Fix aws dx gateway association proposal #19741

dkujawski · 2021-06-09T22:20:23Z

Community Note

Please vote on this pull request by adding a 👍 reaction to the original pull request comment to help the community and maintainers prioritize this request
Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for pull request followers and do not help prioritize the request

Output from acceptance testing:

$> make testacc TESTARGS='\-run=TestAccAwsDxGatewayAssociationProposal_endOfLife'
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./aws -v -count 1 -parallel 20 \-run=TestAccAwsDxGatewayAssociationProposal_endOfLife -timeout 180m
=== RUN   TestAccAwsDxGatewayAssociationProposal_endOfLife
=== PAUSE TestAccAwsDxGatewayAssociationProposal_endOfLife
=== CONT  TestAccAwsDxGatewayAssociationProposal_endOfLife
--- PASS: TestAccAwsDxGatewayAssociationProposal_endOfLife (1941.31s)
PASS
ok      github.com/terraform-providers/terraform-provider-aws/aws       1941.405s

Currently the aws_dx_gateway_association_proposal automatically gets deleted by AWS some time after the proposal is accepted by the dx gateway owner. Terraform sees this and wants to re-create the proposal, cascading into a proposal id change on the accepter.

The fix here is to:

In the resource Read function, if the proposal is not found by ID, check for the association existing and use the metadata from that as the current state
Create a customized Import function that allows passing the proposal ID, target gateway, and dx gateway. If the proposal ID doesn’t exist TF will still see it as existing based on the gateway IDs

Pros:

Proposal resource now shares a lifespan with the association resource as far as TF is concerned – this is basically the behavior that we’d expect if AWS wasn’t deleting the proposals
Can import “placeholder” proposals – useful for when you’re importing a cross-account DX gateway association that wasn’t created directly in TF
Pretty easy update

Cons:

The actual state of the proposal resource is now indeterminate, which seems like a pretty big departure from how TF is supposed to work, and probably the reason the existing PRs haven’t been merged
Resource may show pending updates but not be able to apply them

github-actions

Welcome @dkujawski 👋

It looks like this is your first Pull Request submission to the Terraform AWS Provider! If you haven’t already done so please make sure you have checked out our CONTRIBUTING guide and FAQ to make sure your contribution is adhering to best practice and has all the necessary elements in place for a successful approval.

Also take a look at our FAQ which details how we prioritize Pull Requests for inclusion.

Thanks again, and welcome to the community! 😃

ewbankkit · 2021-06-22T16:15:34Z

[#9209] Fix dx gateway association proposal so it works even if expired #12221

Once the proposal has been accepted and deleted, locate the association, populate the proposal state to prevent recreating the proposal unnecessarily.

…posal needs to be recreated.

…oposal

accept an import string composed of the proposal id, dx gateway id, and target associated gateway id when the proposal has been removed by AWS due to it being accepted.

move proposal existance logic out of custom diff function and over into the Read function. add more debug logs to track when proposal id values exist

…ociation_proposal acceptance tests.

…pers.

…port format.

…l ID is not blank.

…posal'.

ewbankkit

LGTM 🚀.

