Skip to content

Commit

Permalink
fix: Addresses persistent diff with manage_default_network_acl
Browse files Browse the repository at this point in the history
As noted in the [terraform docs][0], subnets using the default network acl
will generate a persistent diff if they are not specified to the aws_default_network_acl
resource. This module was handling subnets created by the module, but
of course is not aware of subnets created externally to the module.

The docs suggest using lifecycle ignore_changes as an option to avoid
the persistence diff, which is the approach implemented in this patch.

Fixes terraform-aws-modules#529

[0]: https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/default_network_acl#managing-subnets-in-a-default-network-acl
  • Loading branch information
lorengordon committed Jan 25, 2022
1 parent 6f89db5 commit 92b8fc9
Showing 1 changed file with 7 additions and 22 deletions.
29 changes: 7 additions & 22 deletions main.tf
Original file line number Diff line number Diff line change
Expand Up @@ -587,28 +587,9 @@ resource "aws_default_network_acl" "this" {

default_network_acl_id = aws_vpc.this[0].default_network_acl_id

# The value of subnet_ids should be any subnet IDs that are not set as subnet_ids
# for any of the non-default network ACLs
subnet_ids = setsubtract(
compact(flatten([
aws_subnet.public[*].id,
aws_subnet.private[*].id,
aws_subnet.intra[*].id,
aws_subnet.database[*].id,
aws_subnet.redshift[*].id,
aws_subnet.elasticache[*].id,
aws_subnet.outpost[*].id,
])),
compact(flatten([
aws_network_acl.public[*].subnet_ids,
aws_network_acl.private[*].subnet_ids,
aws_network_acl.intra[*].subnet_ids,
aws_network_acl.database[*].subnet_ids,
aws_network_acl.redshift[*].subnet_ids,
aws_network_acl.elasticache[*].subnet_ids,
aws_network_acl.outpost[*].subnet_ids,
]))
)
# subnet_ids is using lifecycle ignore_changes, so it is not necessary to list
# any explicitly. See https://github.com/terraform-aws-modules/terraform-aws-vpc/issues/736.
subnet_ids = null

dynamic "ingress" {
for_each = var.default_network_acl_ingress
Expand Down Expand Up @@ -644,6 +625,10 @@ resource "aws_default_network_acl" "this" {
var.tags,
var.default_network_acl_tags,
)

lifecycle {
ignore_changes = [subnet_ids]
}
}

################################################################################
Expand Down

0 comments on commit 92b8fc9

Please sign in to comment.