aws_route53_record allow_overwrite deprecation will break ability to update SOA

[osterman]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform Version

0.11.12

Affected Resource(s)

2.0.0+

• aws_route53_record

Terraform Configuration Files

Our best practice is to set a low SOA on service discovery zones. The default SOA of 900 seconds leads to a default negative cache TTL which messes with service discovery when services query for the DNS record before the records have been updated/created. Basically, when this happens DNS lookups will fail for 15 minutes =); we change it to 30 seconds, so negative DNS queries are refreshed more quickly.

Since AWS creates this SOA record automatically, the only way to accomplish this in a single terraform apply is to support the allow_overwrite flag. Using terraform import in this scenario is a poor UX and something which we cannot mitigate; it's a consequence of how AWS creates the zone.

resource "aws_route53_record" "soa" {
  allow_overwrite = true
  zone_id         = "XXXXX"
  name            = "myzone
  type            = "SOA"
  ttl             = "30"

  records = [
   ...
  ]
}

Expected Behavior

I understand why this behavior is getting deprecated and it makes sense for non-automatically generated DNS record sets. The SOA record, however, is an exception. It's created automatically by AWS.

Not sure the best course of action. Terraform should maybe import the SOA automatically since it gets generated by AWS, not by terraform. There should be a way to set the SOA without getting the deprecation warning because this is not a user problem. There's no way we can mitigate this without the allow_overwrite flag.

Actual Behavior

Warning: module.dns.aws_route53_record.soa: "allow_overwrite": [DEPRECATED] The next major version of the Terraform AWS Provider will require importing existing records

Steps to Reproduce

1. Create a new aws_route53_zone
2. Attempt to update the SOA via the aws_route53_record within the same terraform apply
3. terraform apply

References

• https://www.terraform.io/docs/providers/aws/guides/version-2-upgrade.html#allow_overwrite-default-value-change

[osterman]

This broke in #7734

[bflad]

Pull request submitted to remove the deprecation: #8274

We will still discourage its usage as it can lead to conflicting management of infrastructure, but that choice will be up to the operator.

[bflad]

The deprecation has been removed, which will release with version 2.6.0 of the Terraform AWS Provider later today. 👍

[osterman]

Thanks @bflad ! Very much appreciated.

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thanks!