aws_network_acl with icmp rule always recreates network acl

[slshen]

A rule like:

egress {
    rule_no = "100"
    protocol = "icmp"
    from_port = -1
    to_port = -1
    icmp_type = -1
    icmp_code = -1
    cidr_block = "0.0.0.0/0"
    action = "allow"
}

Creates an icmp any rule, but terraform always thinks it's different. plan says:

egress.2826807916.action:     "allow" => ""
egress.2826807916.cidr_block: "0.0.0.0/0" => ""
egress.2826807916.from_port:  "0" => "0"
egress.2826807916.icmp_code:  "-1" => "0"
egress.2826807916.icmp_type:  "-1" => "0"
egress.2826807916.protocol:   "1" => ""
egress.2826807916.rule_no:    "100" => "0"
egress.2826807916.to_port:    "0" => "0"

Changing the egress rule so that from_port = 0 and to_port = 0 eliminates the diff.

[felnne]

Just been bitten by this too - glad i'm not going mad!

[nekinie]

Also seeing this issue

[fazy]

Confirmed here too, terraform 0.6.11.

Affects VPC network ACLs (aws_network_acl) and security groups (aws_security_group).

[ericwestfall]

Confirmed this impacts version 0.6.12; the issue does not occur if you describe the ICMP rule as a standalone aws_network_acl_rule resource rather than defining the rule inline with the ACL.

This is broken:

resource "aws_network_acl" "test" {
  vpc_id = "${aws_vpc.main.id}"
  tags {
    Name = "test-acl"
  }

  # Authorize all inbound traffic.
  ingress {
    protocol = "icmp"
    rule_no = 100
    action = "allow"
    cidr_block = "0.0.0.0/0"
    from_port = -1
    to_port = -1
    icmp_type = -1
    icmp_code = -1
  }

  # Authorize all outbound traffic.
  egress = {
    protocol = "icmp"
    rule_no = 100
    action = "allow"
    cidr_block = "0.0.0.0/0"
    from_port = -1
    to_port = -1
    icmp_type = -1
    icmp_code = -1
  }
}

This works just fine:

resource "aws_network_acl" "test" {
  vpc_id = "${aws_vpc.main.id}"
  tags {
    Name = "test-acl"
  }
}

resource "aws_network_acl_rule" "allow_ingress_icmp_test" {
    network_acl_id = "${aws_network_acl.test.id}"
    rule_number = 100
    egress = false
    protocol = "icmp"
    rule_action = "allow"
    cidr_block = "0.0.0.0/0"
    from_port = -1
    to_port = -1
    icmp_type = -1
    icmp_code = -1
}

resource "aws_network_acl_rule" "allow_egress_icmp_test" {
    network_acl_id = "${aws_network_acl.test.id}"
    rule_number = 100
    egress = true
    protocol = "icmp"
    rule_action = "allow"
    cidr_block = "0.0.0.0/0"
    from_port = -1
    to_port = -1
    icmp_type = -1
    icmp_code = -1
}

[fazy]

I've had a go at fixing this in PR #5602 - it's a bit hacky, basically I changed the code that computes the hash of the rule properties to set from/to port to always be counted as zero for ICMP rules.

Any feedback/testing appreciated...

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.