Question 18197 in Amazon Web Sevices Question posted in
The official Amazon Web Services documentation can be found here.

Applying Terraform aws_security_group_rule on existing security group not working – Amazon Web Sevices

I have a cloud infrastructure created using Terraform. Due to a cyclic dependency issue with two security groups referring to each other (Terraform circular dependency between security groups) , I tried defining a aws_security_group_rule for the ingress rules. The error disappeared and Terraform completed execution.

However, I found out that the group rule is only applied correctly whenever the security group in question does not exist yet. When it already exists, Terraform cannot seem to update it. Is there something that can be done to resolve this apart from recreating the resources which really goes against the principle of using Terraform?

See below the code

resource "aws_security_group_rule" "apix_to_apiy_rule" {
  type              = "ingress"
  from_port         = 8080
  to_port           = 8080
  protocol          = "tcp"
  security_group_id = "xxxx"
  source_security_group_id = "xxxx"
}

resource "aws_security_group" "xxxx" {...}

Note: Group ID values are just examples.

Tags:

2

Answers


  1. 0

    If the rule already exists and not managed by Terraform, Terraform cannot update it. This is expected behavior for any resources.

    If the rule was created by Terraform, it should be able to detect changes and update it.

    Login or Signup to reply.
  2. 0

    To be able to modify existing SG using TF, you have to first import into TF. Only then you will be able use aws_security_group.xxxx resource to manage it.

    Alternatively, just use aws_security_group_rule.apix_to_apiy_rule, and specify the id of the group through input variable to the template or the aws_security_group data source in:

    source_security_group_id = "<id-of-sg>"

    Login or Signup to reply.
Please signup or login to give your own answer.

Back To Top
Search