skip to Main Content

I’m trying to create VPC Peering between two VPCs in two different accounts. One is managed by me and another one by others and I don’t have access to it.
I’m using the next snippet of Terraform script.

resource "aws_vpc_peering_connection" "a" {
  peer_owner_id = var.a.aws_account_id
  peer_vpc_id   = var.a.vpc_id
  vpc_id        = aws_vpc.main.id
  peer_region   = "eu-west-1"

  requester {
    allow_remote_vpc_dns_resolution = false
  }
}

Next, it is going to be manually accepted by those who manage that account.
The problem is whether Peering is accepted or not Terraform wants to replace that Peering connection:

  # module.vpc.aws_vpc_peering_connection.a is tainted, so must be replaced
-/+ resource "aws_vpc_peering_connection" "a" {
      ~ accept_status = "active" -> (known after apply)
      ~ id            = "pcx-00000000000000000" -> (known after apply)
        # (5 unchanged attributes hidden)

      + accepter {
          + allow_classic_link_to_remote_vpc = (known after apply)
          + allow_remote_vpc_dns_resolution  = (known after apply)
          + allow_vpc_to_remote_classic_link = (known after apply)
        }

        # (1 unchanged block hidden)
    }

I have already tried to prevent the replacement by using lifecycle

  lifecycle {
    ignore_changes = all
  }

But it doesn’t help…

2

Answers


  1. Try to untaint the resource e.g.

    terraform untaint aws_vpc_peering_connection.a
    
    Login or Signup to reply.
  2. By using the aws_vpc_peering_connection_options resource instead of specifying options in the aws_vpc_peering_connection requester, I was able to avoid recreation of the connection itself when Terraform noticed that the allow_remote_vpc_dns_resolution option had changed.

    https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc_peering_connection_options

    Setting the option will still fail before the peering connection has been accepted by the other side, but once you have accepted the connection on the other account, only the options will be tainted, not the whole connection.

    Login or Signup to reply.
Please signup or login to give your own answer.
Back To Top
Search