{"action":"created","issue":{"url":"https://api.github.com/repos/hashicorp/terraform/issues/2463","labels_url":"https://api.github.com/repos/hashicorp/terraform/issues/2463/labels{/name}","comments_url":"https://api.github.com/repos/hashicorp/terraform/issues/2463/comments","events_url":"https://api.github.com/repos/hashicorp/terraform/issues/2463/events","html_url":"https://github.com/hashicorp/terraform/issues/2463","id":90712231,"number":2463,"title":"Adding security rule AFTER applying causes error","user":{"login":"timothykimball","id":84351,"avatar_url":"https://avatars.githubusercontent.com/u/84351?v=3","gravatar_id":"","url":"https://api.github.com/users/timothykimball","html_url":"https://github.com/timothykimball","followers_url":"https://api.github.com/users/timothykimball/followers","following_url":"https://api.github.com/users/timothykimball/following{/other_user}","gists_url":"https://api.github.com/users/timothykimball/gists{/gist_id}","starred_url":"https://api.github.com/users/timothykimball/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/timothykimball/subscriptions","organizations_url":"https://api.github.com/users/timothykimball/orgs","repos_url":"https://api.github.com/users/timothykimball/repos","events_url":"https://api.github.com/users/timothykimball/events{/privacy}","received_events_url":"https://api.github.com/users/timothykimball/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/hashicorp/terraform/labels/bug","name":"bug","color":"f7c6c7"},{"url":"https://api.github.com/repos/hashicorp/terraform/labels/provider/aws","name":"provider/aws","color":"bfdadc"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2015-06-24T15:37:20Z","updated_at":"2015-06-24T15:53:25Z","closed_at":null,"body":"Version of terraform: terraform v0.5.3\r\nSteps to reproduce:\r\n\r\n1. apply the below via terraform\r\n2. uncomment sg_rule_https_ingress in 'rules/main.tf'\r\n3. apply again and see the below.\r\n\r\nJust to highlight, the second rule I added was for port 443. For some reason terraform is re-creating the port 80 rule even through that was already created in step (1)\r\n\r\nAs always, I think this is a bug - but I understand I may have made a mistake.\r\n\r\n\r\nResult:\r\n```\r\nmodule.base.sg_rule_http_ingress.aws_security_group_rule.rule.0: Creating...\r\n  cidr_blocks.#:            \"\" => \"1\"\r\n  cidr_blocks.0:            \"\" => \"10.0.20.1/32\"\r\n  from_port:                \"\" => \"80\"\r\n  protocol:                 \"\" => \"tcp\"\r\n  security_group_id:        \"\" => \"sg-9b0d37fe\"\r\n  self:                     \"\" => \"0\"\r\n  source_security_group_id: \"\" => \"<computed>\"\r\n  to_port:                  \"\" => \"80\"\r\n  type:                     \"\" => \"ingress\"\r\nmodule.base.sg_rule_http_ingress.aws_security_group_rule.rule.1: Creating...\r\n  cidr_blocks.#:            \"\" => \"1\"\r\n  cidr_blocks.0:            \"\" => \"10.0.21.1/32\"\r\n  from_port:                \"\" => \"80\"\r\n  protocol:                 \"\" => \"tcp\"\r\n  security_group_id:        \"\" => \"sg-9b0d37fe\"\r\n  self:                     \"\" => \"0\"\r\n  source_security_group_id: \"\" => \"<computed>\"\r\n  to_port:                  \"\" => \"80\"\r\n  type:                     \"\" => \"ingress\"\r\nmodule.base.sg_rule_https_ingress.aws_security_group_rule.rule.0: Creating...\r\n  cidr_blocks.#:            \"\" => \"1\"\r\n  cidr_blocks.0:            \"\" => \"10.0.20.1/32\"\r\n  from_port:                \"\" => \"443\"\r\n  protocol:                 \"\" => \"tcp\"\r\n  security_group_id:        \"\" => \"sg-9b0d37fe\"\r\n  self:                     \"\" => \"0\"\r\n  source_security_group_id: \"\" => \"<computed>\"\r\n  to_port:                  \"\" => \"443\"\r\n  type:                     \"\" => \"ingress\"\r\nmodule.base.sg_rule_https_ingress.aws_security_group_rule.rule.1: Creating...\r\n  cidr_blocks.