

Would you like to implement a fix?

None

[github-actions]

Community Note

Voting for Prioritization

• Please vote on this issue by adding a 👍 reaction to the original post to help the community and maintainers prioritize this request.
• Please see our prioritization guide for information on how we prioritize.
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request.

Volunteering to Work on This Issue

• If you are interested in working on this issue, please leave a comment.
• If this would be your first contribution, please review the contribution guide.

[flostadler]

A similar thing happens for aws_lb_target_group when the target_type is set to lambda. healthcheck.protocol and healthcheck.port get set to empty strings.

The wrong values aren't surfaced to users though because they only get inserted into the state. Those attributes are ignored when computing the diff and when applying it .

Here pointers are converted to their primitives, which yields "" for port and protocol:

terraform-provider-aws/internal/service/elbv2/target_group.go

Lines 1170 to 1176 in 3724def

	names.AttrEnabled: aws.ToBool(apiObject.HealthCheckEnabled),
	"healthy_threshold": aws.ToInt32(apiObject.HealthyThresholdCount),
	names.AttrInterval: aws.ToInt32(apiObject.HealthCheckIntervalSeconds),
	names.AttrPort: aws.ToString(apiObject.HealthCheckPort),
	names.AttrProtocol: apiObject.HealthCheckProtocol,
	names.AttrTimeout: aws.ToInt32(apiObject.HealthCheckTimeoutSeconds),
	"unhealthy_threshold": aws.ToInt32(apiObject.UnhealthyThresholdCount),

[github-actions]

Warning

This issue has been closed, meaning that any additional comments are hard for our team to see. Please assume that the maintainers will not see them.

Ongoing conversations amongst community members are welcome, however, the issue will be locked after 30 days. Moving conversations to another venue, such as the AWS Provider forum, is recommended. If you have additional concerns, please open a new issue, referencing this one where needed.

[github-actions]

This functionality has been released in v5.69.0 of the Terraform AWS Provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template. Thank you!

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.