{"action":"opened","issue":{"url":"https://api.github.com/repos/hashicorp/vault/issues/5091","repository_url":"https://api.github.com/repos/hashicorp/vault","labels_url":"https://api.github.com/repos/hashicorp/vault/issues/5091/labels{/name}","comments_url":"https://api.github.com/repos/hashicorp/vault/issues/5091/comments","events_url":"https://api.github.com/repos/hashicorp/vault/issues/5091/events","html_url":"https://github.com/hashicorp/vault/issues/5091","id":349985838,"node_id":"MDU6SXNzdWUzNDk5ODU4Mzg=","number":5091,"title":"Vault Version 0.10.4 causes EOF with terraform on database backend","user":{"login":"myoung34","id":879922,"node_id":"MDQ6VXNlcjg3OTkyMg==","avatar_url":"https://avatars1.githubusercontent.com/u/879922?v=4","gravatar_id":"","url":"https://api.github.com/users/myoung34","html_url":"https://github.com/myoung34","followers_url":"https://api.github.com/users/myoung34/followers","following_url":"https://api.github.com/users/myoung34/following{/other_user}","gists_url":"https://api.github.com/users/myoung34/gists{/gist_id}","starred_url":"https://api.github.com/users/myoung34/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/myoung34/subscriptions","organizations_url":"https://api.github.com/users/myoung34/orgs","repos_url":"https://api.github.com/users/myoung34/repos","events_url":"https://api.github.com/users/myoung34/events{/privacy}","received_events_url":"https://api.github.com/users/myoung34/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-08-13T11:11:40Z","updated_at":"2018-08-13T11:11:40Z","closed_at":null,"author_association":"NONE","body":"<!-- Please reserve GitHub issues for bug reports and feature requests.\r\n\r\nFor questions, the best place to get answers is on our [mailing list](https://groups.google.com/forum/#!forum/vault-tool), as they will get more visibility from experienced users than the issue tracker.\r\n\r\nPlease note: We take Vault's security and our users' trust very seriously. If you believe you have found a security issue in Vault, please responsibly disclose by contacting us at security@hashicorp.com. Our PGP key is available at [our security page](https://www.hashicorp.com/security/).\r\n\r\n-->\r\n\r\n**Describe the bug**\r\nA clear and concise description of what the bug is.\r\n\r\n**To Reproduce**\r\nSteps to reproduce the behavior:\r\n1. Run `vault apply` twice. one to create one to update\r\n2. See error\r\n\r\n**Expected behavior**\r\n\r\nShould work. Works in 0.9.6\r\n\r\n**Environment:**\r\n* Vault Server Version (retrieve with `vault status`): 0.10.4\r\n* Vault CLI Version (retrieve with `vault version`): 0.10.4\r\n* Server Operating System/Architecture: AWS Linux 2018.03\r\n\r\nVault server configuration file(s):\r\n\r\n```hcl\r\ndata \"vault_generic_secret\" \"rds_user\" {\r\n  path = \"secret/staging/shared/DB_DEFAULT_USER\"\r\n}\r\n\r\ndata \"vault_generic_secret\" \"rds_password\" {\r\n  path = \"secret/staging/shared/DB_DEFAULT_PASSWORD\"\r\n}\r\n\r\ndata \"vault_generic_secret\" \"rds_dbname\" {\r\n  path = \"secret/staging/shared/DB_DEFAULT_NAME\"\r\n}\r\n\r\nmodule \"rds\" {\r\n  source = \"../../../../modules/rds/snapshot\"\r\n\r\n  apply_immediately         = \"true\"\r\n  engine_version            = \"9.6.6\"\r\n  environment               = \"staging\"\r\n  final_snapshot_identifier = \"health-staging-final-5\"\r\n  instance_class            = \"db.m3.medium\"\r\n  name                      = \"health-staging\"\r\n  db_name                   = \"${data.vault_generic_secret.rds_dbname.data[\"value\"]}\"\r\n  skip_final_snapshot       = \"true\"\r\n  security_group_ids        = [\"${data.terraform_remote_state.staging_vpc.default_security_group_id}\"]\r\n  snapshot_identifier       = \"${var.rds_snapshot_identifier}\"\r\n  storage_size              = \"150\"\r\n  subnet_ids                = [\"${data.terraform_remote_state.staging_vpc.private_subnet_ids}\"]\r\n}\r\n\r\nresource \"vault_database_secret_backend_connection\" \"rds\" {\r\n  allowed_roles = [\"rds-staging\"]\r\n  backend       = \"database\"\r\n  name          = \"rds-staging\"\r\n\r\n  postgresql {\r\n    