Faulty Read of Client VPN Network associations break state

[fgrelak]

In aws/resource_aws_ec2_client_vpn_network_association.go line 112 commit/acc6a21a3bd6159f4f8c10a86bcd08e70edce4f2
d.Set("subnet_id", result.ClientVpnTargetNetworks[0].TargetNetworkId)
leads to wrong subnet-ids if more than one Subnet is associated with the VPN Endpoint (as only the first entry of the map is read. Minimal example breaking the state:

resource "aws_ec2_client_vpn_network_association" "subnet-cvpn-associations" {
  for_each               = toset(var.subnets)
  client_vpn_endpoint_id = aws_ec2_client_vpn_endpoint.main-cvpn-endpoint.id
  subnet_id              = each.value
}

variable "subnets" {
  default = [
    "subnet-123",
    "subnet-456",
  ]
}

will lead to replacement on every terraform plan.

This may have teh reason that the API call here result, err := conn.DescribeClientVpnTargetNetworks(&ec2.DescribeClientVpnTargetNetworksInput{
ClientVpnEndpointId: aws.String(d.Get("client_vpn_endpoint_id").(string)),
AssociationIds: []*string{aws.String(d.Id())},
actually does NOT return a list with only one entry, but all associations. One can test this by making this call with a wrong AssociationId.

[nijave]

This appears to be an Amazon API bug

doesn't work

'body': {
  'Action': 'DescribeClientVpnTargetNetworks',
  'Version': '2016-11-15',
  'ClientVpnEndpointId': 'cvpn-endpoint-123',
  'AssociationIds.1': 'cvpn-assoc-123'
}

works

'body': {
  'Action': 'DescribeClientVpnTargetNetworks', 
  'Version': '2016-11-15',
  'ClientVpnEndpointId': 'cvpn-endpoint-123', 
  'Filter.1.Name': 'association-id', 
  'Filter.1.Value.1': 'cvpn-assoc-123'
}

[cosmin-oprea]

I wonder when the pull request will be approved.
It's holding up my deployment in AWS as I make heavily use of this module and really don't like to start adding vpn client endpoint associations manually.

[breathingdust]

Hi all! 👋 Just wanted to direct you to our public roadmap for this quarter (Nov-Jan) in which this item has been mentioned.

Due to the significant community interest in resolving this issue, we will be looking at merging existing contributions soon.

We appreciate all the contributions and feedback thus far.

[bill-rich]

The ability to use AssociationIds was fixed earlier this year. Rather than switching to using filters, I've left the original method, but added the acceptance test from #14380.

[ghost]

This has been released in version 3.33.0 of the Terraform AWS provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template for triage. Thanks!

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thanks!