r/aws_network_acl: Correctly handle missing associations for deleted subnets

[ewbankkit]

Modifying a NACL to remove the association with a subnet that has been deleted I get the error:

* aws_network_acl.nacl: Failed to find acl association: acl acl-11111111 with subnet subnet-11111111: could not find association for subnet: subnet-11111111

My Terraform code is a nested set of modules but I can reproduce with this scenario (for which I have added an acceptance test):

Before

resource "aws_vpc" "foo" {
  cidr_block = "10.1.0.0/16"
  tags {
    Name = "terraform-testacc-network-acl-subnet-ids"
  }
}

resource "aws_subnet" "one" {
  cidr_block = "10.1.111.0/24"
  vpc_id = "${aws_vpc.foo.id}"
  tags {
    Name = "tf-acc-network-acl-subnet-ids-one"
  }
}

resource "aws_subnet" "two" {
  cidr_block = "10.1.1.0/24"
  vpc_id = "${aws_vpc.foo.id}"
  tags {
    Name = "tf-acc-network-acl-subnet-ids-two"
  }
}

resource "aws_network_acl" "bar" {
  vpc_id = "${aws_vpc.foo.id}"
  subnet_ids = ["${aws_subnet.one.id}", "${aws_subnet.two.id}"]
  tags {
    Name = "tf-acc-acl-subnet-ids"
  }
}

After

resource "aws_vpc" "foo" {
  cidr_block = "10.1.0.0/16"
  tags {
    Name = "terraform-testacc-network-acl-subnet-ids"
  }
}

resource "aws_subnet" "one" {
  cidr_block = "10.1.111.0/24"
  vpc_id = "${aws_vpc.foo.id}"
  tags {
    Name = "tf-acc-network-acl-subnet-ids-one"
  }
}

resource "aws_network_acl" "bar" {
  vpc_id = "${aws_vpc.foo.id}"
  subnet_ids = ["${aws_subnet.one.id}"]
  tags {
    Name = "tf-acc-acl-subnet-ids"
  }
}

terraform plan:

An execution plan has been generated and is shown below.
Resource actions are indicated with the following symbols:
  ~ update in-place
  - destroy

Terraform will perform the following actions:

  ~ aws_network_acl.bar
      subnet_ids.#:          "2" => "1"
      subnet_ids.1707514343: "subnet-11111111" => "subnet-11111111"
      subnet_ids.2646811560: "subnet-22222222" => ""

  - aws_subnet.two


Plan: 0 to add, 1 to change, 1 to destroy.

[ewbankkit]

The best way of handling NACL/Subnet Associations is via the new aws_network_acl_association resource suggested in #1034.

[bflad]

The fix has been merged and will release with v1.14.1 of the AWS provider, likely on Wednesday.

[bflad]

This has been released in version 1.14.1 of the AWS provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thanks!