{"action":"created","issue":{"url":"https://api.github.com/repos/hashicorp/terraform/issues/2200","labels_url":"https://api.github.com/repos/hashicorp/terraform/issues/2200/labels{/name}","comments_url":"https://api.github.com/repos/hashicorp/terraform/issues/2200/comments","events_url":"https://api.github.com/repos/hashicorp/terraform/issues/2200/events","html_url":"https://github.com/hashicorp/terraform/issues/2200","id":84241645,"number":2200,"title":"Terraform always thinks that security group requires changes","user":{"login":"kevinm416","id":526698,"avatar_url":"https://avatars.githubusercontent.com/u/526698?v=3","gravatar_id":"","url":"https://api.github.com/users/kevinm416","html_url":"https://github.com/kevinm416","followers_url":"https://api.github.com/users/kevinm416/followers","following_url":"https://api.github.com/users/kevinm416/following{/other_user}","gists_url":"https://api.github.com/users/kevinm416/gists{/gist_id}","starred_url":"https://api.github.com/users/kevinm416/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kevinm416/subscriptions","organizations_url":"https://api.github.com/users/kevinm416/orgs","repos_url":"https://api.github.com/users/kevinm416/repos","events_url":"https://api.github.com/users/kevinm416/events{/privacy}","received_events_url":"https://api.github.com/users/kevinm416/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-06-02T22:32:44Z","updated_at":"2015-06-02T22:56:05Z","closed_at":null,"body":"I observed this bug in both versions 0.5.1 and 0.5.3. Example output in this bug is from 0.5.3.\r\n\r\nHere's a security group I want to create:\r\n```\r\nprovider \"aws\" {\r\n    region = \"us-west-2\"\r\n}\r\n\r\nresource \"aws_vpc\" \"vpc-name-1\" {\r\n    cidr_block = \"10.0.0.0/16\"\r\n    enable_dns_support = true\r\n    enable_dns_hostnames = false\r\n    tags {\r\n        cloud-spec-name = \"vpc-name-1\"\r\n    }\r\n}\r\n\r\nresource \"aws_security_group\" \"security-group-1\" {\r\n    name = \"security-group-1\"\r\n    vpc_id = \"${aws_vpc.vpc-name-1.id}\"\r\n    \r\n    ingress {\r\n        from_port = \"111\"\r\n        to_port = \"111\"\r\n        protocol = \"tcp\"\r\n        cidr_blocks = [\r\n            \"10.30.0.0/16\",\r\n            \"10.20.0.0/16\",\r\n        ]\r\n    }\r\n    ingress {\r\n        from_port = \"123\"\r\n        to_port = \"456\"\r\n        protocol = \"tcp\"\r\n        cidr_blocks = [\r\n            \"10.0.1.0/16\",\r\n            \"10.10.0.0/16\",\r\n        ]\r\n    }\r\n    \r\n    egress {\r\n       from_port = \"789\"\r\n        to_port = \"1011\"\r\n        protocol = \"udp\"\r\n        cidr_blocks = [\r\n            \"10.0.0.0/16\",\r\n        ]\r\n    }\r\n\r\n    tags {\r\n        cloud-spec-name = \"security-group-1\"\r\n    }\r\n}\r\n```\r\n\r\nTerraform will create this security group no problem:\r\n```\r\n$ ../terraform-install/terraform apply\r\naws_vpc.vpc-name-1: Creating...\r\n  cidr_block:                \"\" => \"10.0.0.0/16\"\r\n  default_network_acl_id:    \"\" => \"<computed>\"\r\n  default_security_group_id: \"\" => \"<computed>\"\r\n  dhcp_options_id:           \"\" => \"<computed>\"\r\n  enable_dns_hostnames:      \"\" => \"0\"\r\n  enable_dns_support:        \"\" => \"1\"\r\n  main_route_table_id:       \"\" => \"<computed>\"\r\n  tags.#:                    \"\" => \"1\"\r\n  tags.cloud-spec-name:      \"\" => \"vpc-name-1\"\r\naws_vpc.vpc-name-1: Creation complete\r\naws_security_group.security-group-1: Creating...\r\n  description:                          \"\" => \"Managed by Terraform\"\r\n  egress.#:                             \"\" => \"1\"\r\n  egress.2879914364.cidr_blocks.#:      \"\" => \"1\"\r\n  egress.2879914364.cidr_blocks.0:      \"\" => \"10.0.0.0/16\"\r\n  egress.2879914364.from_port:          \"\" => \"789\"\r\n  egress.2879914364.protocol:           \"\" => \"udp\"\r\n  egress.2879914364.security_groups.#:  \"\" => \"0\"\r\n  egress.2879914364.self:               \"\" => \"0\"\r\n  egress.2879914364.to_port:            \"\" => \"1011\"\r\n  ingress.#:                            \"\" => \"2\"\r\n  ingress.1069758170.cidr_blocks.#:     \"\" => \"2\"\r\n  ingress.1069758170.cidr_blocks.0:     \"\" => \"10.0.1.0/16\"\r\n  ingress.1069758170.cidr_blocks.1:     \"\" => \"10.10.0.0/16\"\r\n  ingress.1069758170.from_port:         \"\" => \"123\"\r\n  ingress.1069758170.protocol:          \"\" => \"tcp\"\r\n  ingress.1069758170.security_groups.#: \"\" => \"0\"\r\n  ingress.1069758170.self:              \"\" => \"0\"\r\n  ingress.1069758170.to_port:           \"\" => \"456\"\r\n  ingress.1765782756.cidr_blocks.