2

I am getting

~ update in-place

Terraform will perform the following actions:

~ aws_security_group.mayanks-sg revoke_rules_on_delete: "" => "false"

while running terraform plan and I have no idea what it means and why it is coming searched it on google but no luck.

tf file :-

resource "aws_security_group" "mayanks-sg" {
    name = "mayanks-sg"
    description = "for test purpose"
    vpc_id = ""
}
resource "aws_security_group_rule" "mayanks-sg" {
    type = "ingress"
    security_group_id = "sg-xxxxxxxxx"
    from_port = 12345
    to_port   = 12345
    protocol  = "tcp"
    cidr_blocks = ["x.x.x.x"]
}

resource "aws_security_group_rule" "mayanks-sg-1" {
    type = "ingress"
    security_group_id = "sg-xxxxxxxxx"
    from_port = 54321
    to_port   = 54321
    protocol  = "tcp"
    cidr_blocks = ["x.x.x.x"]
}

tfstate :-

{
"version": 3,
"terraform_version": "0.11.7",
"serial": 1,
"lineage": "x-x-x-x-x",
"modules": [
    {
        "path": [
            "root"
        ],
        "outputs": {},
        "resources": {
            "aws_security_group.mayanks-sg": {
                "type": "aws_security_group",
                "depends_on": [],
                "primary": {
                    "id": "sg-xxxxxxxxx",
                    "attributes": {
                        "arn": "arn:aws:ec2:x:x:security-group/sg-xxxxxxxxx",
                        "description": "for test purpose",
                        "egress.#": "0",
                        "id": "sg-xxxxxxxxx",
                        "ingress.#": "2",
                        "ingress.1364877358.cidr_blocks.#": "1",
                        "ingress.1364877358.cidr_blocks.0": "x.x.x.x",
                        "ingress.1364877358.description": "",
                        "ingress.1364877358.from_port": "12345",
                        "ingress.1364877358.ipv6_cidr_blocks.#": "0",
                        "ingress.1364877358.protocol": "tcp",
                        "ingress.1364877358.security_groups.#": "0",
                        "ingress.1364877358.self": "false",
                        "ingress.1364877358.to_port": "12345",
                        "ingress.2197545509.cidr_blocks.#": "1",
                        "ingress.2197545509.cidr_blocks.0": "x.x.x.x",
                        "ingress.2197545509.description": "",
                        "ingress.2197545509.from_port": "54321",
                        "ingress.2197545509.ipv6_cidr_blocks.#": "0",
                        "ingress.2197545509.protocol": "tcp",
                        "ingress.2197545509.security_groups.#": "0",
                        "ingress.2197545509.self": "false",
                        "ingress.2197545509.to_port": "54321",
                        "name": "mayanks-sg",
                        "owner_id": "xxxxxxx",
                        "tags.%": "0",
                        "vpc_id": ""
                    },
                    "meta": {
                        "x-x-x-x-x-x": {
                            "create": 600000000000,
                            "delete": 600000000000
                        },
                        "schema_version": "1"
                    },
                    "tainted": false
                },
                "deposed": [],
                "provider": "provider.aws"
            },
            "aws_security_group_rule.mayanks-sg": {
                "type": "aws_security_group_rule",
                "depends_on": [],
                "primary": {
                    "id": "sgrule-xxxxxx",
                    "attributes": {
                        "cidr_blocks.#": "1",
                        "cidr_blocks.0": "x.x.x.x",
                        "description": "",
                        "from_port": "12345",
                        "id": "sgrule-xxxxxx",
                        "ipv6_cidr_blocks.#": "0",
                        "prefix_list_ids.#": "0",
                        "protocol": "tcp",
                        "security_group_id": "sg-xxxxxxxxxx",
                        "self": "false",
                        "to_port": "12345",
                        "type": "ingress"
                    },
                    "meta": {
                        "schema_version": "2"
                    },
                    "tainted": false
                },
                "deposed": [],
                "provider": "provider.aws"
            },
            "aws_security_group_rule.mayanks-sg-1": {
                "type": "aws_security_group_rule",
                "depends_on": [],
                "primary": {
                    "id": "sgrule-xxxxxx",
                    "attributes": {
                        "cidr_blocks.#": "1",
                        "cidr_blocks.0": "x.x.x.x",
                        "description": "",
                        "from_port": "54321",
                        "id": "sgrule-xxxxx",
                        "ipv6_cidr_blocks.#": "0",
                        "prefix_list_ids.#": "0",
                        "protocol": "tcp",
                        "security_group_id": "sg-xxxxxxxxxxx",
                        "self": "false",
                        "to_port": "54321",
                        "type": "ingress"
                    },
                    "meta": {
                        "schema_version": "2"
                    },
                    "tainted": false
                },
                "deposed": [],
                "provider": "provider.aws"
            }
        },
        "depends_on": []
    }
]
}

I want to remove this error from in the by adding something in the configuration file and also whats the meaning of this parameter. Thanks in advance

Mayank Singh
  • 131
  • 4
  • 9

3 Answers3

3

This is not an error message. If you want to remove it, apply your template. It's stating that if you ran the template it would update the parameter for that security group. revoke_rules_on_delete is currently set to blank. Terraform defaults it to false.

revoke_rules_on_delete - (Optional) Instruct Terraform to revoke all of the Security Groups attached ingress and egress rules before deleting the rule itself. This is normally not needed, however certain AWS services such as Elastic Map Reduce may automatically add required rules to security groups used with the service, and those rules may contain a cyclic dependency that prevent the security groups from being destroyed without removing the dependency first. Default false

Bottom line, if you want this to be true set it in your aws_security_group resource and apply your playbook. If you want it to be false, apply your playbook.

https://www.terraform.io/docs/providers/aws/r/security_group.html

kenlukas
  • 3,616
  • 9
  • 25
  • 36
  • Thanks @kenlukas well explained. I have a doubt here I have encountered this for the first time and this warning I have not seen before when I am making configuration file actually I don't want to do terraform apply because I am importing an existing infra. and I just want that my tf file matches tfstate file. So any idea to remove this warning when I do plan beacuse I have added this parameter in aws_security_group and still it is showing the same for me. – Mayank Singh Sep 26 '18 at 06:24
  • Facing the same issue. Tried to assign `revoke_rules_on_delete` with "" (value in state file as per the TF plan). Still getting the same issue. – Vinni Sep 22 '22 at 02:16
0

For anyone faced to this issue and wondering how to fix it.

Following the three steps, you can perform the terraform apply with minimal risk.

  1. You can create a restricted AWS User with S3 full access and VPC read only permission.
  2. Make sure you use the restricted AWS User to perform terraform apply
  3. Done

By doing so, you can see the terraform fix the state file and you don't have to worry about the terraform will modify any unexpected resource.

willisc
  • 507
  • 4
  • 22
0

You can add "revoke_rules_on_delete": "false" in your terraform state file manually in SG section, and this message will go away.

Ashish chugh
  • 71
  • 1
  • 6