{"action":"created","issue":{"url":"https://api.github.com/repos/hashicorp/terraform/issues/3925","labels_url":"https://api.github.com/repos/hashicorp/terraform/issues/3925/labels{/name}","comments_url":"https://api.github.com/repos/hashicorp/terraform/issues/3925/comments","events_url":"https://api.github.com/repos/hashicorp/terraform/issues/3925/events","html_url":"https://github.com/hashicorp/terraform/issues/3925","id":116941611,"number":3925,"title":"as_db_instance does not honour vpc_security_group_ids","user":{"login":"philp","id":100245,"avatar_url":"https://avatars.githubusercontent.com/u/100245?v=3","gravatar_id":"","url":"https://api.github.com/users/philp","html_url":"https://github.com/philp","followers_url":"https://api.github.com/users/philp/followers","following_url":"https://api.github.com/users/philp/following{/other_user}","gists_url":"https://api.github.com/users/philp/gists{/gist_id}","starred_url":"https://api.github.com/users/philp/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/philp/subscriptions","organizations_url":"https://api.github.com/users/philp/orgs","repos_url":"https://api.github.com/users/philp/repos","events_url":"https://api.github.com/users/philp/events{/privacy}","received_events_url":"https://api.github.com/users/philp/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/hashicorp/terraform/labels/bug","name":"bug","color":"f7c6c7"},{"url":"https://api.github.com/repos/hashicorp/terraform/labels/provider/aws","name":"provider/aws","color":"bfdadc"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-11-14T17:58:22Z","updated_at":"2015-12-09T17:56:32Z","closed_at":null,"body":"Part of my configuration looks something like this:\r\n\r\n```\r\nresource \"aws_db_subnet_group\" \"my-db-rds\" {\r\n    name        = \"rds-main\"\r\n    description = \"The RDS subnets\"\r\n    subnet_ids  = [\"${split(\",\", module.vpc.public_subnets)}\"]\r\n}\r\n\r\nresource \"aws_db_instance\" \"my-db\" {\r\n    identifier                  = \"my-rds-instance\"\r\n    allocated_storage           = \"5\"\r\n    engine                      = \"mysql\"\r\n    engine_version              = \"5.6.23\"\r\n    instance_class              = \"${var.instance_type.rds_server}\"\r\n    name                        = \"${var.db_name}\"\r\n    username                    = \"${var.db_user}\"\r\n    password                    = \"${var.db_pass}\"\r\n    vpc_security_group_ids      = [\"${aws_security_group.my-sg.id}\"]\r\n    db_subnet_group_name        = \"${aws_db_subnet_group.my-db-rds.id}\"\r\n}\r\n```\r\n\r\nThe first time I run this, the `vpc_security_group_ids` property is not honoured. Instead my default security group is used. If I run `terraform apply` a second time (without making any changes) then the property *does* get applied."},"comment":{"url":"https://api.github.com/repos/hashicorp/terraform/issues/comments/163340016","html_url":"https://github.com/hashicorp/terraform/issues/3925#issuecomment-163340016","issue_url":"https://api.github.com/repos/hashicorp/terraform/issues/3925","id":163340016,"user":{"login":"catsby","id":61721,"avatar_url":"https://avatars.githubusercontent.com/u/61721?v=3","gravatar_id":"","url":"https://api.github.com/users/catsby","html_url":"https://github.com/catsby","followers_url":"https://api.github.com/users/catsby/followers","following_url":"https://api.github.com/users/catsby/following{/other_user}","gists_url":"https://api.github.com/users/catsby/gists{/gist_id}","starred_url":"https://api.github.com/users/catsby/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/catsby/subscriptions","organizations_url":"https://api.github.com/users/catsby/orgs","repos_url":"https://api.github.com/users/catsby/repos","events_url":"https://api.github.com/users/catsby/events{/privacy}","received_events_url":"https://api.github.com/users/catsby/received_events","type":"User","site_admin":false},"created_at":"2015-12-09T17:56:32Z","updated_at":"2015-12-09T17:56:32Z","body":"Hello –\r\n\r\nI'm unable to reproduce this on the master branch at this time. I tried with the following config:\r\n\r\n```hcl\r\nprovider \"aws\" {\r\n  alias  = \"west\"\r\n  region = \"us-west-2\"\r\n}\r\n\r\noutput \"endpoint\" {\r\n  value = \"${aws_db_instance.pg_2_master.endpoint}\"\r\n}\r\n\r\noutput \"db_arn\" {\r\n  value = \"${aws_db_instance.pg_2_master.arn}\"\r\n}\r\n\r\nresource \"aws_db_instance\" \"pg_2_master\" {\r\n  provider   = \"aws.west\"\r\n  identifier = \"mysql-source\"\r\n\r\n  ## CONSTANTS\r\n  engine                 = \"mysql\"\r\n  multi_az               = false\r\n  publicly_accessible    = false\r\n  name                   = \"baz\"\r\n  password               = \"barbarbarbar\"\r\n  username               = \"foo\"\r\n  db_subnet_group_name   = \"${aws_db_subnet_group.rds_public_subnet_group.name}\"\r\n  vpc_security_group_ids = [\"${aws_security_group.main.id}\"]\r\n\r\n  apply_immediately = true\r\n\r\n  ## TUNABLES WITH NO INTERRUPTION\r\n  allocated_storage = 10\r\n\r\n  ## TUNABLES WITH SOME INTERRUPTION\r\n  instance_class          = \"db.t1.micro\"\r\n  storage_type            = \"gp2\"\r\n  backup_retention_period = 1\r\n}\r\n\r\nresource \"aws_db_subnet_group\" \"rds_public_subnet_group\" {\r\n  provider    = \"aws.west\"\r\n  name        = \"aurora-rds-public-subnetgroup\"\r\n  description = \"Public subnets for RDS instance\"\r\n\r\n  subnet_ids = [\r\n    \"${aws_subnet.main.id}\",\r\n    \"${aws_subnet.other.id}\",\r\n    \"${aws_subnet.third.id}\",\r\n  ]\r\n\r\n  lifecycle {\r\n    create_before_destroy = true\r\n  }\r\n}\r\n\r\nresource \"aws_subnet\" \"main\" {\r\n  provider          = \"aws.west\"\r\n  vpc_id            = \"${aws_vpc.foo.id}\"\r\n  availability_zone = \"us-west-2a\"\r\n  cidr_block        = \"10.0.1.0/24\"\r\n\r\n  tags {\r\n    Name = \"subnet-count-test\"\r\n  }\r\n\r\n  lifecycle {\r\n    create_before_destroy = true\r\n  }\r\n}\r\n\r\nresource \"aws_subnet\" \"other\" {\r\n  provider          = \"aws.west\"\r\n  vpc_id            = \"${aws_vpc.foo.id}\"\r\n  availability_zone = \"us-west-2b\"\r\n  cidr_block        = \"10.0.2.0/24\"\r\n\r\n  tags {\r\n    Name = \"subnet-count-test-other\"\r\n  }\r\n\r\n  lifecycle {\r\n    create_before_destroy = true\r\n  }\r\n}\r\n\r\nresource \"aws_subnet\" \"third\" {\r\n  provider          = \"aws.west\"\r\n  vpc_id            = \"${aws_vpc.foo.id}\"\r\n  availability_zone = \"us-west-2c\"\r\n  cidr_block        = \"10.0.3.0/24\"\r\n\r\n  tags {\r\n    Name = \"subnet-count-test-other\"\r\n  }\r\n\r\n  lifecycle {\r\n    create_before_destroy = true\r\n  }\r\n}\r\n\r\nresource \"aws_vpc\" \"foo\" {\r\n  provider             = \"aws.west\"\r\n  cidr_block           = \"10.0.0.0/16\"\r\n  enable_dns_hostnames = true\r\n\r\n  tags {\r\n    Name = \"rds-subnet-vpc\"\r\n  }\r\n\r\n  lifecycle {\r\n    create_before_destroy = true\r\n  }\r\n}\r\n\r\nresource \"aws_security_group\" \"main\" {\r\n  provider    = \"aws.west\"\r\n  name        = \"rds-sg\"\r\n  description = \"Allow MySQL traffic to rds\"\r\n  vpc_id      = \"${aws_vpc.foo.id}\"\r\n\r\n  lifecycle {\r\n    create_before_destroy = true\r\n  }\r\n}\r\n```\r\n\r\nThe database correctly gets placed in the VPC. \r\nCan you please check that your vpc_security_group_ids are Security Groups in that VPC, and that the `db_subnet_group_name` also is a subnet group with subnets in that VPC? I imagine it would error otherwise, but I thought I'd ask. "}}