terraform-provider-aws: aws_wafv2_web_acl - Error: Provider produced inconsistent final plan

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave “+1” or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Related:

• #23390 (42)
• #23423 (16)
• #23936 (16)
• 👉 #23992 (117)
• #24386 (13)
• #27175 (27)
• #27273 (42)
• #27479 (20)
• #28191 (34)
• #28672 (23)
• #29012 (9)
• #29304 (43)
• #30858 (5)

Terraform CLI and Terraform AWS Provider Version

Terraform version 1.1.7 provider registry.terraform.io/hashicorp/aws v4.8.0

Affected Resource(s)

• aws_wafv2_web_acl

Terraform Configuration Files

Please include all Terraform configurations required to reproduce the bug. Bug reports without a functional reproduction may be closed without investigation.

resource "aws_wafv2_ip_set" "ip_whitelist" {
  name = "IP-whitelist"
  provider  = aws.virginia
  scope = "CLOUDFRONT"
  ip_address_version = "IPV4"
  addresses = var.stage == "prod" || var.stage == "cons" ? ["xxx.xxx.xxx.xxx/32"] : ["0.0.0.0/1", "128.0.0.0/1"]
}

resource "aws_wafv2_web_acl" "whitelist_waf_acls" {
  name = "Whitelist-WAF-ACLs"
  provider = aws.virginia
  scope = "CLOUDFRONT"

  default_action {
    block {}
  }

  rule {
    name = "Whitelist-WAF-ACLs-rule"
    priority = 0

    action {
      allow {}
    }

    statement {
      ip_set_reference_statement { 
        arn = aws_wafv2_ip_set.ip_whitelist.arn
      }
    }

    visibility_config {
      cloudwatch_metrics_enabled = true
      metric_name = "Whitelist-WAF-ACLs-rule"
      sampled_requests_enabled = true
    }
  }

  rule {
    name     = "AWSManagedRulesBotControlRuleSet"
    priority = 1

    override_action {
      count {}
    }

    statement {
      managed_rule_group_statement {
        name        = "AWSManagedRulesBotControlRuleSet"
        vendor_name = "AWS"
      }
    }

    visibility_config {
      cloudwatch_metrics_enabled = true
      metric_name                = "Whitelist-WAF-ACLs-menaged-rule"
      sampled_requests_enabled   = true
    }
  }

  rule {
    name     = "AWSManagedRulesAdminProtectionRuleSet"
    priority = 2

    override_action {
      count {}
    }

    statement {
      managed_rule_group_statement {
        name        = "AWSManagedRulesAdminProtectionRuleSet"
        vendor_name = "AWS"
      }
    }

    visibility_config {
      cloudwatch_metrics_enabled = true
      metric_name                = "Whitelist-WAF-ACLs-menaged-rule"
      sampled_requests_enabled   = true
    }
  }

  rule {
    name     = "AWSManagedRulesAmazonIpReputationList"
    priority = 3

    override_action {
      count {}
    }

    statement {
      managed_rule_group_statement {
        name        = "AWSManagedRulesAmazonIpReputationList"
        vendor_name = "AWS"
      }
    }

    visibility_config {
      cloudwatch_metrics_enabled = true
      metric_name                = "Whitelist-WAF-ACLs-menaged-rule"
      sampled_requests_enabled   = true
    }
  }

  rule {
    name     = "AWSManagedRulesAnonymousIpList"
    priority = 4

    override_action {
      count {}
    }

    statement {
      managed_rule_group_statement {
        name        = "AWSManagedRulesAnonymousIpList"
        vendor_name = "AWS"
      }
    }

    visibility_config {
      cloudwatch_metrics_enabled = true
      metric_name                = "Whitelist-WAF-ACLs-menaged-rule"
      sampled_requests_enabled   = true
    }
  }

  rule {
    name     = "AWSManagedRulesCommonRuleSet"
    priority = 5

    override_action {
      count {}
    }

    statement {
      managed_rule_group_statement {
        name        = "AWSManagedRulesCommonRuleSet"
        vendor_name = "AWS"
      }
    }

