{"action":"created","issue":{"url":"https://api.github.com/repos/hashicorp/terraform/issues/3019","labels_url":"https://api.github.com/repos/hashicorp/terraform/issues/3019/labels{/name}","comments_url":"https://api.github.com/repos/hashicorp/terraform/issues/3019/comments","events_url":"https://api.github.com/repos/hashicorp/terraform/issues/3019/events","html_url":"https://github.com/hashicorp/terraform/pull/3019","id":101677212,"number":3019,"title":"provider/aws: Update Security Group Rules to Version 2","user":{"login":"catsby","id":61721,"avatar_url":"https://avatars.githubusercontent.com/u/61721?v=3","gravatar_id":"","url":"https://api.github.com/users/catsby","html_url":"https://github.com/catsby","followers_url":"https://api.github.com/users/catsby/followers","following_url":"https://api.github.com/users/catsby/following{/other_user}","gists_url":"https://api.github.com/users/catsby/gists{/gist_id}","starred_url":"https://api.github.com/users/catsby/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/catsby/subscriptions","organizations_url":"https://api.github.com/users/catsby/orgs","repos_url":"https://api.github.com/users/catsby/repos","events_url":"https://api.github.com/users/catsby/events{/privacy}","received_events_url":"https://api.github.com/users/catsby/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/hashicorp/terraform/labels/bug","name":"bug","color":"f7c6c7"},{"url":"https://api.github.com/repos/hashicorp/terraform/labels/provider/aws","name":"provider/aws","color":"bfdadc"},{"url":"https://api.github.com/repos/hashicorp/terraform/labels/waiting-response","name":"waiting-response","color":"5319e7"}],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":10,"created_at":"2015-08-18T15:01:52Z","updated_at":"2015-10-18T07:06:08Z","closed_at":"2015-10-12T21:03:12Z","pull_request":{"url":"https://api.github.com/repos/hashicorp/terraform/pulls/3019","html_url":"https://github.com/hashicorp/terraform/pull/3019","diff_url":"https://github.com/hashicorp/terraform/pull/3019.diff","patch_url":"https://github.com/hashicorp/terraform/pull/3019.patch"},"body":"This patch aims to resolve a lingering issue with Security Group Rules, \r\nwhere different resources generate rules that are consolidated on Amazon's \r\nside, as a result resulting in loss of local resources in the state file \r\nand duplication errors on AWS's side. \r\n\r\nExample:\r\n\r\n```\r\nresource \"aws_security_group_rule\" \"first\" {\r\n    type        = \"ingress\"\r\n    from_port   = 80\r\n    to_port     = 80\r\n    protocol    = \"tcp\"\r\n    cidr_blocks = [\"10.0.2.0/24\", \"10.0.3.0/24\"]\r\n\r\n   security_group_id = \"${aws_security_group.nat.id}\"\r\n}\r\n```\r\n\r\nAfter applying this rule, our security group `nat` looks like this:\r\n\r\n```\r\n{\r\n  Description: \"Managed by Terraform\",\r\n  GroupId: \"sg-87eb46e3\",\r\n  GroupName: \"secg-nat\",\r\n  IpPermissions: [{\r\n      FromPort: 80,\r\n      IpProtocol: \"tcp\",\r\n      IpRanges: [{\r\n          CidrIp: \"10.0.2.0/24\"\r\n        },{\r\n          CidrIp: \"10.0.3.0/24\"\r\n        }],\r\n      ToPort: 80\r\n    }],\r\n  OwnerId: \"470663696735\",\r\n  VpcId: \"vpc-0806716d\"\r\n}\r\n```\r\n\r\nThis rule, with 2 `cidr_block` entires, is a single IPPermission rule according to the API.\r\n\r\nAt present, the Security Group Rule resource hashes it's values (ports, cidrs, security groups) \r\nto generate a key. This breaks down however, when another rule is added with a new `cidr_block`. \r\n\r\nNow, adding a second rule that also uses a `cidr_block` like so, will reveal the bug:\r\n\r\n```\r\nresource \"aws_security_group_rule\" \"second\" {\r\n    type        = \"ingress\"\r\n    from_port   = 80\r\n    to_port     = 80\r\n    protocol    = \"tcp\"\r\n    cidr_blocks = [\"10.0.5.0/24\"]\r\n\r\n   security_group_id = \"${aws_security_group.nat.id}\"\r\n}\r\n```\r\n\r\nThe IPPermissions now look like this:\r\n\r\n```\r\nFull Security Group: {\r\n  Description: \"Managed by Terraform\",\r\n  GroupId: \"sg-87eb46e3\",\r\n  GroupName: \"secg-nat\",\r\n  IpPermissions: [{\r\n      FromPort: 80,\r\n      IpProtocol: \"tcp\",\r\n      IpRanges: [{\r\n          CidrIp: \"10.0.2.0/24\"\r\n        },{\r\n          CidrIp: \"10.0.3.0/24\"\r\n        },{\r\n          CidrIp: \"10.0.5.0/24\"\r\n        }],\r\n      ToPort: 80\r\n    }],\r\n  OwnerId: \"470663696735\",\r\n  VpcId: \"vpc-0806716d\"\r\n}\r\n```\r\n\r\nThe API has consolidated this new `cidr_block` into an existing rule, based on the port and \r\nprotocol it applies to. Because of the way Terraform hashes the rules locally, it can no longer find \r\neither resource, as it hashes the **entire IPPermission** looking for a match.\r\n\r\nThis pull request resolves this by iterating through `IpPermissions` and looking for matching criteria, \r\nensuring that each `cidr_block` or `security_group_id` is found in a set. \r\n\r\nThis patch also fixes another issue, where similar rules applied to different security groups caused the \r\nsame kind of conflict, because we were not hashing the security group id itself into the id of the rule. \r\nWe now consider the id in the hash for the rule to avoid this. \r\n\r\nRefs:\r\n\r\n- https://github.com/hashicorp/terraform/issues/2584#issuecomment-120088474\r\n- https://github.com/hashicorp/terraform/issues/2837\r\n- https://github.com/hashicorp/terraform/issues/2463"},"comment":{"url":"https://api.github.com/repos/hashicorp/terraform/issues/comments/148986060","html_url":"https://github.com/hashicorp/terraform/pull/3019#issuecomment-148986060","issue_url":"https://api.github.com/repos/hashicorp/terraform/issues/3019","id":148986060,"user":{"login":"scalp42","id":1475276,"avatar_url":"https://avatars.githubusercontent.com/u/1475276?v=3","gravatar_id":"","url":"https://api.github.com/users/scalp42","html_url":"https://github.com/scalp42","followers_url":"https://api.github.com/users/scalp42/followers","following_url":"https://api.github.com/users/scalp42/following{/other_user}","gists_url":"https://api.github.com/users/scalp42/gists{/gist_id}","starred_url":"https://api.github.com/users/scalp42/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/scalp42/subscriptions","organizations_url":"https://api.github.com/users/scalp42/orgs","repos_url":"https://api.github.com/users/scalp42/repos","events_url":"https://api.github.com/users/scalp42/events{/privacy}","received_events_url":"https://api.github.com/users/scalp42/received_events","type":"User","site_admin":false},"created_at":"2015-10-18T07:06:08Z","updated_at":"2015-10-18T07:06:08Z","body":"@radeksimko I tried to taint the SGs (not the rules)."}}