% make testacc TEST=./aws TESTARGS='-run=TestAccAwsDxGateway_'     
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./aws -v -count 1 -parallel 20 -run=TestAccAwsDxGateway_ -timeout 180m
=== RUN   TestAccAwsDxGateway_basic
=== PAUSE TestAccAwsDxGateway_basic
=== RUN   TestAccAwsDxGateway_disappears
=== PAUSE TestAccAwsDxGateway_disappears
=== RUN   TestAccAwsDxGateway_complex
=== PAUSE TestAccAwsDxGateway_complex
=== CONT  TestAccAwsDxGateway_basic
=== CONT  TestAccAwsDxGateway_complex
=== CONT  TestAccAwsDxGateway_disappears
--- PASS: TestAccAwsDxGateway_disappears (22.54s)
--- PASS: TestAccAwsDxGateway_basic (23.22s)
--- PASS: TestAccAwsDxGateway_complex (761.57s)
PASS
ok  	github.com/terraform-providers/terraform-provider-aws/aws	764.824s
% ACCTEST_PARALLELISM=2 make testacc TEST=./aws TESTARGS='-run=TestAccAwsDxGatewayAssociation_\|TestAccAwsDxGatewayAssociationProposal_'
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./aws -v -count 1 -parallel 2 -run=TestAccAwsDxGatewayAssociation_\|TestAccAwsDxGatewayAssociationProposal_ -timeout 180m
=== RUN   TestAccAwsDxGatewayAssociationProposal_basicVpnGateway
=== PAUSE TestAccAwsDxGatewayAssociationProposal_basicVpnGateway
=== RUN   TestAccAwsDxGatewayAssociationProposal_basicTransitGateway
=== PAUSE TestAccAwsDxGatewayAssociationProposal_basicTransitGateway
=== RUN   TestAccAwsDxGatewayAssociationProposal_disappears
=== PAUSE TestAccAwsDxGatewayAssociationProposal_disappears
=== RUN   TestAccAwsDxGatewayAssociationProposal_endOfLifeVpn
=== PAUSE TestAccAwsDxGatewayAssociationProposal_endOfLifeVpn
=== RUN   TestAccAwsDxGatewayAssociationProposal_endOfLifeTgw
=== PAUSE TestAccAwsDxGatewayAssociationProposal_endOfLifeTgw
=== RUN   TestAccAwsDxGatewayAssociationProposal_AllowedPrefixes
=== PAUSE TestAccAwsDxGatewayAssociationProposal_AllowedPrefixes
=== RUN   TestAccAwsDxGatewayAssociation_V0StateUpgrade
=== PAUSE TestAccAwsDxGatewayAssociation_V0StateUpgrade
=== RUN   TestAccAwsDxGatewayAssociation_basicVpnGatewaySingleAccount
=== PAUSE TestAccAwsDxGatewayAssociation_basicVpnGatewaySingleAccount
=== RUN   TestAccAwsDxGatewayAssociation_basicVpnGatewayCrossAccount
=== PAUSE TestAccAwsDxGatewayAssociation_basicVpnGatewayCrossAccount
=== RUN   TestAccAwsDxGatewayAssociation_basicTransitGatewaySingleAccount
=== PAUSE TestAccAwsDxGatewayAssociation_basicTransitGatewaySingleAccount
=== RUN   TestAccAwsDxGatewayAssociation_basicTransitGatewayCrossAccount
=== PAUSE TestAccAwsDxGatewayAssociation_basicTransitGatewayCrossAccount
=== RUN   TestAccAwsDxGatewayAssociation_multiVpnGatewaysSingleAccount
=== PAUSE TestAccAwsDxGatewayAssociation_multiVpnGatewaysSingleAccount
=== RUN   TestAccAwsDxGatewayAssociation_allowedPrefixesVpnGatewaySingleAccount
=== PAUSE TestAccAwsDxGatewayAssociation_allowedPrefixesVpnGatewaySingleAccount
=== RUN   TestAccAwsDxGatewayAssociation_allowedPrefixesVpnGatewayCrossAccount
=== PAUSE TestAccAwsDxGatewayAssociation_allowedPrefixesVpnGatewayCrossAccount
=== RUN   TestAccAwsDxGatewayAssociation_recreateProposal
=== PAUSE TestAccAwsDxGatewayAssociation_recreateProposal
=== CONT  TestAccAwsDxGatewayAssociationProposal_basicVpnGateway
=== CONT  TestAccAwsDxGatewayAssociation_basicVpnGatewayCrossAccount
--- PASS: TestAccAwsDxGatewayAssociationProposal_basicVpnGateway (57.20s)
=== CONT  TestAccAwsDxGatewayAssociation_allowedPrefixesVpnGatewaySingleAccount
--- PASS: TestAccAwsDxGatewayAssociation_allowedPrefixesVpnGatewaySingleAccount (1578.84s)
=== CONT  TestAccAwsDxGatewayAssociation_recreateProposal
--- PASS: TestAccAwsDxGatewayAssociation_basicVpnGatewayCrossAccount (1755.63s)
=== CONT  TestAccAwsDxGatewayAssociation_allowedPrefixesVpnGatewayCrossAccount
=== CONT  TestAccAwsDxGatewayAssociation_recreateProposal
--- PASS: TestAccAwsDxGatewayAssociation_recreateProposal (2071.69s)
=== CONT  TestAccAwsDxGatewayAssociation_basicTransitGatewayCrossAccount
--- PASS: TestAccAwsDxGatewayAssociation_allowedPrefixesVpnGatewayCrossAccount (1510.18s)
=== CONT  TestAccAwsDxGatewayAssociation_multiVpnGatewaysSingleAccount
--- PASS: TestAccAwsDxGatewayAssociation_basicTransitGatewayCrossAccount (1271.75s)
=== CONT  TestAccAwsDxGatewayAssociationProposal_endOfLifeTgw
--- PASS: TestAccAwsDxGatewayAssociation_multiVpnGatewaysSingleAccount (1152.73s)
=== CONT  TestAccAwsDxGatewayAssociation_basicVpnGatewaySingleAccount
--- PASS: TestAccAwsDxGatewayAssociationProposal_endOfLifeTgw (1179.68s)
=== CONT  TestAccAwsDxGatewayAssociation_V0StateUpgrade
--- PASS: TestAccAwsDxGatewayAssociation_basicVpnGatewaySingleAccount (1327.53s)
=== CONT  TestAccAwsDxGatewayAssociationProposal_AllowedPrefixes
--- PASS: TestAccAwsDxGatewayAssociationProposal_AllowedPrefixes (86.29s)
=== CONT  TestAccAwsDxGatewayAssociationProposal_disappears
--- PASS: TestAccAwsDxGatewayAssociationProposal_disappears (55.90s)
=== CONT  TestAccAwsDxGatewayAssociationProposal_endOfLifeVpn
--- PASS: TestAccAwsDxGatewayAssociation_V0StateUpgrade (998.55s)
=== CONT  TestAccAwsDxGatewayAssociation_basicTransitGatewaySingleAccount
--- PASS: TestAccAwsDxGatewayAssociationProposal_endOfLifeVpn (1183.03s)
=== CONT  TestAccAwsDxGatewayAssociationProposal_basicTransitGateway
--- PASS: TestAccAwsDxGatewayAssociation_basicTransitGatewaySingleAccount (1160.12s)
--- PASS: TestAccAwsDxGatewayAssociationProposal_basicTransitGateway (207.98s)
PASS
ok  	github.com/terraform-providers/terraform-provider-aws/aws	7282.567s

