{"action":"opened","issue":{"url":"https://api.github.com/repos/hashicorp/terraform/issues/5226","repository_url":"https://api.github.com/repos/hashicorp/terraform","labels_url":"https://api.github.com/repos/hashicorp/terraform/issues/5226/labels{/name}","comments_url":"https://api.github.com/repos/hashicorp/terraform/issues/5226/comments","events_url":"https://api.github.com/repos/hashicorp/terraform/issues/5226/events","html_url":"https://github.com/hashicorp/terraform/issues/5226","id":135008199,"number":5226,"title":"AWS VPC Network ACL Protocol \"all\" Docs Wrong","user":{"login":"tylerFowler","id":5419372,"avatar_url":"https://avatars.githubusercontent.com/u/5419372?v=3","gravatar_id":"","url":"https://api.github.com/users/tylerFowler","html_url":"https://github.com/tylerFowler","followers_url":"https://api.github.com/users/tylerFowler/followers","following_url":"https://api.github.com/users/tylerFowler/following{/other_user}","gists_url":"https://api.github.com/users/tylerFowler/gists{/gist_id}","starred_url":"https://api.github.com/users/tylerFowler/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tylerFowler/subscriptions","organizations_url":"https://api.github.com/users/tylerFowler/orgs","repos_url":"https://api.github.com/users/tylerFowler/repos","events_url":"https://api.github.com/users/tylerFowler/events{/privacy}","received_events_url":"https://api.github.com/users/tylerFowler/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2016-02-20T00:13:55Z","updated_at":"2016-02-20T00:13:55Z","closed_at":null,"body":"The docs specify that in a network ACL rule (for AWS) a protocol value of \"-1\" is used to specify all protocols however when it's actually applied the tfstate file shows a protocol value of \"all\" so this rule will always show a change. Writing a rule as follows seems to fix the issue:\r\n\r\n```hashicorp\r\nresource \"aws_network_acl_rule\" \"all_out\" {\r\n  network_acl_id = \"${aws_network_acl.some_acl.id}\"\r\n  rule_number = 100\r\n  egress = true\r\n  protocol = \"all\" # <- fixes the problem\r\n  cidr_block = \"0.0.0.0/0\"\r\n  rule_action = \"allow\"\r\n  from_port = 0\r\n  to_port = 0\r\n}\r\n```"}}