Creating CloudWatch Log Group failed: ResourceAlreadyExistsException

[lucasvianna]

This problem should be related to hashicorp/terraform-provider-aws#7406, but this problem makes the update impossible.

With the version v5.0.0 I can't apply the changes because:

 Creating CloudWatch Log Group failed: ResourceAlreadyExistsException: The specified log group already exists
	status code: 400, request id: 89b8f8a6-820d-836a2f69df1b:  The CloudWatch Log Group '/aws/eks/cluster-name/cluster' already exists.

I'm submitting a...

• bug report
• feature request
• support request
• kudos, thank you, warm fuzzy

What is the current behavior?

If this is a bug, how to reproduce? Please include a code sample if relevant.

What's the expected behavior?

Are you able to fix this problem and submit a PR? Link here if you have already.

Environment details

Terraform v0.12.2
provider.aws v2.16.0

• Affected module version: v5.0.0
• OS: MacOS 10.14.5
• Terraform version: v0.12.2

Any other relevant info

[max-rocket-internet]

Yes it's a new resource that will clash with the one that already exists if you have logging already enabled. You can just import the resource to resolve the issue:

terraform import module.your_module.aws_cloudwatch_log_group.this "/aws/eks/cluster-name/cluster"

[jimmymills]

Whenever I run this import, I see a message for "Import complete!" and then during the refresh that runs as the second step of the import I run into #402 where I see in the output |---------------- | aws_security_group.cluster is empty tuple | var.cluster_security_group_id is "" and a similar error with |---------------- | aws_security_group.workers is empty tuple | var.worker_security_group_id is "" even though I am definitely passing in cluster_security_group_id and worker_security_group_id

[bagarYas]

I am also facing similar issue. this issue is mostly related to the resources log groups created by AWS. Since terraform has no control on these resources it fails stating log group already exists. I am facing an issues with /aws/lamda/xxxxx

[chewmanfoo]

@bagarYas what was the resolution? I'm facing this issue with Lambda LogGroups created automatically by the AWS API when a Lambda Function is created, trying to manage them after they were created outside of terraform. I see the message, I import them, I try again and I see the message again.

[barneyparker]

If you are providing logs:CreateLogGroup permission, you are explicitly allowing AWS to create the log group under the IAM role/policy. Without that permission AWS wont actually create the log group on your behalf, and the operation would fail internally (and silently except within CloudTrail).

This does mean you need to explicitly create the correct log group in Terraform, but this is already being done, otherwise you wouldn't be seeing the error!

[bilalbayasut]

I tried to do the import, but it always asking the env var, and the cli has no option to add --var-file, any idea ?

[barneyparker]

@bilalbayasut that is a slightly annoying import feature - having to provide variable values because you can't include .tfvars files etc!

All you can do here is know what they should be, and when prompted, type the missing values

You could add a temporary .tf file with the missing vars preset just to get you past the import

Ideally you should let Terraform create the resource, so you could delete the log group and then apply quickly - which isn't ideal....

[bilalbayasut]

I've solved this by removing the log groups in aws console, and renaming the name property in log_groups resource in terraform, and then applied it

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[daroga0002]

In current version of module (and few back) it is handled by creating a cloudwatch log group before creating a EKS so this should avoid such situations so closing this issue.

Code is here:

terraform-aws-eks/cluster.tf

Line 51 in 1d848b5

aws_cloudwatch_log_group.this

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues. If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.