aws_ecs_service cannot be modified after initial creation to add an IAM Role and/or an ELB

[CpuID]

Looks like this is only permitted at initial creation.

STR:

• Define an aws_ecs_task_definition, assign it to an aws_ecs_service without the iam_role and load_balancer properties
• Apply
• Add iam_role and load_balancer as per the docs
• Plan succeeds
• Apply succeeds
• ELB is not added to the Service.

This may be an upstream API limitation also, not just a TF bug (haven't researched). Either way it should either work as expected (updated .tf, update the resource), or error out that it can't be changed after creation, maybe force a new resource or something.

cc @radeksimko

[radeksimko]

Changing ELB association is apparently a destructive action since there's no way to update it - we'll need to mark all aws_ecs_service.load_balancer.* fields as ForceNew: true.

You could probably make it less destructive by using lifecycle { create_before_destroy = true } on the aws_ecs_service, so that the new association takes place, traffic is served from the new service and old association is removed. For that however we will need to make name optional & generated, otherwise this would fail due to name conflict.

This is also a root cause for #4227

I'm working on a PR which should appear soon and fix this.

[CpuID]

thx :)

[radeksimko]

See #4366

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.