#:     \"\" => \"2\"\r\n  ingress.1765782756.cidr_blocks.0:     \"\" => \"10.30.0.0/16\"\r\n  ingress.1765782756.cidr_blocks.1:     \"\" => \"10.20.0.0/16\"\r\n  ingress.1765782756.from_port:         \"\" => \"111\"\r\n  ingress.1765782756.protocol:          \"\" => \"tcp\"\r\n  ingress.1765782756.security_groups.#: \"\" => \"0\"\r\n  ingress.1765782756.self:              \"\" => \"0\"\r\n  ingress.1765782756.to_port:           \"\" => \"111\"\r\n  name:                                 \"\" => \"security-group-1\"\r\n  owner_id:                             \"\" => \"<computed>\"\r\n  tags.#:                               \"\" => \"1\"\r\n  tags.cloud-spec-name:                 \"\" => \"security-group-1\"\r\n  vpc_id:                               \"\" => \"vpc-dbc24abe\"\r\naws_security_group.security-group-1: Creation complete\r\n\r\nApply complete! Resources: 2 added, 0 changed, 0 destroyed.\r\n\r\nThe state of your infrastructure has been saved to the path\r\nbelow. This state is required to modify and destroy your\r\ninfrastructure, so keep it safe. To inspect the complete state\r\nuse the `terraform show` command.\r\n\r\nState path: terraform.tfstate\r\n```\r\n\r\nHowever, it always incorrectly thinks that there is something about the security group it needs to update, even after performing multiple `terraform apply` commands.\r\n```\r\n$ ../terraform-install/terraform plan\r\nRefreshing Terraform state prior to plan...\r\n\r\naws_vpc.vpc-name-1: Refreshing state... (ID: vpc-dbc24abe)\r\naws_security_group.security-group-1: Refreshing state... (ID: sg-38d7345c)\r\n\r\nThe Terraform execution plan has been generated and is shown below.\r\nResources are shown in alphabetical order for quick scanning. Green resources\r\nwill be created (or destroyed and then created if an existing resource\r\nexists), yellow resources are being changed in-place, and red resources\r\nwill be destroyed.\r\n\r\nNote: You didn't specify an \"-out\" parameter to save this plan, so when\r\n\"apply\" is called, Terraform can't guarantee this is what will execute.\r\n\r\n~ aws_security_group.security-group-1\r\n    ingress.1069758170.cidr_blocks.#:     \"0\" => \"2\"\r\n    ingress.1069758170.cidr_blocks.0:     \"\" => \"10.0.1.0/16\"\r\n    ingress.1069758170.cidr_blocks.1:     \"\" => \"10.10.0.0/16\"\r\n    ingress.1069758170.from_port:         \"\" => \"123\"\r\n    ingress.1069758170.protocol:          \"\" => \"tcp\"\r\n    ingress.1069758170.security_groups.#: \"0\" => \"0\"\r\n    ingress.1069758170.self:              \"\" => \"0\"\r\n    ingress.1069758170.to_port:           \"\" => \"456\"\r\n    ingress.1765782756.cidr_blocks.#:     \"2\" => \"2\"\r\n    ingress.1765782756.cidr_blocks.0:     \"10.30.0.0/16\" => \"10.30.0.0/16\"\r\n    ingress.1765782756.cidr_blocks.1:     \"10.20.0.0/16\" => \"10.20.0.0/16\"\r\n    ingress.1765782756.from_port:         \"111\" => \"111\"\r\n    ingress.1765782756.protocol:          \"tcp\" => \"tcp\"\r\n    ingress.1765782756.security_groups.#: \"0\" => \"0\"\r\n    ingress.1765782756.self:              \"0\" => \"0\"\r\n    ingress.1765782756.to_port:           \"111\" => \"111\"\r\n```\r\n"},"comment":{"url":"https://api.github.com/repos/hashicorp/terraform/issues/comments/108122913","html_url":"https://github.com/hashicorp/terraform/issues/2200#issuecomment-108122913","issue_url":"https://api.github.com/repos/hashicorp/terraform/issues/2200","id":108122913,"user":{"login":"phinze","id":37534,"avatar_url":"https://avatars.githubusercontent.com/u/37534?v=3","gravatar_id":"","url":"https://api.github.com/users/phinze","html_url":"https://github.com/phinze","followers_url":"https://api.github.com/users/phinze/followers","following_url":"https://api.github.com/users/phinze/following{/other_user}","gists_url":"https://api.github.com/users/phinze/gists{/gist_id}","starred_url":"https://api.github.com/users/phinze/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/phinze/subscriptions","organizations_url":"https://api.github.com/users/phinze/orgs","repos_url":"https://api.github.com/users/phinze/repos","events_url":"https://api.github.com/users/phinze/events{/privacy}","received_events_url":"https://api.github.com/users/phinze/received_events","type":"User","site_admin":false},"created_at":"2015-06-02T22:56:05Z","updated_at":"2015-06-02T22:56:05Z","body":"@catsby going to tag this as a provider issue - feel free to kick it to `core` if you decide it's not provider related."}}