Import of an aws_route_table with propagation erroneously imports propagated routes

[richievos]

When importing a route table that has had routes propagated to it, terraform improperly reads the propagated routes as actual configured routes.

My guess is that the EnableVgwRoutePropagation logic in https://github.com/terraform-providers/terraform-provider-aws/blob/master/aws/resource_aws_route_table.go either isn't being used during the import, or is being ran at a time before the propagation info is available.

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform Version

Terraform v0.11.7

Affected Resource(s)

• aws_route
• aws_route_table

Terraform Configuration Files

Here's an example terraform config

variable "vpc_cidr" {}
variable "virtual_gateway_amazon_side_asn" {}

resource "aws_vpc" "lz_vpc" {
  cidr_block = "${var.vpc_cidr}"

  enable_dns_support = true
  enable_dns_hostnames = true
}

resource "aws_internet_gateway" "vpc_gateway" {
  vpc_id = "${aws_vpc.lz_vpc.id}"
}

resource "aws_route_table" "public" {
  vpc_id = "${aws_vpc.lz_vpc.id}"

  route {
    cidr_block = "0.0.0.0/0"
    gateway_id = "${aws_internet_gateway.vpc_gateway.id}"
  }
}

resource "aws_vpn_gateway" "test_prop_vpn_gw" {
  vpc_id = "${aws_vpc.lz_vpc.id}"

  amazon_side_asn = "${var.virtual_gateway_amazon_side_asn}"
}

resource "aws_vpn_gateway_route_propagation" "test_prop" {
  vpn_gateway_id = "${aws_vpn_gateway.vpn_gw.id}"
  route_table_id = "${aws_route_table.test_table.id}"
}

resource "aws_route_table" "test_table" {
  vpc_id = "${aws_vpc.lz_vpc.id}"

  route {
    cidr_block = "0.0.0.0/0"
    gateway_id = "${aws_internet_gateway.vpc_gateway.id}"
  }
}

Debug Output

The relevant part of the import output that's wrong is this:

aws_route_table.db: Importing from ID "rtb-08815aaf574aea18d"...
aws_route_table.db: Import complete!
  Imported aws_route_table (ID: rtb-9876)
  Imported aws_route (ID: r-rtb-123456)
...
aws_route.test_table-4: Refreshing state... (ID: r-rtb-9876)
...

These routes then appear in the plan/apply output as well, and the only way to get around it is to manually state rm each of them. If you try to do an apply, the following happens:

Terraform will perform the following actions:

  - aws_route.the_table

  - aws_route.the_table-1
....
   > yes

aws_route.db-1: Destroying... (ID: r-rtb-9876)
...
* aws_route.db-9 (destroy): 1 error(s) occurred:

* aws_route.db-9: InvalidRoute.NotFound: no route with destination-cidr-block 10.X.Y.0/24 in route table rtb-9876
	status code: 400, request id: e9f963a9-0cda-48fc-abac-8d0c818827e7

Expected Behavior

When importing a route table with routes that propagated into it, I'd expect those routes to be ignored, similar to how they're ignored normally.

Actual Behavior

The propagated routes are imported, causing the state file to be invalid and unusable without manual intervention (state rm).

Steps to Reproduce

1. terraform apply the above configuration
2. outside of this, setup some routes which propagate through that gateway
3. wait for that to propagate
4. terraform state rm aws_route_table.test_table
5. terraform import aws_route_table.test_table rtb-123456
6. terraform plan -- you'll see the propagated routes in a "to delete" state
7. terraform apply -- apply will try and delete them but be unable to

References

• Some relevant code: https://github.com/terraform-providers/terraform-provider-aws/blob/master/aws/resource_aws_route_table.go#L166
• Issue which sourced the propagation ignoring: Terraform erroneously plans to remove routes with origin EnableVgwRoutePropagation. terraform#722
• PR the ignoring came in from originally: https://github.com/hashicorp/terraform/pull/726/files

[richievos]

I submitted a PR with a fix for this. As guessed, a different copy of the logic was being used in import.

[bflad]

The fix for this has been merged into master and will release with version 1.27.0 of the AWS provider, likely middle of next week.

[bflad]

This has been released in version 1.27.0 of the AWS provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thanks!