aws_network_acl_rule with protocol "-1" always forces resource to be recreated

[SergK]

Terraform Version

Terraform v0.9.1

Affected Resource(s)

• aws_network_acl_rule

Terraform Configuration Files

resource "aws_network_acl" "network_acl" {
  vpc_id     = "${aws_vpc.CI-Infra-VPC.id}"
  subnet_ids = ["${aws_subnet.public_net.id}", "${aws_subnet.private_net.id}"]

  tags {
    terraform = "true"
    project   = "${var.project_name}"
  }
}

resource "aws_network_acl_rule" "net_acl_rule_ingress" {
  network_acl_id = "${aws_network_acl.network_acl.id}"
  cidr_block     = "0.0.0.0/0"
  protocol       = "-1"
  rule_number    = "100"
  rule_action    = "allow"
}

resource "aws_network_acl_rule" "net_acl_rule_egress" {
  network_acl_id = "${aws_network_acl.network_acl.id}"
  cidr_block     = "0.0.0.0/0"
  protocol       = "-1"
  rule_number    = "100"
  rule_action    = "allow"
  egress         = "true"
}

Debug Output

terraform plan -out=plan.out -detailed-exitcode

-/+ aws_network_acl_rule.net_acl_rule_egress
    cidr_block:     "0.0.0.0/0" => "0.0.0.0/0"
    egress:         "true" => "true"
    network_acl_id: "acl-xxxxxxx" => "acl-xxxxxxx"
    protocol:       "all" => "-1" (forces new resource)
    rule_action:    "allow" => "allow"
    rule_number:    "100" => "100"

-/+ aws_network_acl_rule.net_acl_rule_ingress
    cidr_block:     "0.0.0.0/0" => "0.0.0.0/0"
    egress:         "false" => "false"
    network_acl_id: "acl-xxxxxxx" => "acl-xxxxxxx"
    protocol:       "all" => "-1" (forces new resource)
    rule_action:    "allow" => "allow"
    rule_number:    "100" => "100"

Expected Behavior

No changes. Infrastructure is up-to-date.

Actual Behavior

We always re-create resource

$ terraform apply plan.out 

aws_network_acl_rule.net_acl_rule_ingress: Destroying... (ID: nacl-xxxxxxxxx)
aws_network_acl_rule.net_acl_rule_egress: Destroying... (ID: nacl-xxxxxxxxx)
aws_network_acl_rule.net_acl_rule_egress: Destruction complete
aws_network_acl_rule.net_acl_rule_ingress: Destruction complete
aws_network_acl_rule.net_acl_rule_egress: Creating...
  cidr_block:     "" => "0.0.0.0/0"
  egress:         "" => "true"
  network_acl_id: "" => "acl-xxxxxxxxx"
  protocol:       "" => "-1"
  rule_action:    "" => "allow"
  rule_number:    "" => "100"
aws_network_acl_rule.net_acl_rule_ingress: Creating...
  cidr_block:     "" => "0.0.0.0/0"
  egress:         "" => "false"
  network_acl_id: "" => "acl-xxxxxxxxx"
  protocol:       "" => "-1"
  rule_action:    "" => "allow"
  rule_number:    "" => "100"
aws_network_acl_rule.net_acl_rule_egress: Creation complete (ID: nacl-xxxxxxxxx)
aws_network_acl_rule.net_acl_rule_ingress: Creation complete (ID: nacl-xxxxxxxxx)

Steps to Reproduce

terraform apply plan.out

Actually the issue is solved when setting protocol to all

...
protocol       = "all"
...

This should be reflected in documentation

protocol - (Required) The protocol. A value of -1 means all protocols.

[stack72]

Hi @SergK

I have been able to recreate this right now - I am going to get a fix in place

Paul

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.