connection_url = \"postgresql://${data.vault_generic_secret.rds_user.data[\"value\"]}:${data.vault_generic_secret.rds_password.data[\"value\"]}@${module.rds.address}:${module.rds.port}/${data.vault_generic_secret.rds_dbname.data[\"value\"]}\"\r\n  }\r\n}\r\n\r\nresource \"vault_database_secret_backend_role\" \"rds\" {\r\n  backend               = \"database\"\r\n  db_name               = \"${vault_database_secret_backend_connection.rds.name}\"\r\n  default_ttl           = 36000\r\n  max_ttl               = 86400\r\n  name                  = \"rds-staging\"\r\n}\r\n```\r\n\r\n**Additional context**\r\n\r\nCreation works fine. Update causes EOF. See run:\r\n\r\n```\r\n$ vault delete database/config/rds-staging                                                                                     \r\nSuccess! Data deleted (if it existed) at: database/config/rds-staging                              \r\n\r\n$ vault delete database/roles/rds-staging                  \r\nSuccess! Data deleted (if it existed) at: database/roles/rds-staging\r\n\r\n$ terraform apply -target=vault_database_secret_backend_connection.rds -target=vault_database_secret_backend_role.rds\r\n\r\ndata.terraform_remote_state.staging_vpc: Refreshing state...                                                                                                                                                                                  data.vault_generic_secret.rds_password: Refreshing state...                                                                                                                                                                                   data.vault_generic_secret.rds_dbname: Refreshing state...                                                                                                                                                                                     data.vault_generic_secret.rds_user: Refreshing state...                                                                                                                                                                                       aws_db_parameter_group.default: Refreshing state... (ID: health-staging)                                                                                                                                                                      aws_db_subnet_group.default: Refreshing state... (ID: health-staging)\r\naws_db_instance.default: Refreshing state... (ID: health-staging)\r\nvault_database_secret_backend_role.rds: Refreshing state... (ID: database/roles/rds-staging)\r\n                                                                                                                                         \r\nAn execution plan has been generated and is shown below.\r\nResource actions are indicated with the following symbols:                                                                     \r\n  + create                                                                                         \r\n\r\nTerraform will perform the following actions:              \r\n                                                     \r\n  + vault_database_secret_backend_connection.rds\r\n      id:                                <computed>\r\n      allowed_roles.#:                   \"1\"\r\n      allowed_roles.0:                   \"rds-staging\"         \r\n      backend:                           \"database\"      \r\n      name:                              \"rds-staging\"\r\n      postgresql.#:                      \"1\"            \r\n      postgresql.0.connection_url:       \"postgresql://user:superstrongpassword@health-staging.blah.us-east-1.rds.amazonaws.com:5432/databasename\"\r\n      postgresql.0.max_open_connections: \"2\"                  \r\n      verify_connection:                 \"true\"\r\n                                                                                                                                                                                \r\n  + vault_database_secret_backend_role.rds    \r\n      id:                                <computed>                   \r\n      backend:                           \"database\"                                                       \r\nword}}' VALID UNTIL '{{expiration}}' IN ROLE vault_role_full;\\\"]\"\r\n      db_name:                           \"rds-staging\"\r\n      default_ttl:                       \"36000\"\r\n      max_ttl:                           \"86400\"\r\n      name:                              \"rds-staging\"\r\n\r\n\r\nPlan: 2 to add, 0 to change, 0 to destroy.