Security Group vs Rule requires apply to be run twice

[atz]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

After terraform import of a Security Group, both the aws_security_group and associated aws_security_group_rule resources are added to the state file, as noted in other issues.

Apparently there is no way to import a SG to HCL with inline ingress/egress blocks without (at least temporarily) destroying the rules and running terraform apply twice. That is an unacceptable tradeoff, since it imposes downtime on infrastructure, breaks CD, etc.

If SG import requires atomic aws_security_group_rule resources, that requirement should be more explicitly documented.

Terraform Version

• Terraform v0.12.8
• provider.aws v2.22.0

Affected Resource(s)

• aws_security_group
• aws_security_group_rule

Terraform Configuration Files

resource "aws_security_group" "mygroup" {
  name = "mygroup"
  ingress {...}
  egress {...}
   ...
 }

Expected Behavior

terraform import aws_security_group... should allow targeting inline ingress/egress blocks without requiring downtime and multiple applies.

After the first successful terraform apply, with no changes, terraform plan should show no pending changes.

Actual Behavior

After apply succeeds, plan shows that ingress and egress blocks need to be created. (Indeed, in console the ingress/egress rules of the SG have been destroyed.) The point is, between the first apply and the next, no code or infrastructure has changed. This is the definition of when plan/apply should be clean.

Steps to Reproduce

1. add resource "aws_security_group" "mygroup" {...} in tf file (but not rules)
2. terraform import aws_security_group.mygroup sg-123456
3. terraform apply
4. terraform apply (again)

References

See:

• All Rules Deleted on Security Group import/apply #6036
• Importing aws_security_group creates aws_security_group_rule's #6652

[ghost]

This has been released in version 3.0.0 of the Terraform AWS provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template for triage. Thanks!

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thanks!