[Bug]: Terraform Provider v5.6.0 causes Load Balancers recreate when tags change

[lopezm1]

Terraform Core Version

1.4.6

AWS Provider Version

5.6.0

Affected Resource(s)

aws_lb

Expected Behavior

I would expect a tag change NOT to destroy and recreate my existing load balancer.

Actual Behavior

Our aws_lb object is being re-created any time a tag is updated. This is not the expected behavior. We were able to fix our deployment pipelines by pinning v5.5.0 on the AWS Terraform provider.

Relevant Error/Panic Output Snippet

# module.load_balancer["fanmgmt-api-stg"].aws_lb.application must be replaced
+/- resource "aws_lb" "application" {
      ~ arn                                         = "arn:aws:elasticloadbalancing:*********:xxxxxxxxx:loadbalancer/app/fanmgmt-api-stg-bg/e66e37824cbd877e" -> (known after apply)
      ~ arn_suffix                                  = "app/fanmgmt-api-stg-bg/xxxxxxxx" -> (known after apply)
      ~ dns_name                                    = "fanmgmt-api-stg-bg-xxxxxxxxx.*********.elb.amazonaws.com" -> (known after apply)
      - enable_cross_zone_load_balancing            = true -> null
      ~ id                                          = "arn:aws:elasticloadbalancing:*********:xxxxxxxxxx:loadbalancer/app/fanmgmt-api-stg-bg/e66e37824cbd877e" -> (known after apply)
      ~ ip_address_type                             = "ipv4" -> (known after apply)
        name                                        = "fanmgmt-api-stg-bg"
      ~ tags                                        = {
          ~ "color"         = "blue" -> "green"
            # (11 unchanged elements hidden)
        }
      ~ vpc_id                                      = "vpc-xxxxxxxxx" -> (known after apply)
      ~ zone_id                                     = "xxxxxxx" -> (known after apply)
        # (14 unchanged attributes hidden)


      - subnet_mapping {
          - subnet_id = "subnet-xxxxx" -> null
        }
      - subnet_mapping {
          - subnet_id = "subnet-xxxxx" -> null
        }
      - subnet_mapping {
          - subnet_id = "subnet-xxxxxx" -> null
        }
      + subnet_mapping {
          + allocation_id        = (known after apply)
          + ipv6_address         = (known after apply)
          + outpost_id           = (known after apply)
          + private_ipv4_address = (known after apply)
          + subnet_id            = (known after apply)
        }
        # (1 unchanged block hidden)
    }

Terraform Configuration Files

resource "aws_lb" "application" {
name = var.name
security_groups = var.security_groups
internal = var.internal
subnets = var.internal ? data.terraform_remote_state.current_vpc.outputs.private_subnets : data.terraform_remote_state.current_vpc.outputs.public_subnets
load_balancer_type = var.load_balancer_type

enable_deletion_protection = var.enable_deletion_protection
enable_cross_zone_load_balancing = true

tags = var.tags
lifecycle {
ignore_changes = [subnets]
}
}

Steps to Reproduce

1. Run terraform with AWS Provider v5.6.0
2. Create aws_lb with tags
3. Try to change the tag on aws_lb and observe it changing

Debug Output

No response

Panic Output

No response

Important Factoids

No response

References

No response

Would you like to implement a fix?

No

[github-actions]

Community Note

Voting for Prioritization

• Please vote on this issue by adding a 👍 reaction to the original post to help the community and maintainers prioritize this request.
• Please see our prioritization guide for information on how we prioritize.
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request.

Volunteering to Work on This Issue

• If you are interested in working on this issue, please leave a comment.
• If this would be your first contribution, please review the contribution guide.

[Pesticles]

This is not limited to LB resources, appears to be consistent across all resource types. This should be considered a SEV1 issue!

[lopezm1]

Wow scary @Pesticles

[lopezm1]

cc: @justinretzolk

[babbottscott]

Yup. All our pipelines are broken on trying to replace iam roles. Ack!

[ewbankkit]

@lopezm1 Thanks for reporting this issue 👏.
The maintainers are working on a hotfix for this issue and hope to release it shortly.
Underway: https://github.com/hashicorp/terraform-provider-aws/actions/runs/5418524882.

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.