\r\n\r\nDo you want to perform these actions?\r\n  Terraform will perform the actions described above.\r\n  Only 'yes' will be accepted to approve.\r\n\r\n  Enter a value: yes\r\n\r\nvault_database_secret_backend_connection.rds: Creating...\r\n  allowed_roles.#:                   \"\" => \"1\"\r\n  allowed_roles.0:                   \"\" => \"rds-staging\"\r\n  backend:                           \"\" => \"database\"\r\n  name:                              \"\" => \"rds-staging\"\r\n  postgresql.#:                      \"\" => \"1\"\r\n  postgresql.0.connection_url:       \"\" => \"postgresql://user:superstrongpassword@health-staging.blah.us-east-1.rds.amazonaws.com:5432/databasename\"\r\n  postgresql.0.max_open_connections: \"\" => \"2\"\r\n  verify_connection:                 \"\" => \"true\"\r\nvault_database_secret_backend_connection.rds: Creation complete after 0s (ID: database/config/rds-staging)\r\nvault_database_secret_backend_role.rds: Creating...\r\n  backend:               \"\" => \"database\"\r\n  db_name:               \"\" => \"rds-staging\"\r\n  default_ttl:           \"\" => \"36000\"\r\n  max_ttl:               \"\" => \"86400\"\r\n  name:                  \"\" => \"rds-staging\"\r\n```\r\n\r\nRun it again immediately:\r\n\r\n```\r\n$ terraform apply -target=vault_database_secret_backend_connection.rds -target=vault_database_secret_backend_role.rds\r\ndata.terraform_remote_state.staging_vpc: Refreshing state...\r\ndata.vault_generic_secret.rds_user: Refreshing state...\r\ndata.vault_generic_secret.rds_password: Refreshing state...\r\ndata.vault_generic_secret.rds_dbname: Refreshing state...\r\naws_db_parameter_group.default: Refreshing state... (ID: health-staging)\r\naws_db_subnet_group.default: Refreshing state... (ID: health-staging)\r\naws_db_instance.default: Refreshing state... (ID: health-staging)\r\nvault_database_secret_backend_connection.rds: Refreshing state... (ID: database/config/rds-staging)\r\nvault_database_secret_backend_role.rds: Refreshing state... (ID: database/roles/rds-staging)\r\n\r\nAn execution plan has been generated and is shown below.\r\nResource actions are indicated with the following symbols:\r\n  ~ update in-place\r\n\r\nTerraform will perform the following actions:\r\n\r\n  ~ vault_database_secret_backend_connection.rds\r\n      postgresql.0.connection_url: \"postgresql://user:*****@health-staging.blah.us-east-1.rds.amazonaws.com:5432/databasename\" => \"postgresql://user:superstrongpassword@health-staging.blah.us-east-1.rds.amazonaws.com:5432/databasename\"\r\n\r\n\r\nPlan: 0 to add, 1 to change, 0 to destroy.\r\n\r\nDo you want to perform these actions?\r\n  Terraform will perform the actions described above.\r\n  Only 'yes' will be accepted to approve.\r\n\r\n  Enter a value: yes\r\n\r\nvault_database_secret_backend_connection.rds: Modifying... (ID: database/config/rds-staging)\r\n  postgresql.0.connection_url: \"postgresql://user:*****@health-staging.blah.us-east-1.rds.amazonaws.com:5432/databasename\" => \"postgresql://user:superstrongpassword@health-staging.blah.us-east-1.rds.amazonaws.com:5432/databasename\"\r\n\r\nError: Error applying plan:\r\n\r\n1 error(s) occurred:\r\n\r\n* vault_database_secret_backend_connection.rds: 1 error(s) occurred:\r\n\r\n* vault_database_secret_backend_connection.rds: unexpected EOF\r\n\r\nTerraform does not automatically rollback in the face of errors.\r\nInstead, your Terraform state file has been partially updated with\r\nany resources that successfully completed. Please address the error\r\nabove and apply again to incrementally change your infrastructure.\r\n\r\n```"}}
{"actor":{"display_login":"myoung34"}}