aws_network_interface can't find securitygroupID.

[hashibot]

This issue was originally opened by @TheM0ng00se as hashicorp/terraform#3372. It was migrated here as part of the provider split. The original body of the issue is below.

---

In Terraform 0.6.3 I'm noticing that attaching a security group to an ENI isn't working as expected.

I've tried both with {$aws_security_group.csr_sg_inside.name} AND {$aws_security_group.csr_sg_inside.id} and both throw the error.

Error applying plan:

2 error(s) occurred:

* aws_network_interface.csr_inside.0: Error creating ENI: InvalidSecurityGroupID.NotFound: The securityGroup ID '{$aws_security_group.csr_sg_inside.name}' does not exist
    status code: 400, request id: []
* aws_network_interface.csr_inside.1: Error creating ENI: InvalidSecurityGroupID.NotFound: The securityGroup ID '{$aws_security_group.csr_sg_inside.name}' does not exist
    status code: 400, request id: []

Terraform does indeed create the security group and it exists. I had a brief look at the source...seems like I should be able to do this..

resource "aws_network_interface" "csr_inside" {
    count = "2"
    subnet_id = "${element(aws_subnet.tools.*.id, count.index)}"
    source_dest_check = "false"
    security_groups = [ "{$aws_security_group.csr_sg_inside.id}" ]
    attachment {
        instance = "${element(aws_instance.csr.*.id, count.index)}"
        device_index = "2"
    }
}

[hashibot]

This comment was originally opened by @mslayton-abra as hashicorp/terraform#3372 (comment). It was migrated here as part of the provider split. The original comment is below.

---

This problem also cropped up for me. Same scenario. Same error.
Also tried upgrading to terraform-0.7.11 with the same result.

[radeksimko]

Hi folks,
sorry for the confusion here.

The correct interpolation syntax has dollar sign $ before brackets, not inside. See https://www.terraform.io/docs/configuration/interpolation.html for more details.

I was able to apply your config with a small tweak (replaced {$aws_security_group.csr_sg_inside.id} with ${aws_security_group.csr_sg_inside.id}).

I first thought we could provide an error in such case, but then {$...} could be a valid value in some other contexts, so we can't really perform such generic validation and field-specific validation would provide you pretty much the same error message as you get from the API above.

With that I believe there's nothing to fix, so I'm going to close this issue. Let me know if anything's unclear or if you keep having issues.

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thanks!