{"action":"created","issue":{"url":"https://api.github.com/repos/hashicorp/terraform/issues/6029","repository_url":"https://api.github.com/repos/hashicorp/terraform","labels_url":"https://api.github.com/repos/hashicorp/terraform/issues/6029/labels{/name}","comments_url":"https://api.github.com/repos/hashicorp/terraform/issues/6029/comments","events_url":"https://api.github.com/repos/hashicorp/terraform/issues/6029/events","html_url":"https://github.com/hashicorp/terraform/issues/6029","id":146124606,"number":6029,"title":"Terraform not removing last egress rule","user":{"login":"mminkus","id":15617332,"avatar_url":"https://avatars.githubusercontent.com/u/15617332?v=3","gravatar_id":"","url":"https://api.github.com/users/mminkus","html_url":"https://github.com/mminkus","followers_url":"https://api.github.com/users/mminkus/followers","following_url":"https://api.github.com/users/mminkus/following{/other_user}","gists_url":"https://api.github.com/users/mminkus/gists{/gist_id}","starred_url":"https://api.github.com/users/mminkus/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mminkus/subscriptions","organizations_url":"https://api.github.com/users/mminkus/orgs","repos_url":"https://api.github.com/users/mminkus/repos","events_url":"https://api.github.com/users/mminkus/events{/privacy}","received_events_url":"https://api.github.com/users/mminkus/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/hashicorp/terraform/labels/bug","name":"bug","color":"f7c6c7"},{"url":"https://api.github.com/repos/hashicorp/terraform/labels/provider/aws","name":"provider/aws","color":"bfdadc"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2016-04-05T22:30:23Z","updated_at":"2016-04-20T23:12:14Z","closed_at":null,"body":"Hey @catsby and whoever else worked on terraform egress rules.\r\n\r\nWe're running terraform 0.6.11 but also tested and confirmed that the same behaviour occurs on terraform 0.6.14.\r\n\r\nIf you have a security group with ingress and egress rules, and remove the final egress rule in your code:\r\n\r\neg, change:\r\n\r\n```\r\nresource \"aws_security_group\" \"saltmaster_instance_sg\" {\r\n  name = \"saltmaster-instance-sg\"\r\n  description = \"Security group for saltmaster instance(s)\"\r\n  vpc_id = \"${var.vpc}\"\r\n\r\n  # Allow minions on any vpc to connect to the master on ports 4505-4506\r\n  ingress {\r\n    from_port = 4505\r\n    to_port = 4506\r\n    protocol = \"tcp\"\r\n    cidr_blocks = [\"${var.infra_cidr}\", \"${var.prod_cidr}\", \"${var.test_cidr}\"]\r\n  }\r\n\r\n  egress {\r\n    from_port = 0\r\n    to_port = 0\r\n    protocol = \"-1\"\r\n    cidr_blocks = [\"0.0.0.0/0\"]\r\n  }\r\n}\r\n```\r\n\r\nto:\r\n\r\n```\r\nresource \"aws_security_group\" \"saltmaster_instance_sg\" {\r\n  name = \"saltmaster-instance-sg\"\r\n  description = \"Security group for saltmaster instance(s)\"\r\n  vpc_id = \"${var.vpc}\"\r\n\r\n  # Allow minions on any vpc to connect to the master on ports 4505-4506\r\n  ingress {\r\n    from_port = 4505\r\n    to_port = 4506\r\n    protocol = \"tcp\"\r\n    cidr_blocks = [\"${var.infra_cidr}\", \"${var.prod_cidr}\", \"${var.test_cidr}\"]\r\n  }\r\n}\r\n```\r\n\r\n1) Terraform silently doesn't change the security group,\r\n2) Terraform doesn't output anything in the plan with regard to the security group,\r\n3) the egress rule stays in AWS,\r\n4) and the state file keeps it!\r\n\r\nWe've been removing said egress security groups for some time and only just caught this happening today by chance. (Usually we delete the entire security group, but in this case we needed to keep it for an ingress rule.)\r\n\r\nWorse yet, if you go to the console and change the egress rule to something else terraform still doesn't remove it but continues to update its statefile to whatever you do in the aws console.\r\n\r\nThis clearly appears to be a serious bug as terraform is taking aws as the source of truth and not the terraform code base.\r\n\r\nWe considered adding in an explicit DENY egress rule but after looking at the documentation there does not appear to be such an ability in terraform.\r\n\r\nThe documentation also clearly states that it will NOT give you a default allow egress rule like AWS does (which is a behaviour we love btw) so it isn't terraform adding in a default allow egress rule unless its going counter to the terraform documentation. Additionally, it doesn't care what the egress rule is specifically (eg: 0.0.0.0/0 or 8.8.8.8/32 or anything else) it keeps it and silently updates its statefile with it.\r\n\r\nWe're now going to have to go and audit all our security groups because of this issue.\r\n\r\nCan we get confirmation that this is unintended behaviour?"},"comment":{"url":"https://api.github.com/repos/hashicorp/terraform/issues/comments/212647362","html_url":"https://github.com/hashicorp/terraform/issues/6029#issuecomment-212647362","issue_url":"https://api.github.com/repos/hashicorp/terraform/issues/6029","id":212647362,"user":{"login":"mminkus","id":15617332,"avatar_url":"https://avatars.githubusercontent.com/u/15617332?v=3","gravatar_id":"","url":"https://api.github.com/users/mminkus","html_url":"https://github.com/mminkus","followers_url":"https://api.github.com/users/mminkus/followers","following_url":"https://api.github.com/users/mminkus/following{/other_user}","gists_url":"https://api.github.com/users/mminkus/gists{/gist_id}","starred_url":"https://api.github.com/users/mminkus/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mminkus/subscriptions","organizations_url":"https://api.github.com/users/mminkus/orgs","repos_url":"https://api.github.com/users/mminkus/repos","events_url":"https://api.github.com/users/mminkus/events{/privacy}","received_events_url":"https://api.github.com/users/mminkus/received_events","type":"User","site_admin":false},"created_at":"2016-04-20T23:12:14Z","updated_at":"2016-04-20T23:12:14Z","body":"Agreed. We had this happen as well. Had to manually remove the rules using the AWS console."}}