AWS Provider >=3.0.0 ASG inline load_balancers removing attached load balancers

[andrew-womeldorf]

Since the AWS Provider's update to v3.0.0, the relationship between an aws_autoscaling_group and aws_autoscaling_attachment has become more strictly conflicted. Since the vault-cluster module does not define a load balancer, and a load balancer must be attached by an autoscaling attachment from outside the vault-cluster module, the autoscaling groups should ignore changes to the load_balancers and target_group_arns.

In my case, despite the vault-elb module defining the autoscaling attachment, the AWS provider is trying to remove the relationship in favor of the empty inline load_balancers argument. There is a similar issue in the terraform-aws-consul module.

This conflict is documented in the AWS Provider's documentation here, and there is an open issue on the AWS Provider repo.

[brikis98]

This conflict is documented in the AWS Provider's documentation here, and there is an open issue on the AWS Provider repo.

So is this actually a bug we should wait to be fixed? And perhaps pin to AWS Provider < 3.x until it is fixed?

[andrew-womeldorf]

The issue I linked is only a week old, so it may be too soon to tell if it's planned on being fixed.

My personal impression is that this is not going to be fixed soon. This was already a documented issue in 2.x. It seems that the inline load_balancers/target_group_arns weren't actively overriding the aws_autoscaling_attachment resource in 2.x like they are now.

[andrew-womeldorf]

One more thought in favor of not waiting to see if this is a bug that will be fixed -

This module does not declare any target groups or load balancers for itself - those must be provided by the user with the attachment resources. Unless there are plans to add such resources into this module, I think it's a safe assumption that we will always want to favor the attachment resources, and thus ignoring the inline arguments here is a safe, long-term change.

[teraflik]

This conflict is documented in the AWS Provider's documentation here, and there is an open issue on the AWS Provider repo.

So is this actually a bug we should wait to be fixed? And perhaps pin to AWS Provider < 3.x until it is fixed?

@brikis98 this is not a bug, it is an intended behaviour when using AWS Provider ~ 3.x.

As the documentation mentions everywhere, using same of the inline resource and exclusive resource "causes conflicts" or "unintended resource updates".

I can't comment why it didn't cause problems in AWS provider ~ 2.x, but with provider ~ 3.x, it's working as it should (by causing problems.)

As @andrew-womeldorf said, its a safe assumption that an ASG will either be used with a target group or a load balancer, for example in the vault-elb module.

[brikis98]

Roger. Hopefully we can get #211 merged soon to fix this.