ewbankkit · 2021-07-12T13:23:43Z

Verified on a test Association Proposal that was EOLed by AWS.

After initial `terraform apply`

% aws --region us-west-2 directconnect describe-direct-connect-gateway-association-proposals --proposal-id 8e0af368-25b3-45b6-a551-450dd926ad44
{
    "directConnectGatewayAssociationProposals": [
        {
            "proposalId": "8e0af368-25b3-45b6-a551-450dd926ad44",
            "directConnectGatewayId": "7d9db843-d600-44db-8f4e-617a1dc21c67",
            "directConnectGatewayOwnerAccount": "123456789012",
            "proposalState": "accepted",
            "associatedGateway": {
                "id": "vgw-07699f257cc1eebc8",
                "type": "virtualPrivateGateway",
                "ownerAccount": "234567890123",
                "region": "us-west-2"
            },
            "existingAllowedPrefixesToDirectConnectGateway": [
                {
                    "cidr": "10.255.255.0/28"
                }
            ],
            "requestedAllowedPrefixesToDirectConnectGateway": [
                {
                    "cidr": "10.255.255.0/28"
                }
            ]
        }
    ]
}

Wait 4 days

% aws --region us-west-2 directconnect describe-direct-connect-gateway-association-proposals --proposal-id 8e0af368-25b3-45b6-a551-450dd926ad44
{
    "directConnectGatewayAssociationProposals": []
}

Run `terraform plan`

% terraform plan
Refreshing Terraform state in-memory prior to plan...
The refreshed state will be used to calculate this plan, but will not be
persisted to local or remote state storage.

data.aws_caller_identity.creator: Refreshing state...
aws_vpn_gateway.test: Refreshing state... [id=vgw-07699f257cc1eebc8]
aws_vpc.test: Refreshing state... [id=vpc-0279ccbb6e8392569]
aws_dx_gateway.test: Refreshing state... [id=7d9db843-d600-44db-8f4e-617a1dc21c67]
aws_vpn_gateway_attachment.test: Refreshing state... [id=vpn-attachment-cf62e598]
aws_dx_gateway_association_proposal.test: Refreshing state... [id=8e0af368-25b3-45b6-a551-450dd926ad44]
aws_dx_gateway_association.test: Refreshing state... [id=ga-7d9db843-d600-44db-8f4e-617a1dc21c67vgw-07699f257cc1eebc8]

------------------------------------------------------------------------

No changes. Infrastructure is up-to-date.

