aws_wafv2_web_acl apply fails when default action changes

[jaypeng2015]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Related:

• aws_wafv2_web_acl : Provider produced inconsistent final plan #23390
• 👉 aws_wafv2_web_acl apply fails when default action changes #23423
• Error: Provider produced inconsistent final plan - invalid new value for .rule: planned set element #23936
• aws_wafv2_web_acl - Error: Provider produced inconsistent final plan #23992
• apply default tags to wafv2 or cloudfront_distribution and error #24386
• [Bug]: Error "Provider produced inconsistent final plan" when adding a default tag to a aws_wafv2_web_acl #27175
• [Bug]: Provider produced inconsistent final plan for complex aws_wafv2_web_acl configurations #27273
• [Bug]: aws_wafv2_web_acl description/tag changes result in inconsistent final plan #27479
• [Bug]: "registry.terraform.io/hashicorp/aws" produced an invalid new value for .rule: planned set element #28191
• [Bug]: aws_wafv2_web_acl is unable to use dynamic block to manage "rule_action_override" #28672
• [Bug]: Error: Provider produced inconsistent final plan #29012
• [Bug]: Error: Provider produced inconsistent final plan #29304
• [Bug]: aws_wafv2_web_acl Error: Provider produced inconsistent final plan #30858

Terraform CLI and Terraform AWS Provider Version

Terraform Cloud runtime v1.1.6
Providers:

• "registry.terraform.io/hashicorp/archive" 2.2.0
• "registry.terraform.io/hashicorp/aws" 4.3.0
• "registry.terraform.io/hashicorp/random" 3.1.0

Affected Resource(s)

• aws_wafv2_web_acl

Terraform Configuration Files

Please include all Terraform configurations required to reproduce the bug. Bug reports without a functional reproduction may be closed without investigation.

resource "aws_wafv2_web_acl" "main" {
  count = var.enabled ? 1 : 0

  name  = var.name_prefix
  scope = var.scope

  default_action {
    dynamic "allow" {
      for_each = var.allow_default_action ? [1] : []
      content {}
    }

    dynamic "block" {
      for_each = var.allow_default_action ? [] : [1]
      content {}
    }
  }

  // other config
}

Debug Output

Panic Output

• Plan output:

# module.wafv2-cloudfront.module.wafcf.aws_wafv2_web_acl.main[0] will be updated in-place
  ~ resource "aws_wafv2_web_acl" "main" {
        id         = "31fc351b-9585-4089-8c72-9f1742a1c9ee"
        name       = "dev-wafv2-cloudfront"
        tags       = {
            "Name" = "dev-wafv2-cloudfront"
        }
        # (5 unchanged attributes hidden)

      ~ default_action {
          - allow {
            }

          + block {
            }
        }


        # (5 unchanged blocks hidden)
    }

• Apply output:
  https://gist.github.com/jaypeng2015/0577c4ee07bf314888914e5de75fd1fc

Expected Behavior

The default action changed from allow to block.

Actual Behavior

Apply errored.

Error: Provider produced inconsistent final plan
│ 
│ When expanding the plan for
│ module.wafv2-cloudfront.module.wafcf.aws_wafv2_web_acl.main[0] to include
│ new values learned so far during apply, provider
│ "registry.terraform.io/hashicorp/aws" produced an invalid new value for
│ .rule: planned set element

This is a bug in the provider, which should be reported in the provider's own issue tracker.

Steps to Reproduce

1. terraform apply
2. change the variable allow_default_action from true to false
3. terraform apply

Important Factoids

It only errors when configuration changes, if deploying from scratch, no matter the default action is true of false, it will success.

References

[rdubya]

I'm seeing this same error when trying to add tags. Version: registry.terraform.io/hashicorp/aws 4.8.0

Plan:

id : "****" # noop
name : "*****" # noop
tags : {  } # update
tags_all : { # create
  environment : "dev" # create
  terraform : "true" # create
}

... 5 unchanged attributes hidden

... 6 unchanged blocks hidden

[eg15]

This is happening to me on the latest AWS provider version 4.33.0 with the latest Terraform 1.3.1.
Changing default_action alone always triggers 2MB long error output.

[mmaetzler]

FYI: This issues with WAFv2 has been reported multiple times:

• aws_wafv2_web_acl : Provider produced inconsistent final plan #23390
• aws_wafv2_web_acl apply fails when default action changes #23423
• Error: Provider produced inconsistent final plan - invalid new value for .rule: planned set element #23936
• aws_wafv2_web_acl - Error: Provider produced inconsistent final plan #23992
• apply default tags to wafv2 or cloudfront_distribution and error #24386
• [Bug]: Error "Provider produced inconsistent final plan" when adding a default tag to a aws_wafv2_web_acl #27175
• [Bug]: Provider produced inconsistent final plan for complex aws_wafv2_web_acl configurations #27273
• [Bug]: aws_wafv2_web_acl description/tag changes result in inconsistent final plan #27479

[YakDriver]

NOTE: I cannot reproduce this error using Terraform v1.5+/AWS provider v5.7+ after trying various configurations. Retry using a minimum of Terraform v1.4.2/AWS provider v4.67.0 but preferably Terraform v1.5.3+/AWS provider v5.8.0+ and let us know if this is still a problem! If we don't hear back and can't reproduce, we plan to close this on or around July 20, 2023. The evidence suggests this is OBE (ie, fixed in the interim).

For more details see #23992 (comment) and #28672 (comment).

[justinretzolk]

Hi all 👋 As was mentioned above, this issue appears to be fixed when using a minimum Terraform version of 1.4.2 and a minimum AWS Provider version of 4.67.0 (preferably Terraform 1.5.3 or later and AWS Provider 5.8.0 or later). If you experience additional unexpected behaviors with versions that meet these parameters, please open a new issue so that we can investigate further.

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.