Error while trying to change security group connected to alb

[jezhumble]

Error applying plan:

1 error(s) occurred:

• aws_alb.dora_alb: diffs didn't match during apply. This is a bug with Terraform and should be reported as a GitHub Issue.

Please include the following information in your report:

Terraform Version: 0.7.3
Resource ID: aws_alb.dora_alb
Mismatch reason: diff: Destroy; old: false, new: true
Diff One (usually from plan): *terraform.InstanceDiff{mu:sync.Mutex{state:0, sema:0x0}, Attributes:map[string]*terraform.ResourceAttrDiff{"security_groups.#":*terraform.ResourceAttrDiff{Old:"", New:"", NewComputed:true, NewRemoved:false, NewExtra:interface {}(nil), RequiresNew:false, Sensitive:false, Type:0x0}}, Destroy:false, DestroyTainted:false}
Diff Two (usually from apply): *terraform.InstanceDiff{mu:sync.Mutex{state:0, sema:0x0}, Attributes:map[string]*terraform.ResourceAttrDiff{"security_groups.#":*terraform.ResourceAttrDiff{Old:"1", New:"1", NewComputed:false, NewRemoved:false, NewExtra:interface {}(nil), RequiresNew:false, Sensitive:false, Type:0x0}, "subnets.#":*terraform.ResourceAttrDiff{Old:"2", New:"2", NewComputed:false, NewRemoved:false, NewExtra:interface {}(nil), RequiresNew:false, Sensitive:false, Type:0x0}, "internal":*terraform.ResourceAttrDiff{Old:"false", New:"false", NewComputed:false, NewRemoved:false, NewExtra:interface {}(nil), RequiresNew:false, Sensitive:false, Type:0x0}, "name":*terraform.ResourceAttrDiff{Old:"terraform-dora-alb", New:"terraform-dora-alb", NewComputed:false, NewRemoved:false, NewExtra:interface {}(nil), RequiresNew:false, Sensitive:false, Type:0x0}, "enable_deletion_protection":*terraform.ResourceAttrDiff{Old:"false", New:"false", NewComputed:false, NewRemoved:false, NewExtra:interface {}(nil), RequiresNew:false, Sensitive:false, Type:0x0}, "security_groups.738430072":*terraform.ResourceAttrDiff{Old:"sg-6d24f717", New:"", NewComputed:false, NewRemoved:true, NewExtra:interface {}(nil), RequiresNew:false, Sensitive:false, Type:0x0}, "vpc_id":*terraform.ResourceAttrDiff{Old:"vpc-3c710d5b", New:"", NewComputed:true, NewRemoved:false, NewExtra:interface {}(nil), RequiresNew:false, Sensitive:false, Type:0x0}, "arn":*terraform.ResourceAttrDiff{Old:"arn:aws:elasticloadbalancing:us-east-1:346417737908:loadbalancer/app/terraform-dora-alb/404cd0716b25bf58", New:"", NewComputed:true, NewRemoved:false, NewExtra:interface {}(nil), RequiresNew:false, Sensitive:false, Type:0x0}, "subnets.807857994":*terraform.ResourceAttrDiff{Old:"subnet-3714f56c", New:"subnet-3714f56c", NewComputed:false, NewRemoved:false, NewExtra:interface {}(nil), RequiresNew:false, Sensitive:false, Type:0x0}, "security_groups.1243217035":*terraform.ResourceAttrDiff{Old:"", New:"sg-758b1b0f", NewComputed:false, NewRemoved:false, NewExtra:interface {}(nil), RequiresNew:true, Sensitive:false, Type:0x0}, "subnets.701492291":*terraform.ResourceAttrDiff{Old:"subnet-9ae407b7", New:"subnet-9ae407b7", NewComputed:false, NewRemoved:false, NewExtra:interface {}(nil), RequiresNew:false, Sensitive:false, Type:0x0}, "tags.%":*terraform.ResourceAttrDiff{Old:"1", New:"1", NewComputed:false, NewRemoved:false, NewExtra:interface {}(nil), RequiresNew:false, Sensitive:false, Type:0x0}, "dns_name":*terraform.ResourceAttrDiff{Old:"terraform-dora-alb-765013520.us-east-1.elb.amazonaws.com", New:"", NewComputed:true, NewRemoved:false, NewExtra:interface {}(nil), RequiresNew:false, Sensitive:false, Type:0x0}, "zone_id":*terraform.ResourceAttrDiff{Old:"Z35SXDOTRQ7X7K", New:"", NewComputed:true, NewRemoved:false, NewExtra:interface {}(nil), RequiresNew:false, Sensitive:false, Type:0x0}, "tags.owner":*terraform.ResourceAttrDiff{Old:"dora", New:"dora", NewComputed:false, NewRemoved:false, NewExtra:interface {}(nil), RequiresNew:false, Sensitive:false, Type:0x0}, "idle_timeout":*terraform.ResourceAttrDiff{Old:"60", New:"60", NewComputed:false, NewRemoved:false, NewExtra:interface {}(nil), RequiresNew:false, Sensitive:false, Type:0x0}}, Destroy:true, DestroyTainted:false}

Also include as much context as you can about your config, state, and the steps you performed to trigger this error.

[jezhumble]

NB I got this working again by running the plan again - I was trying to change a security group connected to an alb, and the only way I could get it to work was to change the lifecycle to "create-before-destroy", delete the name, and then run terraform twice (the first time gave the error reported above)

[stack72]

Hey @jezhumble

Thanks for reporting this - any chance you could drop us a small config that we can try and reproduce your conditions here?

Paul

[jezhumble]

Sure, try this subset:

resource "aws_security_group" "load_balancer" {
  name = "load_balancer"
  description = "Allow inbound http and https"
  vpc_id = "${aws_vpc.dora_vpc.id}"

  ingress {
    from_port = 443
    to_port = 443
    protocol = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  ingress {
    from_port = 80
    to_port = 80
    protocol = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  egress {
    from_port = 80
    to_port = 80
    protocol = "tcp"
    cidr_blocks = ["10.0.0.0/24"]
  }

  tags {
    owner = "dora"
  }
}

resource "aws_alb" "dora_alb" {
  name = "terraform-dora-alb"
  internal = false
  subnets = ["${aws_subnet.public_subnet_1.id}", "${aws_subnet.public_subnet_2.id}"]
  security_groups = ["${aws_security_group.load_balancer.id}"]

  tags {
     owner = "dora"
  }
}

resource "aws_subnet" "public_subnet_1" {
    vpc_id = "${aws_vpc.dora_vpc.id}"
    availability_zone = "us-east-1a"
    cidr_block = "10.0.0.0/26"
    map_public_ip_on_launch = false
    tags {
        owner = "dora"
    }
}

resource "aws_subnet" "public_subnet_2" {
    vpc_id = "${aws_vpc.dora_vpc.id}"
    availability_zone = "us-east-1c"
    cidr_block = "10.0.0.64/26"
    map_public_ip_on_launch = false
    tags {
        owner = "dora"
    }
}

resource "aws_vpc" "dora_vpc" {
    cidr_block = "10.0.0.0/24"
    tags {
        owner = "dora"
    }
}

[jezhumble]

PS what caused the initial problem was adding the ingress block for port 80 - so to reproduce, try without that block, and then try adding it.

[stack72]

Hi @jezhumble

Sorry for the delay here (huge number of issues!) but finally got around to fixing this. PR just about to hit

Paul

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.