    visibility_config {
      cloudwatch_metrics_enabled = true
      metric_name                = "Whitelist-WAF-ACLs-menaged-rule"
      sampled_requests_enabled   = true
    }
  }

  rule {
    name     = "AWSManagedRulesKnownBadInputsRuleSet"
    priority = 6

    override_action {
      count {}
    }

    statement {
      managed_rule_group_statement {
        name        = "AWSManagedRulesKnownBadInputsRuleSet"
        vendor_name = "AWS"
      }
    }

    visibility_config {
      cloudwatch_metrics_enabled = true
      metric_name                = "Whitelist-WAF-ACLs-menaged-rule"
      sampled_requests_enabled   = true
    }
  }

  rule {
    name     = "AWSManagedRulesSQLiRuleSet"
    priority = 7

    override_action {
      count {}
    }

    statement {
      managed_rule_group_statement {
        name        = "AWSManagedRulesSQLiRuleSet"
        vendor_name = "AWS"
      }
    }

    visibility_config {
      cloudwatch_metrics_enabled = true
      metric_name                = "Whitelist-WAF-ACLs-menaged-rule"
      sampled_requests_enabled   = true
    }
  }

  visibility_config {
    cloudwatch_metrics_enabled = true
    metric_name = "Whitelist-WAF-ACLs-metric"
    sampled_requests_enabled = true
  }

  tags = {
    Name = "whitelist_waf_acls"
  }

  depends_on = [aws_wafv2_ip_set.ip_whitelist]
}

Debug Output

Panic Output

Expected Behavior

I am trying to make a update to the config, this particular change is for removing tags

Terraform will perform the following actions:

  # aws_wafv2_web_acl.whitelist_waf_acls will be updated in-place
  ~ resource "aws_wafv2_web_acl" "whitelist_waf_acls" {

        id         = "xxxxxx-xxxxxx-xxxxx-xxxxxx"

        name       = "Whitelist-WAF-ACLs"

      ~ tags       = {
          - "Application" = "xxxx" -> null
          - "Cost Center" = "xxxx" -> null
          - "Environment" = "dev" -> null
          - "Owner"       = "xxxxx@xxx.xx" -> null
          - "Project"     = "xxxxx" -> null
          - "TeamName"    = "xxxxx" -> null
          - "Entity" = "xxx" -> null
            # (1 unchanged element hidden)
        }
      ~ tags_all   = {
          - "Application" = "xxxx" -> null
          - "Cost Center" = "xxx" -> null
          - "Environment" = "dev" -> null
          - "Owner"       = "xxxx@xx.xx" -> null
          - "Project"     = "xxxx" -> null
          - "TeamName"    = "xxxx" -> null
          - "Entity" = "xxx" -> null
            # (1 unchanged element hidden)
        }

Actual Behavior

It does not deploy, it throws the error;

When expanding the plan for aws_wafv2_web_acl.whitelist_waf_acls to include new values learned so far during apply, provider "registry.terraform.io/hashicorp/aws" produced an invalid new value for .rule: planned set element

cty.ObjectVal(map[string]cty.Value{"action":cty.ListValEmpty(cty.Object(map[string]cty.Type{"allow":cty.List(cty.Object(map[string]cty.Type{"custom_request_handling":cty.List(cty.Object(map[string]cty.Type{"insert_header":cty.Set(cty.Object(map[string]cty.Type{"name":cty.String, "value":cty.String}))}))})), "block":cty.List(cty.Object(map[string]cty.Type{"custom_response":cty.List(cty.Object(map[string]cty.Type{"custom_response_body_key":cty.String, "response_code":cty.Number,
.
.
.
"text_transformation":cty.Set(cty.Object(map[string]cty.Type{"priority":cty.Number, "type":cty.String}))}))})}), "visibility_config":cty.ListVal([]cty.Value{cty.ObjectVal(map[string]cty.Value{"cloudwatch_metrics_enabled":cty.True, "metric_name":cty.StringVal("Whitelist-WAF-ACLs-menaged-rule"), "sampled_requests_enabled":cty.True})})}) does not correlate with any element in actual.

 This is a bug in the provider, which should be reported in the provider's own issue tracker.

Steps to Reproduce

1. terraform apply

Important Factoids

References