Not idempotent for aws_route_table_association

[ghost]

This issue was originally opened by @RuBiCK as hashicorp/terraform#19435. It was migrated here as a result of the provider split. The original body of the issue is below.

---

Terraform Version

Terraform v0.11.10

• provider.aws v1.46.0

Affected resources

aws_route_table_association

Expected Behavior

I have a var that defines subnets with tags to indicate if a subnet is public
I create a resource aws_route_table that I associate to certain subnets found by data aws_subnet_ids
It's expected to be idempotent if I run many times terraform apply
The subnet id to be associated needs to be computed (in my case) and after gather all information, terraform should check that association exists or not instead of delete and create the same association.

Actual Behavior

Between first and second apply the route_table_association gets removed and recreated again for each apply:

plan:

-/+ aws_route_table_association.public-rt (new resource required)
      id:                   "rtbassoc-00fa56a88a4080a05" => <computed> (forces new resource)
      route_table_id:       "rtb-044e7ab173eb7dd2e" => "rtb-044e7ab173eb7dd2e"
      subnet_id:            "subnet-0b8bee3f1d5b755ec" => "${data.aws_subnet_ids.public.ids[count.index]}" (forces new resource)

apply:

aws_route_table_association.public-rt: Creating...
  route_table_id: "" => "rtb-044e7ab173eb7dd2e"
  subnet_id:      "" => "subnet-0b8bee3f1d5b755ec"
...
aws_route_table_association.public-rt: Creation complete after 5s (ID: rtbassoc-03e0dbad4543d6ff4)

Steps to Reproduce

1. terraform plan
2. terraform apply
3. terraform apply

Output
Debug log

Additional Context

data "aws_subnet_ids" "public" {
  depends_on = ["aws_subnet.subnet"] //creation of subnets
  vpc_id = "${aws_vpc.main.id}"
  tags {
    public = true
  }
}

resource "aws_route_table_association" "public-rt" {
  /*
  workaround count can't be computed
 https:/hashicorp/terraform/issues/10857#issuecomment-368059147
  count = "${length(data.aws_subnet_ids.public.ids)}"
  */
  count = "${var.subnets_public_count}"
  subnet_id = "${data.aws_subnet_ids.public.ids[count.index]}"
  route_table_id = "${aws_route_table.public-route.id}"
}

References

• Terraform apply not idempotent for security groups terraform#13966

[aries1980]

I think this is related to #561 .

[bflad]

Hi folks 👋 My suggestion here would be to try this in Terraform 0.12 and later to see if the issue still persists. There are also notable improvements for the aws_route_table_association resource releasing in version 2.20.0 of the Terraform AWS Provider tomorrow. If you are still encountering issues, please feel free to open a new Bug Report following the issue template for further triage.

Of note: Terraform 0.12.6 which was just released, now has support for the resource-level for_each argument. This can be used so resources are indexed in the Terraform state based on a string map or set, rather than the simple numeric list with the resource-level count argument. Resources switched to for_each over count will no longer have issues with removing elements in the middle of a list or general rearranging of elements as the resource index keys are stable.

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thanks!