This means that Terraform did not detect any differences between your
configuration and real physical resources that exist. As a result, no
actions need to be performed.

github-actions · 2021-07-15T23:44:40Z

This functionality has been released in v3.50.0 of the Terraform AWS Provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template. Thank you!

github-actions · 2021-08-15T02:05:37Z

I'm going to lock this pull request because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems related to this change, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.

github-actions bot reviewed Jun 9, 2021

View reviewed changes

github-actions bot added service/directconnect Issues and PRs that pertain to the directconnect service. tests PRs: expanded test coverage. Issues: expanded coverage, enhancements to test infrastructure. labels Jun 10, 2021

dkujawski marked this pull request as ready for review June 21, 2021 22:19

github-actions bot added size/XL Managed by automation to categorize the size of a PR. and removed size/L Managed by automation to categorize the size of a PR. labels Jun 23, 2021

ewbankkit mentioned this pull request Jun 23, 2021

[#9209] Fix dx gateway association proposal so it works even if expired #12221

Closed

ewbankkit removed the needs-triage Waiting for first response or review from a maintainer. label Jun 23, 2021

ewbankkit self-assigned this Jun 23, 2021

ewbankkit added the thinking label Jun 23, 2021

dkujawski and others added 15 commits July 7, 2021 13:26

don't report diff when proposal is gone

2e09495

Populate proposal state using found association

8c198a1

Once the proposal has been accepted and deleted, locate the association, populate the proposal state to prevent recreating the proposal unnecessarily.

WIP activate debug code path for testing

7f5ae58

collect state information from associated gateway to determine if pro…

19b4043

…posal needs to be recreated.

when associated gateway is not found or errors, assume we need the pr…

363a762

…oposal

provide some commentary for clarity

76c016d

add test to cover proposal end of life

1f41003

reset debug mode default

69feb2f

allow import dx gateway assoc poroposal after EOL

69767a4

accept an import string composed of the proposal id, dx gateway id, and target associated gateway id when the proposal has been removed by AWS due to it being accepted.

defer existance checks to Read function

925c9df

move proposal existance logic out of custom diff function and over into the Read function. add more debug logs to track when proposal id values exist

remove test function no longer needed

2710bca

include allowed_prefixes when atrificially populating proposal

f7501be

include tgw for acc tests

e8b8e03

Add DirectConnect internal finder and waiter packages.

10830b0

Use finder package in aws_dx_gateway_association & aws_dx_gateway_ass…

c281882

…ociation_proposal acceptance tests.

ewbankkit added 11 commits July 7, 2021 15:31

Add DirectConnect internal lister package and use in (some) test swee…

9a5b53c

…pers.

r/aws_dx_gateway_association_proposal: Document alternate resource im…

5d7606d

…port format.

r/aws_dx_gateway_association_proposal: Ensure that any pseudo-proposa…

cc09452

…l ID is not blank.

Tweak acceptance test configurations.

5091041

Fix 'errcheck' linter errors.

847d868

r/aws_dx_gateway_association: Use internal waiter package.

1a884d2

r/aws_dx_gateway_association: Use internal finder and waiter packages.

ccddd60

r/aws_dx_gateway: Use internal finder and waiter packages.

9a5d4db

Add CHANGELOG entry.

7d84773

Taint Proposal to test Gateway Association ForceNew.

8cb22b4

Configuration changes for 'TestAccAwsDxGatewayAssociation_recreatePro…

e75ba1b

…posal'.

ewbankkit force-pushed the dk-FCC-175-fix-aws_dx_gateway_association_proposal-2 branch from 2e480e7 to e75ba1b Compare July 12, 2021 13:19

ewbankkit removed the thinking label Jul 12, 2021

github-actions bot added the documentation Introduces or discusses updates to documentation. label Jul 12, 2021

ewbankkit approved these changes Jul 12, 2021

View reviewed changes

Fix 'terrafmt' errors.

f97a52e

ewbankkit merged commit 6dc2d6f into hashicorp:main Jul 12, 2021

github-actions bot added this to the v3.50.0 milestone Jul 12, 2021

github-actions bot locked as resolved and limited conversation to collaborators Aug 15, 2021

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Fix aws dx gateway association proposal #19741

Fix aws dx gateway association proposal #19741

dkujawski commented Jun 9, 2021 •

edited by ewbankkit

Loading

github-actions bot left a comment

ewbankkit commented Jun 22, 2021

ewbankkit left a comment

ewbankkit commented Jul 12, 2021

github-actions bot commented Jul 15, 2021

github-actions bot commented Aug 15, 2021

Fix aws dx gateway association proposal #19741

Fix aws dx gateway association proposal #19741

Conversation

dkujawski commented Jun 9, 2021 • edited by ewbankkit Loading

Community Note

github-actions bot left a comment

Choose a reason for hiding this comment

ewbankkit commented Jun 22, 2021

ewbankkit left a comment

Choose a reason for hiding this comment

ewbankkit commented Jul 12, 2021

After initial terraform apply

Wait 4 days

Run terraform plan

github-actions bot commented Jul 15, 2021

github-actions bot commented Aug 15, 2021

dkujawski commented Jun 9, 2021 •

edited by ewbankkit

Loading

After initial `terraform apply`

Run `terraform plan`