VPN Connection Tunnels incorrectly ordered

[hashibot]

This issue was originally opened by @kitforbes as hashicorp/terraform#10411. It was migrated here as part of the provider split. The original body of the issue is below.

---

Terraform Version

Terraform v0.7.13

Affected Resource(s)

• aws_vpn_connection

Terraform Configuration Files

module "vpc" {
  source = "../../../modules/aws/network/vpc"

  name        = "${var.name}-vpc"
  environment = "${var.environment}"
  cidr        = "${var.vpc_cidr}"
}

resource "aws_customer_gateway" "edinburgh" {
  type       = "${var.vpn_connection_type}"
  bgp_asn    = "${var.vpn_bgs_asn}"
  ip_address = "${var.vpn_local_ip}"

  tags {
    Name        = "${var.name}-customer-gateway"
    Environment = "${var.environment}"
    Creator     = "Terraform"
  }
}

resource "aws_vpn_gateway" "edinburgh" {
  vpc_id = "${module.vpc.vpc_id}"

  tags {
    Name        = "${var.name}-edinburgh"
    Environment = "${var.environment}"
    Creator     = "Terraform"
  }
}

resource "aws_vpn_connection" "edinburgh" {
  vpn_gateway_id      = "${aws_vpn_gateway.edinburgh.id}"
  customer_gateway_id = "${aws_customer_gateway.edinburgh.id}"
  type                = "${var.vpn_connection_type}"
  static_routes_only  = true

  tags {
    Name        = "${var.name}-edinburgh"
    Environment = "${var.environment}"
    Creator     = "Terraform"
  }
}

output "vpn_config" {
  value = <<CONFIGURATION

  Tunnel 1
    Address:     ${aws_vpn_connection.edinburgh.tunnel1_address}
  Tunnel 2
    Address:     ${aws_vpn_connection.edinburgh.tunnel2_address}
CONFIGURATION
}

Expected Behavior

${aws_vpn_connection.edinburgh.tunnel1_address} should output the value of Tunnel 1 in the AWS Console.

Actual Behavior

It actually outputs the value of tunnel 2, and tunnel 2 outputs the value of tunnel 1. Not a critical issue by any means.

Steps to Reproduce

Create an AWS VPN connection and compare the Terraform output to actual AWS Console information in the VPC section.

[tyrken]

Not sure, but suspect the AWS Console GUI is sorting by Outside IP address. Would recommend TF does NOT do so.

[jochen42]

perhaps the reason is this sort-statement:

https://github.com/terraform-providers/terraform-provider-aws/blob/master/aws/resource_aws_vpn_connection.go#L595-L596

this sort is inside the code since the first version:

https://github.com/terraform-providers/terraform-provider-aws/blob/757055f2a5dfb4ea62207de6c4376088c33e3948/aws/resource_aws_vpn_connection.go#L468-L469

but why the xml from the api should be in the wrong order?

[jochen42]

for users who running in this issue before merging/releasing the pull-request:

use the xml-output "aws_vpn_connection.<resource_name>.customer_gateway_configuration". the tunnels inside this xml are always sorted exactly like the aws console does. aditionaly it contains some more informations about the connection-parameters.

https://www.terraform.io/docs/providers/aws/r/vpn_connection.html#virtual-private-gateway

[MRinalducci]

This triage bug becomes very annoying since last version of the provider v3.22.0 with PR #14740 which adds read/refresh of tunnel options.
Any ideas how to solve that?

[dthvt]

Configuring tunnel1/tunnel2 with differing options (DH group, etc.) will trigger a dual tunnel outage when applying due to the reordering of the tunnels in terraform. I would support ANY solution that results in consistent ordering of the tunnels, even if it doesn't match the Console. As it is now, having different tunnel configs will trigger a dual tunnel outage and full loss of connectivity during applies, which is just not acceptable in a production environment.

[francescoprovino]

I have found a workaround: because tunnel1 is always the lowest IP of the two, I just wrote a few lines to convert it to a number, and tied the assignment to this convention. You can do it in two-three lines with a simple condition. I think this could be fixed this way in the backend, also.

[bflad]

Hi folks 👋 Sorry this is still causing issues. We are working on a fix now.

[ghost]

This has been released in version 3.38.0 of the Terraform AWS provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template for triage. Thanks!

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.