Terraform plan reports change when there is no change to apply

[sarahhodne]

We have something like this in a Terraform file:

resource "aws_vpn_gateway" "vgw" {
  vpc_id = "${aws_vpc.main.id}"
  tags {
    Name = "vpn-gateway"
  }
}

Every time we run terraform plan, we get a plan that looks like this:

~ aws_vpn_gateway.vgw
    availability_zone: "us-east-1b" => ""

Applying doesn’t actually change anything, but we keep getting that plan. If I add availability_zone = "us-east-1b" to the Terraform file, this step of the plan goes away.

Looks like the differ doesn’t take into account that the availability zone isn’t set in the Terraform file?

[catsby]

Hey @henrikhodne – what eversion of Terraform are you using? I can't seem to reproduce this on either the latest v0.4.2 or the current master branch. If you're not on v0.4.2, can you try updating?

[catsby]

Hey @henrikhodne – what eversion of Terraform are you using? I can't seem to reproduce this on either the latest v0.4.2 or the current master branch. If you're not on v0.4.2, can you try updating?

[sarahhodne]

I was on 0.4.1, but I can reproduce this on 0.4.2 as well.

[sarahhodne]

I was on 0.4.1, but I can reproduce this on 0.4.2 as well.

[catsby]

Interesting, I'll take another look...

[catsby]

Interesting, I'll take another look...

[catsby]

I've managed to reproduce this on v0.4.2, but still can't on master, so I suspect this is "resolved" in the upcoming release

[catsby]

I've managed to reproduce this on v0.4.2, but still can't on master, so I suspect this is "resolved" in the upcoming release

[catsby]

I may be totally off but it seems that on line 91 of vpn_gateway.go, vpnGateway.AvailabilityZone has a value when I use us-east-1 (like yourself), but is nil/empty when I use us-west-2 or eu-west-1 region 😦

[catsby]

I may be totally off but it seems that on line 91 of vpn_gateway.go, vpnGateway.AvailabilityZone has a value when I use us-east-1 (like yourself), but is nil/empty when I use us-west-2 or eu-west-1 region 😦

[catsby]

@henrikhodne can you tell if the availability zone is even actually important here? The API docs list it, but for regions beyond EAST I'm not seeing it even returned, even with the AWS CLI tool:

$ aws ec2 describe-vpn-gateways --vpn-gateway-ids vgw-eb6cb0f5
--------------------------------------------
|            DescribeVpnGateways           |
+------------------------------------------+
||               VpnGateways              ||
|+-----------+-----------+----------------+|
||   State   |   Type    | VpnGatewayId   ||
|+-----------+-----------+----------------+|
||  available|  ipsec.1  |  vgw-eb6cb0f5  ||
|+-----------+-----------+----------------+|
|||                 Tags                 |||
||+------------+-------------------------+||
|||     Key    |          Value          |||
||+------------+-------------------------+||
|||  Name      |  vpn-gateway            |||
||+------------+-------------------------+||
|||            VpcAttachments            |||
||+---------------+----------------------+||
|||     State     |        VpcId         |||
||+---------------+----------------------+||
|||  attached     |  vpc-74901611        |||
||+---------------+----------------------+||

$ aws ec2 describe-vpn-gateways --vpn-gateway-ids vgw-eb6cb0f5 --output=json
{
    "VpnGateways": [
        {
            "State": "available",
            "Tags": [
                {
                    "Value": "vpn-gateway",
                    "Key": "Name"
                }
            ],
            "Type": "ipsec.1",
            "VpnGatewayId": "vgw-eb6cb0f5",
            "VpcAttachments": [
                {
                    "State": "attached",
                    "VpcId": "vpc-74901611"
                }
            ]
        }
    ]
}

For an EAST vgw:

$ AWS_DEFAULT_REGION=us-east-1 aws ec2 describe-vpn-gateways --vpn-gateway-ids vgw-8f8865e6 --output=json
{
    "VpnGateways": [
        {
            "AvailabilityZone": "us-east-1d",
            "Tags": [
                {
                    "Value": "vpn-gateway",
                    "Key": "Name"
                }
            ],
            "VpcAttachments": [
                {
                    "State": "attached",
                    "VpcId": "vpc-564d6033"
                }
            ],
            "State": "available",
            "VpnGatewayId": "vgw-8f8865e6",
            "Type": "ipsec.1"
        }
    ]
}

[catsby]

@henrikhodne can you tell if the availability zone is even actually important here? The API docs list it, but for regions beyond EAST I'm not seeing it even returned, even with the AWS CLI tool:

$ aws ec2 describe-vpn-gateways --vpn-gateway-ids vgw-eb6cb0f5
--------------------------------------------
|            DescribeVpnGateways           |
+------------------------------------------+
||               VpnGateways              ||
|+-----------+-----------+----------------+|
||   State   |   Type    | VpnGatewayId   ||
|+-----------+-----------+----------------+|
||  available|  ipsec.1  |  vgw-eb6cb0f5  ||
|+-----------+-----------+----------------+|
|||                 Tags                 |||
||+------------+-------------------------+||
|||     Key    |          Value          |||
||+------------+-------------------------+||
|||  Name      |  vpn-gateway            |||
||+------------+-------------------------+||
|||            VpcAttachments            |||
||+---------------+----------------------+||
|||     State     |        VpcId         |||
||+---------------+----------------------+||
|||  attached     |  vpc-74901611        |||
||+---------------+----------------------+||

$ aws ec2 describe-vpn-gateways --vpn-gateway-ids vgw-eb6cb0f5 --output=json
{
    "VpnGateways": [
        {
            "State": "available",
            "Tags": [
                {
                    "Value": "vpn-gateway",
                    "Key": "Name"
                }
            ],
            "Type": "ipsec.1",
            "VpnGatewayId": "vgw-eb6cb0f5",
            "VpcAttachments": [
                {
                    "State": "attached",
                    "VpcId": "vpc-74901611"
                }
            ]
        }
    ]
}

For an EAST vgw:

$ AWS_DEFAULT_REGION=us-east-1 aws ec2 describe-vpn-gateways --vpn-gateway-ids vgw-8f8865e6 --output=json
{
    "VpnGateways": [
        {
            "AvailabilityZone": "us-east-1d",
            "Tags": [
                {
                    "Value": "vpn-gateway",
                    "Key": "Name"
                }
            ],
            "VpcAttachments": [
                {
                    "State": "attached",
                    "VpcId": "vpc-564d6033"
                }
            ],
            "State": "available",
            "VpnGatewayId": "vgw-8f8865e6",
            "Type": "ipsec.1"
        }
    ]
}

[mitchellh]

Closing due to lack of response, can't fix without it. Feel free to open a new issue with the data and we'll look back at it. Thanks!

[mitchellh]

Closing due to lack of response, can't fix without it. Feel free to open a new issue with the data and we'll look back at it. Thanks!