terraform-provider-aws: Encrypted flag cannot be specified since device /dev/sda1 has a snapshot specified

I have had to go back to launch configurations which is not desired, but unfortunately necessary. this is a pretty big deal and is hampering our usage of launch templates. any prioritization for fixing this would be greatly appreciated.

This has been released in version 1.34.0 of the AWS provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

@yardensachs We kept using good old AWS launch configurations instead of launch templates for configuring our ASG instances.

https://www.terraform.io/docs/providers/aws/r/launch_configuration.html

Terraform v0.11.8

• provider.aws v1.37.0

Still seeing this issue after setting encrypted=true in the launch template.

provider.aws v1.38.0 I’m also seeing it after setting encrypted=true or encrypted=false in the launch template. The only way I get success is to set encrypted=“” which shows up in the AWS console as ‘Default’.

@bflad @terraformbot @tf-release-bot Facing the same issue. Removing the block_device_mappings argument fixed it (but I can no longer tweak the root volume size). Hope this issue can be fixed ASAP

The fix for this has been merged into master and will release with version 1.34.0 of the AWS provider, likely later today.

Bug fix pull request submitted: #5632

This must get fixed, in order to use aws_launch_template in a fully automated way. I do want to tweak the root device volume size and not to remove it and need to have this done automatically and not in a manual way

Same here.

Also same: Removing the block_device_mappings argument fixed it (but I can no longer tweak the root volume size).

Ok so I found a way to complete this automatically, although its very hacky.

I figured out the issue here is because terraform auto defaults the encryption if you dont pass an option in, which it shouldnt.

if you use the aws cli to create a new template version, and overwrite the ebs volume options with no encryption passed in, the correct option will be put into the template and will allow you to spin up instance.

So to solve this automatically, I added a local-exec to my launch template that will run the aws command, update the ebs volume with the same name and not pass in the encryption method, and now it works.

resource "aws_launch_template" "launch_temp" {
  name     = "launch_Temp"
  image_id = "${var.ami_ubuntu}"
  key_name = "${var.key_name}"

  instance_type = "t2.2xlarge"

  block_device_mappings {
    device_name = "/dev/sda1"
    ebs {
      volume_size           = 200
      volume_type           = "gp2"
      delete_on_termination = "true"
    }
  }
  vpc_security_group_ids = [
    "${aws_security_group.test.id}",
  ]

  user_data = "${base64encode(data.template_file.userdata.rendered)}"

  provisioner "local-exec" {
    command = "sleep 10; aws ec2 create-launch-template-version --launch-template-id ${aws_launch_template.swarm_manager_launch.id} --version-description turnOffEncryption --source-version 1 --launch-template-data '{\"BlockDeviceMappings\": [{\"DeviceName\": \"/dev/sda1\", \"Ebs\": { \"VolumeSize\": 200, \"VolumeType\": \"gp2\" }}]}'"
  }
}

The sleep 10 was to fix an issues with the id interpolation that I think I found with this resource type. You could probably just remove the ebs block inside the terraform template and just use the aws cli to update the created template with the block if you wanted.

Hit the same problem today with the workaround mentioned above; editing the launch template in AWS Console then continue with Terraform.

I ran into the same issue and the following workaround process did the trick :

• create the launch template via terraform without using it in other resources (so don’t create resources that need it in the same “apply” command)
• in the aws console manually unset the flag encryption and save the new version
• back to terraform : create the other resources that depend on the launch template

You will see that terraform does not complain about the encryption flag difference on your already created template.

Please note that evreytime you update the launch template with terraform, the same manual trick will be needed in the aws console.

Seems above PR has been hold for a while. When can we get it merged?

We are in terraform 0.12.x now. Hope the fix can work in 0.12 directly.

PR submitted: https://github.com/hashicorp/terraform-aws-vault/pull/97

I ran into this issue and came across this when searching for the error code BUT I was using AWS CLI; not Terraform.

So this issue is really an issue with AWS API itself; in AWS CLI I was able to resolved it by removing the encrypted field altogether. In Terraform it would probably require some code change so that it does not always set encrypted field by default.

Facing the same issue. Removing the block_device_mappings argument fixed it (but I can no longer tweak the root volume size).