ignore_changes does not properly filter ForceNew attributes from diff

[vitroth]

Testing the new ignore_updates feature (which I'm excited to have), I've encountered two problems immediately.

On existing EC2 instances provisioned with 0.6.3, setting the ignore_updates to ["ami", "user_data"] and then changing the user_data, terraform 0.6.4 still wants to delete & recreate the instances.

Additionally, with ignore_updates set to either that or just ["ami"], instance creation fails with:
aws_instance.foo: diffs didn't match during apply. This is a bug with Terraform and should be reported

[phinze]

This should be working now on the latest version of Terraform - feel free to follow up if you see trouble!

[vitroth]

I just tested with 0.6.12 and ignoring an AMI change still doesn't work. For every aws_instance resource I added:

  lifecycle {
    # Once created, ignore future changes to the ami
    ignore_changes = ["ami"]
  }

But on a terraform plan I see:

-/+ module.apcera-aws.aws_instance.singleton
    associate_public_ip_address: "true" => "1"
    availability_zone:           "us-west-2a" => "<computed>"
    ebs_block_device.#:          "0" => "<computed>"
    ephemeral_block_device.#:    "0" => "<computed>"
    instance_state:              "running" => "<computed>"
    instance_type:               "m1.small" => "m1.small"
    key_name:                    "aws-eng-usw2-201510" => "aws-eng-usw2-201510"
    placement_group:             "" => "<computed>"
    private_dns:                 "ip-10-0-0-206.us-west-2.compute.internal" => "<computed>"
    private_ip:                  "10.0.0.206" => "<computed>"
    public_dns:                  "" => "<computed>"
    public_ip:                   "REDACTED" => "<computed>"
    root_block_device.#:         "1" => "<computed>"
    security_groups.#:           "1" => "1"
    security_groups.2859541123:  "sg-9f910bfb" => "sg-9f910bfb"
    source_dest_check:           "true" => "1"
    subnet_id:                   "subnet-02e6b867" => "subnet-02e6b867"
    tags.#:                      "1" => "1"
    tags.Name:                   "foo-singleton" => "foo-singleton"
    tenancy:                     "default" => "<computed>"
    user_data:                   "676807870701f2763666ebae7af918b55fd86d66" => "676807870701f2763666ebae7af918b55fd86d66"
    vpc_security_group_ids.#:    "1" => "<computed>"

(Note no row highlighted as the "forces new resource")

[phinze]

Thanks for re-testing @vitroth - looks like ForceNew attributes aren't being properly handled. Reopening and we'll get this fixed up.

[nickithewatt]

@phinze I can confirm that this is still an issue with 0.6.12. I created a separate issue (#5294) which can probably be closed, and simply tracked here now. To recap, that issue is specifically around ignore_changes not working in relation to the AWS user_data variable, where the content is coming from a rendered template.

[phinze]

Hey folks, rolling up ignore_changes problems in #5627 and tackling fixes today. Head over there for updates.

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.