aws_vpn_gateway and aws_vpn_gateway_attachment incorrectly refreshing attachment state

[ewbankkit]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

The vpnGatewayGetAttachment() function, used when refreshing VGW attachment state, does not correctly account for detaching or attaching states: https://github.com/terraform-providers/terraform-provider-aws/blob/3471582595cb9cd20d20abe2ca7f7463499edf6a/aws/resource_aws_vpn_gateway.go#L333-L340

This only starts to manifest as a problem when the VGW has been attached to a Direct Connect gateway as the VGW attachment state will remain detaching for minutes. This has become evident in recent work with Direct Connect gateway attachments - #8222 (review) and #8455 (comment).
In other cases the attachment state moves from attached to detached effectively immediately, which is why none of the current acceptance tests have caused problems.

[ewbankkit]

The solution is to pass the VPC ID to vpnGatewayGetAttachment() and really return the attachment for the specified VPC. Return the sentinel only when no attachment can be found for the specified VPC.

[ewbankkit]

Actually I'm going to split into two functions:

• vpnGatewayGetAttachmentState which will take a VPC ID and return the state of that attachment
• vpnGatewayGetAttachment which will return details of any attachment in attached state (as now) or nil

[bflad]

The fix for this has been merged and will release with version 2.11.0 of the Terraform AWS Provider, likely later this week.

[bflad]

This has been released in version 2.11.0 of the Terraform AWS provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thanks!