error reading EC2 Network ACL Rule

[cdancy]

Now that THIS ISSUE has finally been resolved we are now seeing this which looks similar and I'm wondering if the same logic can be applied?

[2022-02-11T19:54:26.983Z]         	            	               

[2022-02-11T19:54:26.983Z]         	            	               Error: error reading EC2 Network ACL Rule (nacl-3954984924): couldn't find resource

[2022-02-11T19:54:26.983Z]         	            	               

[2022-02-11T19:54:26.983Z]         	            	                 with module.vpc.aws_network_acl_rule.public_outbound[2],

[2022-02-11T19:54:26.983Z]         	            	                 on .terraform/modules/vpc/main.tf line 668, in resource "aws_network_acl_rule" "public_outbound":

[2022-02-11T19:54:26.983Z]         	            	                668: resource "aws_network_acl_rule" "public_outbound" {

[ewbankkit]

@cdancy Thanks for raising this issue.
Which version of the Terraform AWS Provider are you using?
In v4.0.0 we have started to use the paginated DescribeNetworkAcls call:

terraform-provider-aws/internal/service/ec2/network_acl.go

Line 182 in 7a06646

return FindNetworkACLByID(conn, d.Id())

terraform-provider-aws/internal/service/ec2/find.go

Lines 773 to 778 in 7a06646

	func FindNetworkACLByID(conn *ec2.EC2, id string) (*ec2.NetworkAcl, error) {
	input := &ec2.DescribeNetworkAclsInput{
	NetworkAclIds: aws.StringSlice([]string{id}),
	}
	output, err := FindNetworkACL(conn, input)

terraform-provider-aws/internal/service/ec2/find.go

Lines 722 to 723 in 7a06646

	func FindNetworkACL(conn *ec2.EC2, input *ec2.DescribeNetworkAclsInput) (*ec2.NetworkAcl, error) {
	output, err := FindNetworkACLs(conn, input)

terraform-provider-aws/internal/service/ec2/find.go

Lines 740 to 743 in 7a06646

	func FindNetworkACLs(conn *ec2.EC2, input *ec2.DescribeNetworkAclsInput) ([]*ec2.NetworkAcl, error) {
	var output []*ec2.NetworkAcl
	err := conn.DescribeNetworkAclsPages(input, func(page *ec2.DescribeNetworkAclsOutput, lastPage bool) bool {

[cdancy]

@ewbankkit just started trying out 4.0.0 this morning and saw this which is not an issue we've encountered before. Not sure if it's related or not...

[rpf3]

I'm seeing a similar pattern using AWS provider 4.5.0.

Error: error reading EC2 Network ACL Rule (nacl-12345): empty result

Error: error reading EC2 Network ACL Association (aclassoc-12345): empty result

It appears to be intermittent though.

[ksanjay7]

+1
This seems like intermittent issue.
error reading EC2 Network ACL Rule (nacl-12345): couldn't find resource
with module.nacl["infra"].aws_network_acl_rule.ingress["110"]

Behaviour:

Already NACL had nearly 10 rules and while adding new rules (2 ingress and 2 egress) faced the issue for 1st ingress. However in the UI of AWS, I see all new 4 rules were added. I have tried to re-run to make the state consistent and below is the output
module.nacl["infra"].aws_network_acl_rule.ingress["110"] is tainted, so must be replaced
+/- resource "aws_network_acl_rule" "ingress" {
~ id = "nacl-1234" -> (known after apply)
~ protocol = "6" -> "tcp"
# (7 unchanged attributes hidden)
}

Plan: 1 to add, 0 to change, 1 to destroy.

Output : Ingress rule 110 was deleted and don't see any addition of the rule 110

So I have rerun the apply to add this rule and this time it has added the rule

[nrastogiakoya]

+1 on getting the "empty result" for nacl association

[DacoDev]

Still seeing this regularly on AWS provider v4.39

[nrastogiakoya]

Yes, and it's a super frustrating error for running smooth pipelines

[mgarber-ops]

I'm also seeing this using provider ver 4.15.1

[tigerpeng2001]

It is quite an annoying error. Reran the plan, the plan out indicated the associations would be replaced. The associations were created successfully after, maybe multiple times, replan/reapply.

$ terraform version
Terraform v1.3.7
on darwin_amd64
+ provider registry.terraform.io/hashicorp/aws v4.48.0

[cdancy]

@tigerpeng2001 yeah we have a wrapper script that basically retries upon some failure message encountered. Usually after a handful of retries, with some waits thrown in between for good measure, things go through. Kind of ridiculous solution but it does work 90% of the time

[github-actions]

This functionality has been released in v4.59.0 of the Terraform AWS Provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template. Thank you!

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.