When modifying a VPC to add IPv6 terraform exits with an error that ::/0 egress entry in the default security group already exists

[takeda]

I reported it at hashicorp/terraform#26275, but looks like this is the correct place.

When you have an existing VPC that is configured IPv4 only, and then you add assign_generated_ipv6_cidr_block = true to the VPC and also adding an entry like this to the default security group:

  egress {
    protocol   = -1
    rule_no    = 101
    action     = "allow"
    ipv6_cidr_block = "::/0"
    from_port  = 0
    to_port    = 0
  }

The terraform (tested on 0.13.2) will error out with the following message:
Error: Error authorizing security group egress rules: InvalidPermission.Duplicate: the specified rule "peer: ::/0, ALL, ALLOW" already exists

What I believe is happening, is when I allocate IPv6 CIDR for the VPC, AWS most likely automatically is adding ::/0 to the default security group. Terraform then tries to add that entry and fails. I don't know a good workaround for this, besides rerunning TF twice, because this entry is required to be listed when stack is created from scratch (it correctly won't be there if not specified), but it will throw an error about duplicate when updating existing VPC that's set up to be IPv4 only.

I did the same thing with CloudFormation and it works as expected, both when creating from scratch and updating the stack.

[github-actions]

Marking this issue as stale due to inactivity. This helps our maintainers find and focus on the active issues. If this issue receives no comments in the next 30 days it will automatically be closed. Maintainers can also remove the stale label.

If this issue was automatically closed and you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thank you!

[takeda]

It's still a bug.

[github-actions]

Marking this issue as stale due to inactivity. This helps our maintainers find and focus on the active issues. If this issue receives no comments in the next 30 days it will automatically be closed. Maintainers can also remove the stale label.

If this issue was automatically closed and you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thank you!

[takeda]

Was it actually resolved?