#:            \"\" => \"1\"\r\n  cidr_blocks.0:            \"\" => \"10.0.21.1/32\"\r\n  from_port:                \"\" => \"443\"\r\n  protocol:                 \"\" => \"tcp\"\r\n  security_group_id:        \"\" => \"sg-9b0d37fe\"\r\n  self:                     \"\" => \"0\"\r\n  source_security_group_id: \"\" => \"<computed>\"\r\n  to_port:                  \"\" => \"443\"\r\n  type:                     \"\" => \"ingress\"\r\n\r\nError applying plan:\r\n\r\n1 error(s) occurred:\r\n\r\n* 2 error(s) occurred:\r\n\r\n* 1 error(s) occurred:\r\n\r\n* Error authorizing security group rules rules: InvalidPermission.Duplicate: the specified rule \"peer: 10.0.21.1/32, TCP, from port: 80, to port: 80, ALLOW\" already exists\r\n\tstatus code: 400, request id: []\r\n* 1 error(s) occurred:\r\n\r\n* Error authorizing security group rules rules: InvalidPermission.Duplicate: the specified rule \"peer: 10.0.20.1/32, TCP, from port: 80, to port: 80, ALLOW\" already exists\r\n\tstatus code: 400, request id: []\r\n\r\n```\r\n\r\n\r\n\r\nmain.tf\r\n```\r\nprovider \"aws\" {\r\n    access_key = \"${var.access_key}\"\r\n    secret_key = \"${var.secret_key}\"\r\n    region = \"${var.region}\"\r\n}\r\n\r\nmodule \"base\" {\r\n    source = \"rules\"\r\n    vpc_name = \"${var.vpc_name}\"\r\n    vpc_id = \"${var.vpc_id}\"\r\n}\r\n```\r\n\r\nrules/main.tf\r\n```\r\nresource \"aws_security_group\" \"nat\" {\r\n     # See http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_NAT_Instance.html\r\n     name = \"${var.vpc_name}-sg_rule_bug\"\r\n     description = \"Allows SSH, HTTP, and HTTPS access from internal EC2 instances through the NAT\"\r\n     vpc_id = \"${var.vpc_id}\"\r\n}\r\n\r\nmodule \"sg_rule_http_ingress\" {\r\n    source = \"../host_security_group_rule\"\r\n    port = 80\r\n    ips = \"10.0.20.1,10.0.21.1\"\r\n    sg_id = \"${aws_security_group.nat.id}\"\r\n    type = \"ingress\"\r\n}\r\n\r\n/*\r\nmodule \"sg_rule_https_ingress\" {\r\n    source = \"../host_security_group_rule\"\r\n    port = 443\r\n    ips = \"10.0.20.1,10.0.21.1\"\r\n    sg_id = \"${aws_security_group.nat.id}\"\r\n    type = \"ingress\"\r\n}*/\r\n\r\n\r\nresource \"aws_subnet\" \"subnet\" {\r\n    vpc_id = \"${var.vpc_id}\"\r\n    cidr_block = \"10.0.90.0/24\"\r\n    availability_zone = \"eu-west-1a\"\r\n    map_public_ip_on_launch = true\r\n    tags {\r\n       Name = \"${var.vpc_name}-sg_bug-eu-west-1a-${count.index}\"\r\n    }\r\n    count = 1\r\n}\r\n\r\nresource \"aws_instance\" \"nat\" {\r\n    ami = \"ami-ef76e898\"\r\n    instance_type = \"t2.micro\"\r\n    key_name = \"aire-root\"\r\n    subnet_id = \"${element(aws_subnet.subnet.*.id, 0)}\"\r\n    security_groups = [\"${aws_security_group.nat.id}\"]\r\n    # See: http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_NAT_Instance.html\r\n    source_dest_check = false\r\n    tags {\r\n        Name = \"${var.vpc_name}-dmz-eu-west-1a-nat\"\r\n    }\r\n}\r\n\r\n```\r\n\r\nhost_security_group_rule/main.tf\r\n```\r\nresource \"aws_security_group_rule\" \"rule\" {\r\n    type = \"${var.type}\"\r\n    from_port = \"${var.port}\"\r\n    to_port = \"${var.port}\"\r\n    protocol = \"tcp\"\r\n    cidr_blocks = [\"${concat(element(split(\",\",var.ips), count.index), \"/32\")}\"]\r\n    security_group_id = \"${var.sg_id}\"\r\n    count = \"${length(split(\",\", var.ips))}\"\r\n}\r\n```"},"comment":{"url":"https://api.github.com/repos/hashicorp/terraform/issues/comments/114923419","html_url":"https://github.com/hashicorp/terraform/issues/2463#issuecomment-114923419","issue_url":"https://api.github.com/repos/hashicorp/terraform/issues/2463","id":114923419,"user":{"login":"timothykimball","id":84351,"avatar_url":"https://avatars.githubusercontent.com/u/84351?v=3","gravatar_id":"","url":"https://api.github.com/users/timothykimball","html_url":"https://github.com/timothykimball","followers_url":"https://api.github.com/users/timothykimball/followers","following_url":"https://api.github.com/users/timothykimball/following{/other_user}","gists_url":"https://api.github.com/users/timothykimball/gists{/gist_id}","starred_url":"https://api.github.com/users/timothykimball/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/timothykimball/subscriptions","organizations_url":"https://api.github.com/users/timothykimball/orgs","repos_url":"https://api.github.com/users/timothykimball/repos","events_url":"https://api.github.com/users/timothykimball/events{/privacy}","received_events_url":"https://api.github.com/users/timothykimball/received_events","type":"User","site_admin":false},"created_at":"2015-06-24T15:53:25Z","updated_at":"2015-06-24T15:53:25Z","body":"terraform 0.5.3"}}