{"action":"closed","issue":{"url":"https://api.github.com/repos/hashicorp/terraform/issues/4963","repository_url":"https://api.github.com/repos/hashicorp/terraform","labels_url":"https://api.github.com/repos/hashicorp/terraform/issues/4963/labels{/name}","comments_url":"https://api.github.com/repos/hashicorp/terraform/issues/4963/comments","events_url":"https://api.github.com/repos/hashicorp/terraform/issues/4963/events","html_url":"https://github.com/hashicorp/terraform/issues/4963","id":130831096,"number":4963,"title":"aws_db_instance doesn't apply security group changes in EC2 Classic RDS","user":{"login":"Chili-Man","id":631802,"avatar_url":"https://avatars.githubusercontent.com/u/631802?v=3","gravatar_id":"","url":"https://api.github.com/users/Chili-Man","html_url":"https://github.com/Chili-Man","followers_url":"https://api.github.com/users/Chili-Man/followers","following_url":"https://api.github.com/users/Chili-Man/following{/other_user}","gists_url":"https://api.github.com/users/Chili-Man/gists{/gist_id}","starred_url":"https://api.github.com/users/Chili-Man/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Chili-Man/subscriptions","organizations_url":"https://api.github.com/users/Chili-Man/orgs","repos_url":"https://api.github.com/users/Chili-Man/repos","events_url":"https://api.github.com/users/Chili-Man/events{/privacy}","received_events_url":"https://api.github.com/users/Chili-Man/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/hashicorp/terraform/labels/bug","name":"bug","color":"f7c6c7"},{"url":"https://api.github.com/repos/hashicorp/terraform/labels/provider/aws","name":"provider/aws","color":"bfdadc"}],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2016-02-02T21:57:53Z","updated_at":"2016-02-11T22:42:54Z","closed_at":"2016-02-11T22:42:54Z","body":"I'm provisioning a postgres database from a snapshot in EC2 classic, but it never applies the security group changes on it. By default, after the database comes up it is set to the `default` security group, but I want it to be in the `integration` security group. Here is the configuration I use:\r\n\r\n```\r\n{\r\n  \"provider\": {\r\n    \"aws\": {\r\n      \"region\": \"us-west-2\"\r\n    }\r\n  },\r\n  \"resource\": {\r\n    \"aws_db_instance\": {\r\n      \"ninja\": {\r\n        \"apply_immediately\": true,\r\n        \"identifier\": \"integration-fe200a-ninja-2016-02-02-2135\",\r\n        \"instance_class\": \"db.r3.large\",\r\n        \"skip_final_snapshot\": true,\r\n        \"availability_zone\": \"us-west-2a\",\r\n        \"backup_retention_period\": 1,\r\n        \"security_group_names\": [\r\n          \"integration\"\r\n        ],\r\n        \"auto_minor_version_upgrade\": false,\r\n        \"publicly_accessible\": false,\r\n        \"username\": \"root\",\r\n        \"password\": \"some magical password,\r\n        \"snapshot_identifier\": \"cron-test8ing-ninja-2016-02-02\"\r\n      }\r\n    }\r\n  }\r\n}\r\n```\r\n\r\n\r\nterraform plan\r\n```\r\n+ aws_db_instance.ninja\r\n    address:                         \"\" => \"<computed>\"\r\n    allocated_storage:               \"\" => \"<computed>\"\r\n    apply_immediately:               \"\" => \"1\"\r\n    arn:                             \"\" => \"<computed>\"\r\n    auto_minor_version_upgrade:      \"\" => \"0\"\r\n    availability_zone:               \"\" => \"us-west-2a\"\r\n    backup_retention_period:         \"\" => \"1\"\r\n    backup_window:                   \"\" => \"<computed>\"\r\n    copy_tags_to_snapshot:           \"\" => \"0\"\r\n    db_subnet_group_name:            \"\" => \"<computed>\"\r\n    endpoint:                        \"\" => \"<computed>\"\r\n    engine:                          \"\" => \"<computed>\"\r\n    engine_version:                  \"\" => \"<computed>\"\r\n    identifier:                      \"\" => \"integration-fe200a-ninja-2016-02-02-2135\"\r\n    instance_class:                  \"\" => \"db.m3.large\"\r\n    license_model:                   \"\" => \"<computed>\"\r\n    maintenance_window:              \"\" => \"<computed>\"\r\n    multi_az:                        \"\" => \"<computed>\"\r\n    name:                            \"\" => \"<computed>\"\r\n    parameter_group_name:            \"\" => \"<computed>\"\r\n    password:                        \"\" => \"some magical password\"\r\n    port:                            \"\" => \"<computed>\"\r\n    publicly_accessible:             \"\" => \"0\"\r\n    replicas.#:                      \"\" => \"<computed>\"\r\n    security_group_names.