{"action":"closed","issue":{"url":"https://api.github.com/repos/hashicorp/terraform/issues/6502","repository_url":"https://api.github.com/repos/hashicorp/terraform","labels_url":"https://api.github.com/repos/hashicorp/terraform/issues/6502/labels{/name}","comments_url":"https://api.github.com/repos/hashicorp/terraform/issues/6502/comments","events_url":"https://api.github.com/repos/hashicorp/terraform/issues/6502/events","html_url":"https://github.com/hashicorp/terraform/issues/6502","id":153301313,"number":6502,"title":"Plan breaks on recreating an aws_security_group_rule whose cidr_blocks contain both a straight-up and function-return list value","user":{"login":"stephenchu","id":14464,"avatar_url":"https://avatars.githubusercontent.com/u/14464?v=3","gravatar_id":"","url":"https://api.github.com/users/stephenchu","html_url":"https://github.com/stephenchu","followers_url":"https://api.github.com/users/stephenchu/followers","following_url":"https://api.github.com/users/stephenchu/following{/other_user}","gists_url":"https://api.github.com/users/stephenchu/gists{/gist_id}","starred_url":"https://api.github.com/users/stephenchu/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/stephenchu/subscriptions","organizations_url":"https://api.github.com/users/stephenchu/orgs","repos_url":"https://api.github.com/users/stephenchu/repos","events_url":"https://api.github.com/users/stephenchu/events{/privacy}","received_events_url":"https://api.github.com/users/stephenchu/received_events","type":"User","site_admin":false},"labels":[{"id":85946957,"url":"https://api.github.com/repos/hashicorp/terraform/labels/bug","name":"bug","color":"f7c6c7","default":true},{"id":127939518,"url":"https://api.github.com/repos/hashicorp/terraform/labels/provider/aws","name":"provider/aws","color":"bfdadc","default":false}],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2016-05-05T19:07:24Z","updated_at":"2016-11-19T04:17:43Z","closed_at":"2016-11-19T04:17:43Z","body":"### Terraform Version\n\nTerraform v0.6.15\n### Affected Resource(s)\n- AWS `security_group_rule`\n### Terraform Configuration Files\n\n``` hcl\n resource \"aws_security_group_rule\" \"limited_ssh_access\" {\n   type = \"ingress\"\n   security_group_id = \"${aws_security_group.bastion.id}\"\n   from_port   = 22\n   to_port     = 22\n   protocol    = \"tcp\"\n   cidr_blocks = [\n    \"${var.bar}/32\",\n    \"${split(\",\", var.foo)}\"\n   ]\n }\n\n```\n### Debug Output\n\n```\naws_security_group_rule.limited_ssh_access: Destroying...\naws_security_group_rule.limited_ssh_access: Destruction complete\nError applying plan:\n\n1 error(s) occurred:\n\n* aws_security_group_rule.limited_ssh_access: diffs didn't match during apply. This is a bug with Terraform and should be reported as a GitHub Issue.\n\nPlease include the following information in your report:\n\n    Terraform Version: 0.6.15\n    Resource ID: aws_security_group_rule.limited_ssh_access\n    Mismatch reason: attribute mismatch: cidr_blocks.3\n    Diff One (usually from plan): *terraform.InstanceDiff{Attributes:map[string]*terraform.ResourceAttrDiff{\"cidr_blocks.2\":*terraform.ResourceAttrDiff{Old:\"11.11.111.11/32\", New:\"11.11.111.11/32\", NewComputed:false, NewRemoved:false, NewExtra:interface {}(nil), RequiresNew:false, Type:0x0}, \"cidr_blocks.4\":*terraform.ResourceAttrDiff{Old:\"22.22.22.22/32\", New:\n\"\", NewComputed:false, NewRemoved:true, NewExtra:interface {}(nil), RequiresNew:false, Type:0x0}, \"cidr_blocks.0\":*terraform.ResourceAttrDiff{Old:\"33.3.33.33/32\", New:\"33.3.33.33/32\", NewComputed:false, NewRemoved:false, NewExtra:interface {}(nil), RequiresNew:false, Type:0x0}, \"self\":*terraform.ResourceAttrDiff{Old:\"false\", New:\"0\", NewComputed:false, NewRemov\ned:false, NewExtra:interface {}(nil), RequiresNew:false, Type:0x0}, \"security_group_id\":*terraform.ResourceAttrDiff{Old:\"sg-d92ff5bd\", New:\"sg-d92ff5bd\", NewComputed:false, NewRemoved:false, NewExtra:interface {}(nil), RequiresNew:false, Type:0x0}, \"protocol\":*terraform.ResourceAttrDiff{Old:\"tcp\", New:\"tcp\", NewComputed:false, NewRemoved:false, NewExtra:\"tcp\", \nRequiresNew:false, Type:0x0}, \"to_port\":*terraform.ResourceAttrDiff{Old:\"22\", New:\"22\", NewComputed:false, NewRemoved:false, NewExtra:interface {}(nil), RequiresNew:false, Type:0x0}, \"cidr_blocks.1\":*terraform.ResourceAttrDiff{Old:\"55.55.555.555/32\", New:\"55.55.555.555/32\", NewComputed:false, NewRemoved:false, NewExtra:interface {}(nil), RequiresNew:false, Type\n:0x0}, \"from_port\":*terraform.ResourceAttrDiff{Old:\"22\", New:\"22\", NewComputed:false, NewRemoved:false, NewExtra:interface {}(nil), RequiresNew:false, Type:0x0}, \"cidr_blocks.