{"action":"created","issue":{"url":"https://api.github.com/repos/hashicorp/terraform/issues/3634","labels_url":"https://api.github.com/repos/hashicorp/terraform/issues/3634/labels{/name}","comments_url":"https://api.github.com/repos/hashicorp/terraform/issues/3634/comments","events_url":"https://api.github.com/repos/hashicorp/terraform/issues/3634/events","html_url":"https://github.com/hashicorp/terraform/issues/3634","id":113267293,"number":3634,"title":"aws_elasticsearch_domain access_policies keeps reapplying","user":{"login":"lancehudson","id":1708894,"avatar_url":"https://avatars.githubusercontent.com/u/1708894?v=3","gravatar_id":"","url":"https://api.github.com/users/lancehudson","html_url":"https://github.com/lancehudson","followers_url":"https://api.github.com/users/lancehudson/followers","following_url":"https://api.github.com/users/lancehudson/following{/other_user}","gists_url":"https://api.github.com/users/lancehudson/gists{/gist_id}","starred_url":"https://api.github.com/users/lancehudson/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lancehudson/subscriptions","organizations_url":"https://api.github.com/users/lancehudson/orgs","repos_url":"https://api.github.com/users/lancehudson/repos","events_url":"https://api.github.com/users/lancehudson/events{/privacy}","received_events_url":"https://api.github.com/users/lancehudson/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/hashicorp/terraform/labels/bug","name":"bug","color":"f7c6c7"},{"url":"https://api.github.com/repos/hashicorp/terraform/labels/provider/aws","name":"provider/aws","color":"bfdadc"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":7,"created_at":"2015-10-26T01:01:40Z","updated_at":"2016-01-13T18:20:48Z","closed_at":null,"body":"I have \r\n\r\n```terraform\r\nresource \"aws_elasticsearch_domain\" \"es\" {\r\n  domain_name = \"test\"\r\n  advanced_options {\r\n    \"rest.action.multi.allow_explicit_index\" = true\r\n  }\r\n  access_policies = <<EOF\r\n{\r\n  \"Statement\": [\r\n    {\r\n      \"Action\": \"es:*\",\r\n      \"Condition\": {\r\n        \"IpAddress\": {\r\n          \"aws:SourceIp\": [\r\n            \"${aws_instance.nat_a.public_ip}\",\r\n            \"${aws_instance.nat_c.public_ip}\"\r\n          ]\r\n        }\r\n      },\r\n      \"Effect\": \"Allow\",\r\n      \"Principal\": {\r\n        \"AWS\": \"*\"\r\n      },\r\n      \"Resource\": \"arn:aws:es:${var.AWS_REGION}:${var.AWS_ACCOUNT_ID}:domain/test/*\",\r\n      \"Sid\": \"ES\"\r\n    }\r\n  ],\r\n  \"Version\": \"2012-10-17\"\r\n}\r\nEOF\r\n  ebs_options {\r\n    ebs_enabled = true\r\n    volume_type = \"gp2\"\r\n    volume_size = 35\r\n  }\r\n  cluster_config {\r\n    instance_type = \"t2.small.elasticsearch\"\r\n    instance_count = 2\r\n    dedicated_master_enabled = false\r\n    zone_awareness_enabled = true\r\n  }\r\n  snapshot_options {\r\n    automated_snapshot_start_hour = 23\r\n  }\r\n}\r\n```\r\n\r\nThe access_policies section keeps reapplying on every run. I can verify in AWS that the correct policy is applied. I suspect it is this line https://github.com/hashicorp/terraform/compare/master...lancehudson:patch-1"},"comment":{"url":"https://api.github.com/repos/hashicorp/terraform/issues/comments/171386902","html_url":"https://github.com/hashicorp/terraform/issues/3634#issuecomment-171386902","issue_url":"https://api.github.com/repos/hashicorp/terraform/issues/3634","id":171386902,"user":{"login":"willejs","id":1313453,"avatar_url":"https://avatars.githubusercontent.com/u/1313453?v=3","gravatar_id":"","url":"https://api.github.com/users/willejs","html_url":"https://github.com/willejs","followers_url":"https://api.github.com/users/willejs/followers","following_url":"https://api.github.com/users/willejs/following{/other_user}","gists_url":"https://api.github.com/users/willejs/gists{/gist_id}","starred_url":"https://api.github.com/users/willejs/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/willejs/subscriptions","organizations_url":"https://api.github.com/users/willejs/orgs","repos_url":"https://api.github.com/users/willejs/repos","events_url":"https://api.github.com/users/willejs/events{/privacy}","received_events_url":"https://api.github.com/users/willejs/received_events","type":"User","site_admin":false},"created_at":"2016-01-13T18:20:48Z","updated_at":"2016-01-13T18:20:48Z","body":"This is fixed now. You need to compare the proposed changes and you will realise amazon reformats the input you give it, just match the output from amazon to the correct format in your policy and its all ok."}}