#:          \"\" => \"1\"\r\n    security_group_names.4259933595: \"\" => \"integration\"\r\n    skip_final_snapshot:             \"\" => \"1\"\r\n    snapshot_identifier:             \"\" => \"cron-testing-ninja-2016-02-02\"\r\n    status:                          \"\" => \"<computed>\"\r\n    storage_type:                    \"\" => \"<computed>\"\r\n    username:                        \"\" => \"root\"\r\n    vpc_security_group_ids.#:        \"\" => \"<computed>\"\r\n\r\n\r\nPlan: 1 to add, 0 to change, 0 to destroy.\r\n```\r\n\r\nterraform apply\r\n```\r\naws_db_instance.delphius: Creating...\r\n  address:                         \"\" => \"<computed>\"\r\n  allocated_storage:               \"\" => \"<computed>\"\r\n  apply_immediately:               \"\" => \"1\"\r\n  arn:                             \"\" => \"<computed>\"\r\n  auto_minor_version_upgrade:      \"\" => \"0\"\r\n  availability_zone:               \"\" => \"us-west-2a\"\r\n  backup_retention_period:         \"\" => \"1\"\r\n  backup_window:                   \"\" => \"<computed>\"\r\n  copy_tags_to_snapshot:           \"\" => \"0\"\r\n  db_subnet_group_name:            \"\" => \"<computed>\"\r\n  endpoint:                        \"\" => \"<computed>\"\r\n  engine:                          \"\" => \"<computed>\"\r\n  engine_version:                  \"\" => \"<computed>\"\r\n  identifier:                      \"\" => \"integration-fe200a-ninja-2016-02-02-2135\"\r\n  instance_class:                  \"\" => \"db.r3.large\"\r\n  license_model:                   \"\" => \"<computed>\"\r\n  maintenance_window:              \"\" => \"<computed>\"\r\n  multi_az:                        \"\" => \"<computed>\"\r\n  name:                            \"\" => \"<computed>\"\r\n  parameter_group_name:            \"\" => \"<computed>\"\r\n  password:                        \"\" => \"some magical password\"\r\n  port:                            \"\" => \"<computed>\"\r\n  publicly_accessible:             \"\" => \"0\"\r\n  replicas.#:                      \"\" => \"<computed>\"\r\n  security_group_names.#:          \"\" => \"1\"\r\n  security_group_names.4259933595: \"\" => \"integration\"\r\n  skip_final_snapshot:             \"\" => \"1\"\r\n  snapshot_identifier:             \"\" => \"cron-testing-ninja-2016-02-02\"\r\n  status:                          \"\" => \"<computed>\"\r\n  storage_type:                    \"\" => \"<computed>\"\r\n  username:                        \"\" => \"root\"\r\n  vpc_security_group_ids.#:        \"\" => \"<computed>\"\r\naws_db_instance.delphius: Creation complete\r\n\r\nApply complete! Resources: 1 added, 0 changed, 0 destroyed.\r\n```\r\n\r\n\r\nHowever after applying, when I perform a terraform plan:\r\n```\r\nRefreshing Terraform state prior to plan...\r\n\r\naws_db_instance.delphius: Refreshing state... (ID: integration-fe200a-delphius-2016-02-02-2135)\r\n\r\nThe Terraform execution plan has been generated and is shown below.\r\nResources are shown in alphabetical order for quick scanning. Green resources\r\nwill be created (or destroyed and then created if an existing resource\r\nexists), yellow resources are being changed in-place, and red resources\r\nwill be destroyed.\r\n\r\nNote: You didn't specify an \"-out\" parameter to save this plan, so when\r\n\"apply\" is called, Terraform can't guarantee this is what will execute.\r\n\r\n~ aws_db_instance.delphius\r\n    backup_retention_period:         \"7\" => \"1\"\r\n    security_group_names.3814588639: \"default\" => \"\"\r\n    security_group_names.4259933595: \"\" => \"integration\"\r\n\r\n\r\nPlan: 0 to add, 1 to change, 0 to destroy.\r\n```\r\n\r\nYou can see that it still needs to change the security groups and the backup retention period. \r\nHowever, performing another terraform apply and then terraform plan,  it will still show that the security groups have not changed to their desired state:\r\n\r\n```\r\nRefreshing Terraform state prior to plan...\r\n\r\naws_db_instance.delphius: Refreshing state... (ID: integration-fe200a-delphius-2016-02-02-2135)\r\n\r\nThe Terraform execution plan has been generated and is shown below.\r\nResources are shown in alphabetical order for quick scanning. Green resources\r\nwill be created (or destroyed and then created if an existing resource\r\nexists), yellow resources are being changed in-place, and red resources\r\nwill be destroyed.\r\n\r\nNote: You didn't specify an \"-out\" parameter to save this plan, so when\r\n\"apply\" is called, Terraform can't guarantee this is what will execute.\r\n\r\n~ aws_db_instance.delphius\r\n    security_group_names.3814588639: \"default\" => \"\"\r\n    security_group_names.4259933595: \"\" => \"integration\"\r\n\r\n\r\nPlan: 0 to add, 1 to change, 0 to destroy.\r\n```\r\n\r\nNo matter how many times I do `terraform apply` , it never changes the security group. \r\n\r\nI'm using terraform 0.6.11 on Ubuntu 15.10. "}}