WAFv2 is deleted & re-created after doing a plan/apply when editing rules thus changing the ARN

[cisnerosk]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform CLI and Terraform AWS Provider Version

terraform version: Terraform v0.12.27
terraform AWS provider version: 2.68

Affected Resource(s)

• aws_wafv2_web_acl

Terraform Configuration Files

resource "aws_wafv2_web_acl" "example" {
    name = "example"
    description = "This is managed by Terraform"
    scope = "REGIONAL"

    default_action {
        allow {}
    }

    rule {
        name = "example"
        priority = 1

        action {
            block {}
        }

        statement {
            geo_match_statement {
                country_codes = ["US"]
            }
        }
        visibility_config {
            cloudwatch_metrics_enabled = true
            metric_name = "example"
            sampled_requests_enabled = true 
        }
    }

    rule {
        name = "AWSManagedRulesLinuxRuleSet"
        priority = 2

        override_action {
            count {}
        }

        statement {
            managed_rule_group_statement {
                name = "AWSManagedRulesLinuxRuleSet"
                vendor_name = "AWS"
            }
        }

        visibility_config {
            cloudwatch_metrics_enabled = true
            metric_name = "AWSManagedRulesLinuxRuleSet"
            sampled_requests_enabled = true
        }
    }

    visibility_config {
        cloudwatch_metrics_enabled = true
        metric_name = "example"
        sampled_requests_enabled = true
    }

}

resource "aws_wafv2_web_acl_association" "example" {
    resource_arn = example
    web_acl_arn = aws_wafv2_web_acl.example.arn
    depends_on = [
        aws_wafv2_web_acl.example
    ]
}

Expected Behavior

My WAFv2 should have retained the same ID and not be destroyed/recreated after minor changes such as a rule addition/deletion. If I manually add a rule in the console, it does not recreate the WAF. The re-creation process is not ideal because the association has to happen again, so there is a period of time where the resources are not protected and when enhanced logging is enabled, there is a period of time where logging is also not working since the WAF doesn't exist anymore.

Actual Behavior

  # aws_wafv2_web_acl.example must be replaced
-/+ resource "aws_wafv2_web_acl" "example" {
      ~ arn         = "arn:aws:wafv2:region:account:regional/webacl/example/original-id-string-b44" -> (known after apply)
      ~ capacity    = 1447 -> (known after apply)
        description = "This is managed by Terraform"
      ~ id          = "original-id-string-b44" -> (known after apply)
      ~ lock_token  = "lock-token-string" -> (known after apply)
        name        = "example"
        scope       = "REGIONAL"

        default_action {
            allow {}
        }

      - rule { # forces replacement
          - name     = "example" -> null
          - priority = 0 -> null

          - action {

              - block {}
            }

          - statement {

              - geo_match_statement {
                  - country_codes = [
                      - "US"
                    ] -> null
                }
            }

          - visibility_config {
              - cloudwatch_metrics_enabled = true -> null
              - metric_name                = "example" -> null
              - sampled_requests_enabled   = true -> null
            }
        }
      + rule { # forces replacement
          + name     = "example"
          + priority = 1

          + action {

              + block {}
            }

          + statement {

              + geo_match_statement {
                  + country_codes = [
                      + "US"
                    ]
                }
            }

          + visibility_config {
              + cloudwatch_metrics_enabled = true
              + metric_name                = "example"
              + sampled_requests_enabled   = true
            }
        }

        rule {
            name     = "AWSManagedRulesLinuxRuleSet"
            priority = 2

            override_action {
                count {}
            }

            statement {

                managed_rule_group_statement {
                    name        = "AWSManagedRulesLinuxRuleSet"
                    vendor_name = "AWS"
                }
            }

            visibility_config {
                cloudwatch_metrics_enabled = true
                metric_name                = "AWSManagedRulesLinuxRuleSet"
                sampled_requests_enabled   = true
            }
        }

        visibility_config {
            cloudwatch_metrics_enabled = true
            metric_name                = "example"
            sampled_requests_enabled   = true
        }
    }

  # aws_wafv2_web_acl_association.example must be replaced
-/+ resource "aws_wafv2_web_acl_association" "example" {
      ~ id           = "arn:aws:wafv2:region:account:regional/webacl/example/original-id-string-b44,arn:aws:elasticloadbalancing:region:account:loadbalancer/app/lb-name/lb-name-string-id" -> (known after apply)
        resource_arn = "arn:aws:elasticloadbalancing:region:account:loadbalancer/app/lb-name/lb-name-string-id"
      ~ web_acl_arn  = "arn:aws:wafv2:region:account:regional/webacl/example/original-id-string-b44" -> (known after apply) # forces replacement
    }

Steps to Reproduce

1. Change priority of rules or add a new rule to an existing WAFv2 managed by Terraform.
2. Do a plan to see the "known after apply" for the ARN on the WAFv2.
3. Do an apply to see that your ID has changed in the AWS console.

[anGie44]

Hi @cisnerosk, thanks for creating an issue! Making a quick pass it looks like this relates to an issue that's now been addressed in v3.2.0 of the AWS Provider (reference: #13936) . do note that upgrading from 2.68.0 brings along the challenging issue we're still facing with #14062

[cisnerosk]

I missed this issue, apologies! Thank you for letting me know! 😄

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thanks!