#\":*terraform.ResourceAttrDiff{Old:\"5\", New:\"4\", NewComputed:false, NewRemoved:false, NewExtra:interface {}(nil), RequiresNew:true, Type:0x0}, \"source_security_group_id\":*terraform.Resourc\neAttrDiff{Old:\"\", New:\"\", NewComputed:true, NewRemoved:false, NewExtra:interface {}(nil), RequiresNew:false, Type:0x0}, \"type\":*terraform.ResourceAttrDiff{Old:\"ingress\", New:\"ingress\", NewComputed:false, NewRemoved:false, NewExtra:interface {}(nil), RequiresNew:false, Type:0x0}, \"cidr_blocks.3\":*terraform.ResourceAttrDiff{Old:\"44.4.444.44/32\", New:\"\", NewComput\ned:false, NewRemoved:false, NewExtra:interface {}(nil), RequiresNew:true, Type:0x0}}, Destroy:false, DestroyTainted:false}\n    Diff Two (usually from apply): *terraform.InstanceDiff{Attributes:map[string]*terraform.ResourceAttrDiff{\"cidr_blocks.#\":*terraform.ResourceAttrDiff{Old:\"\", New:\"4\", NewComputed:false, NewRemoved:false, NewExtra:interface {}(nil), RequiresNew:true, Type:0x0}, \"cidr_blocks.0\":*terraform.ResourceAttrDiff{Old:\"\", New:\"33.3.33.33/32\", NewComputed:false, NewRemo\nved:false, NewExtra:interface {}(nil), RequiresNew:true, Type:0x0}, \"source_security_group_id\":*terraform.ResourceAttrDiff{Old:\"\", New:\"\", NewComputed:true, NewRemoved:false, NewExtra:interface {}(nil), RequiresNew:true, Type:0x0}, \"from_port\":*terraform.ResourceAttrDiff{Old:\"\", New:\"22\", NewComputed:false, NewRemoved:false, NewExtra:interface {}(nil), Requires\nNew:true, Type:0x0}, \"to_port\":*terraform.ResourceAttrDiff{Old:\"\", New:\"22\", NewComputed:false, NewRemoved:false, NewExtra:interface {}(nil), RequiresNew:true, Type:0x0}, \"protocol\":*terraform.ResourceAttrDiff{Old:\"\", New:\"tcp\", NewComputed:false, NewRemoved:false, NewExtra:\"tcp\", RequiresNew:true, Type:0x0}, \"cidr_blocks.1\":*terraform.ResourceAttrDiff{Old:\"\", \nNew:\"55.55.555.555/32\", NewComputed:false, NewRemoved:false, NewExtra:interface {}(nil), RequiresNew:true, Type:0x0}, \"security_group_id\":*terraform.ResourceAttrDiff{Old:\"\", New:\"sg-d92ff5bd\", NewComputed:false, NewRemoved:false, NewExtra:interface {}(nil), RequiresNew:true, Type:0x0}, \"cidr_blocks.2\":*terraform.ResourceAttrDiff{Old:\"\", New:\"11.11.111.11/32\", N\newComputed:false, NewRemoved:false, NewExtra:interface {}(nil), RequiresNew:true, Type:0x0}, \"self\":*terraform.ResourceAttrDiff{Old:\"\", New:\"0\", NewComputed:false, NewRemoved:false, NewExtra:interface {}(nil), RequiresNew:true, Type:0x0}, \"type\":*terraform.ResourceAttrDiff{Old:\"\", New:\"ingress\", NewComputed:false, NewRemoved:false, NewExtra:interface {}(nil), R\nequiresNew:true, Type:0x0}}, Destroy:false, DestroyTainted:false}\n```\n### Actual Behavior\n- The plan shows un-interpolated values for `cidr_blocks` attribute (see `cidr_blocks.3` below):\n\n```\n-/+ module.vpc.aws_security_group_rule.limited_ssh_access\n    cidr_blocks.#:            \"5\" => \"3\" (forces new resource)\n    cidr_blocks.0:            \"11.1.11.11/32\" => \"11.1.11.11/32\"\n    cidr_blocks.1:            \"22.22.222.222/32\" => \"22.22.222.222/32\"\n    cidr_blocks.2:            \"33.33.333.33/32\" => \"33.33.333.33/32\"\n    cidr_blocks.3:            \"44.4.444.44/32\" => \"${compact(split(\\\",\\\", var.foo))}\" (forces new resource)\n```\n- Apply fails. The destruction part of the re-create completes successfully, but the subsequent creation will fail with diff mismatch above.\n### Steps to Reproduce\n- `Plan` and `apply` a `security_group_rule` creation whose `cider_blocks` contain **both** a straight-up value (can be interpolated) **and** a Terraform function returned list value. This `apply` should succeed. e.g.:\n\n```\n   cidr_blocks = [\n    \"${var.bar}/32\",\n    \"${split(\",\", var.foo)}\"\n   ]\n```\n\nwhere `var.foo` is `10.0.0.0/32,10.0.0.1/32` and `var.bar` is `10.1.0.0/32`.\n- Change `var.foo` value to just a single cidr `10.0.0.0/32`. The subsequent `plan` of this change should trigger a re-create (i.e. `-/+`) of the `security_group_rule` with the new cidrs, since they cannot be modified. But the Terraform functions show up in the `plan` instead of `<computed>` or something. See `cidr_blocks.3` above.\n- If the `cidr_blocks` value only contains `\"${split(\",\", var.foo)}\"` without mixing both types of values in, then it appears the re-create will work fine.\n### References\n\nI didn't check exhaustively, but I can imagine this bug may occur in many other AWS resources that triggers resource `- / +` recreation as well, I'm not sure. I definitely have seen/logged issues around during `plan` it shows un-calculated Terraform functions though around `terraform_remote_state`.\n"}}
{"actor":{"display_login":"mitchellh"}}