Unwanted deletion of aws_security_group_rule on second apply/plan

[obourdon]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform Version

0.11(.14) and 0.12(.23)

Terraform provider version

2.52.0

Affected Resource(s)

• aws_security_group_rule

Terraform Configuration Files

See this repository for easy reproduction

Expected Behavior

Has nothing changed, plan should say so in its output

Actual Behavior

Removal of aws_security_group_rule

Steps to Reproduce

see README.md in repository mentioned above

[obourdon]

Might very well be linked/duplicate of #11059

[mattburgess]

I think this is expected behaviour given the comments at the top of https://www.terraform.io/docs/providers/aws/r/security_group.html - you mix an SG with in-line rules (https://github.com/obourdon/terraform-bug-12356/blob/master/0.12/lb.tf#L14-L50) with an SG rule (https://github.com/obourdon/terraform-bug-12356/blob/master/0.12/netdata.tf#L41-L51).

You need to either put all rules as in-line, or all rules as separate aws_security_group_rule resources otherwise TF won't know which ones you actually want. I personally having "bare" aws_security_group resources, and explicitly defining rules via aws_security_group_rule resources.

[obourdon]

@mattburgess thanks for this explanation. Indeed this makes a lot of sense and I should read documentation more carefully.
Please also note that I found a workaround for this issue by adding a second, conditional security_group with in-line rules (an not security_group_rule resource) which I then attached to the aws_lb security_groups parameter list using concat

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thanks!