terraform 0.12 tries to remove busy aws_security_group yet ignoring HTTP 400

[igorfraa]

I have modified (renamed) an aws_security_group resource.
terraform plan states that it is going to remove old aws_security_group, create a new one and then update corresponding aws_instance in-place.

Steps to reproduce:

1. Create an aws_instance associated with an aws_security_group
2. Rename the aws_security_group
3. Apply changes

Observed behavior:
terraform apply tries to remove the security group, receives HTTP 400 Bad request due this Security Group is in use, ignores error and keeps trying forever.

Desired behavior:
I wish terraform to perform the mentioned actions. If it is impossible it should at least show a notification in advance.

Debug logs:
aws_security_group.instance: Still destroying... [id=sg-0af1b6ca33a5dd2dc, 4m1s elapsed] 2019-05-29T12:38:49.845+0300 [DEBUG] plugin.terraform-provider-aws_v2.12.0_x4: 2019/05/29 12:38:49 [DEBUG] [aws-sdk-go] DEBUG: Request ec2/DeleteSecurityGroup Details: 2019-05-29T12:38:49.846+0300 [DEBUG] plugin.terraform-provider-aws_v2.12.0_x4: ---[ REQUEST POST-SIGN ]----------------------------- 2019-05-29T12:38:49.846+0300 [DEBUG] plugin.terraform-provider-aws_v2.12.0_x4: POST / HTTP/1.1 2019-05-29T12:38:49.846+0300 [DEBUG] plugin.terraform-provider-aws_v2.12.0_x4: Host: ec2.us-east-1.amazonaws.com 2019-05-29T12:38:49.846+0300 [DEBUG] plugin.terraform-provider-aws_v2.12.0_x4: User-Agent: aws-sdk-go/1.19.36 (go1.12.5; linux; amd64) APN/1.0 HashiCorp/1.0 Terraform/0.12.0 2019-05-29T12:38:49.846+0300 [DEBUG] plugin.terraform-provider-aws_v2.12.0_x4: Content-Length: 74 2019-05-29T12:38:49.846+0300 [DEBUG] plugin.terraform-provider-aws_v2.12.0_x4: Authorization: AWS4-HMAC-SHA256 Credential=xxxxx/20190529/us-east-1/ec2/aws4_request, SignedHeaders=content-length;content-type;host;x-amz-date, Signature=xxxxxxxx 2019-05-29T12:38:49.846+0300 [DEBUG] plugin.terraform-provider-aws_v2.12.0_x4: Content-Type: application/x-www-form-urlencoded; charset=utf-8 2019-05-29T12:38:49.846+0300 [DEBUG] plugin.terraform-provider-aws_v2.12.0_x4: X-Amz-Date: 20190529T093849Z 2019-05-29T12:38:49.846+0300 [DEBUG] plugin.terraform-provider-aws_v2.12.0_x4: Accept-Encoding: gzip 2019-05-29T12:38:49.846+0300 [DEBUG] plugin.terraform-provider-aws_v2.12.0_x4: 2019-05-29T12:38:49.846+0300 [DEBUG] plugin.terraform-provider-aws_v2.12.0_x4: Action=DeleteSecurityGroup&GroupId=sg-0af1b6ca33a5dd2dc&Version=2016-11-15 2019-05-29T12:38:49.846+0300 [DEBUG] plugin.terraform-provider-aws_v2.12.0_x4: ----------------------------------------------------- 2019-05-29T12:38:50.810+0300 [DEBUG] plugin.terraform-provider-aws_v2.12.0_x4: 2019/05/29 12:38:50 [DEBUG] [aws-sdk-go] DEBUG: Response ec2/DeleteSecurityGroup Details: 2019-05-29T12:38:50.820+0300 [DEBUG] plugin.terraform-provider-aws_v2.12.0_x4: ---[ RESPONSE ]-------------------------------------- 2019-05-29T12:38:50.820+0300 [DEBUG] plugin.terraform-provider-aws_v2.12.0_x4: HTTP/1.1 400 Bad Request 2019-05-29T12:38:50.820+0300 [DEBUG] plugin.terraform-provider-aws_v2.12.0_x4: Connection: close 2019-05-29T12:38:50.820+0300 [DEBUG] plugin.terraform-provider-aws_v2.12.0_x4: Transfer-Encoding: chunked 2019-05-29T12:38:50.820+0300 [DEBUG] plugin.terraform-provider-aws_v2.12.0_x4: Date: Wed, 29 May 2019 09:38:50 GMT 2019-05-29T12:38:50.820+0300 [DEBUG] plugin.terraform-provider-aws_v2.12.0_x4: Server: AmazonEC2 2019-05-29T12:38:50.820+0300 [DEBUG] plugin.terraform-provider-aws_v2.12.0_x4: 2019-05-29T12:38:50.821+0300 [DEBUG] plugin.terraform-provider-aws_v2.12.0_x4: 2019-05-29T12:38:50.821+0300 [DEBUG] plugin.terraform-provider-aws_v2.12.0_x4: ----------------------------------------------------- 2019-05-29T12:38:50.821+0300 [DEBUG] plugin.terraform-provider-aws_v2.12.0_x4: 2019/05/29 12:38:50 [DEBUG] [aws-sdk-go] <?xml version="1.0" encoding="UTF-8"?> 2019-05-29T12:38:50.821+0300 [DEBUG] plugin.terraform-provider-aws_v2.12.0_x4: <Response><Errors><Error><Code>DependencyViolation</Code><Message>resource sg-0af1b6ca33a5dd2dc has a dependent object</Message></Error></Errors><RequestID>1f2211d4-393f-4368-a66c-896ca10734a6</RequestID></Response> 2019-05-29T12:38:50.821+0300 [DEBUG] plugin.terraform-provider-aws_v2.12.0_x4: 2019/05/29 12:38:50 [DEBUG] [aws-sdk-go] DEBUG: Validate Response ec2/DeleteSecurityGroup failed, not retrying, error DependencyViolation: resource sg-0af1b6ca33a5dd2dc has a dependent object 2019-05-29T12:38:50.821+0300 [DEBUG] plugin.terraform-provider-aws_v2.12.0_x4: status code: 400, request id: 1f2211d4-393f-4368-a66c-896ca10734a6 2019-05-29T12:38:50.821+0300 [DEBUG] plugin.terraform-provider-aws_v2.12.0_x4: 2019/05/29 12:38:50 [TRACE] Waiting 10s before next try

[ghost]

This issue has been automatically migrated to hashicorp/terraform-provider-aws#8809 because it looks like an issue with that provider. If you believe this is not an issue with the provider, please reply to hashicorp/terraform-provider-aws#8809.

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.