private_dns_only_for_inbound_resolver_endpoint value for s3 vpc endpoints is ignored.

[shadow-wheel]

Description

This is pretty simple. As a followup to my prior bug report in #982, I tested the fix in #1023 and noticed that when trying to set the following, the private_dns_only_for_inbound_resolver_endpoint flag was still set to false (Note: a prerequisite of this is to have an existing S3 Gateway endpoint so if testing is needed, that will need to be created first before the Interface endpoint with this flag enabled will succeed.)

private_dns_enabled = true
      dns_options = {
        private_dns_only_for_inbound_resolver_endpoint = true
      }

Upon investigation of the fix, I noticed that dns_options was omitted on

terraform-aws-vpc/modules/vpc-endpoints/main.tf

Line 42 in e476850

private_dns_only_for_inbound_resolver_endpoint = try(each.value.private_dns_only_for_inbound_resolver_endpoint, null)

so the flag passed into the module is ignored.

This can be fixed by updating to private_dns_only_for_inbound_resolver_endpoint = try(each.value.dns_options.private_dns_only_for_inbound_resolver_endpoint, null)

I've verified this fix locally but I don't have any experience with PRs to this repo.

• ✋ I have searched the open/closed issues and my issue is not listed.

Versions

• Module version [Required]:
  v5.5.0

• Terraform version:
  v1.4.6

• Provider version(s):

• provider registry.terraform.io/hashicorp/aws v5.32.1

Reproduction Code [Required]

module "vpc_endpoints" {
  source  = "terraform-aws-modules/vpc/aws//modules/vpc-endpoints"
  version = "v5.5.0"

  vpc_id             = module.vpc.vpc_id
  security_group_ids = [module.vpc_endpoints_sg.security_group_id]

  endpoints = {
    s3 = {
      service = "s3"
      service_type = "Interface"
      private_dns_enabled = true
      dns_options = {
        private_dns_only_for_inbound_resolver_endpoint = true
      }
      tags    = { Name = "s3-vpc-endpoint" }
    }
  }
}

Steps to reproduce the behavior:

explained above already.

Expected behavior

The flag private_dns_only_for_inbound_resolver_endpoint should be true

Actual behavior

The flag private_dns_only_for_inbound_resolver_endpoint is ignored

[antonbabenko]

This issue has been resolved in version 5.5.1 🎉

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues. If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.