false positive: missing EIP association resources associated with NAT Gateways

[n2N8Z]

Description

driftctl/pkg/middlewares/aws_nat_gateway_eip_assoc.go

Line 44 in 5f863c7

if isAssociatedToNatGateway {

Results in missing resources being reported:

Scanned states (1)      
Found missing resources:
  - eipassoc-00000000000000001 (aws_eip_association)
  - eipassoc-00000000000000002 (aws_eip_association)
  - eipassoc-00000000000000003 (aws_eip_association)
  - eipassoc-00000000000000004 (aws_eip_association)
  - eipassoc-00000000000000005 (aws_eip_association)
  - eipassoc-00000000000000006 (aws_eip_association)
  - eipassoc-00000000000000007 (aws_eip_association)
  - eipassoc-00000000000000008 (aws_eip_association)

If I stop managing the corresponding eips, then the missing eipassocs go away, and instead I get aws_eip resources reported as not managed by IaC:

  aws_eip:
    - eipalloc-00000000000000001
    - eipalloc-00000000000000002
    - eipalloc-00000000000000003
    - eipalloc-00000000000000004
    - eipalloc-00000000000000005
    - eipalloc-00000000000000006
    - eipalloc-00000000000000007
    - eipalloc-00000000000000008

If I manage both the eip and the eipassoc, I just get a more detailed missing resource report:

Scanned states (1)      
Found missing resources:
  - eipassoc-00000000000000001 (module.ngw_eip_assoc)
  - eipassoc-00000000000000002 (module.ngw_eip_assoc)
  - eipassoc-00000000000000003 (module.ngw_eip_assoc)
  - eipassoc-00000000000000004 (module.ngw_eip_assoc)
  - eipassoc-00000000000000005 (module.ngw_eip_assoc)
  - eipassoc-00000000000000006 (module.ngw_eip_assoc)
  - eipassoc-00000000000000007 (module.ngw_eip_assoc)
  - eipassoc-00000000000000008 (module.ngw_eip_assoc)

Environment

• OS: Any
• driftctl version: Latest
• terraform version: Any
• terraform providers versions: Any

How to reproduce
Allocate an EIP
Create a nat gateway and associate the EIP.

Possible Solution
Don't ignore EIP associations to nat gateways.

Additional context
The issue is probably caused by aws_eip_association_expander.go expanding the association from the eip after they were already ignored.

DEBU[0012] Starting middleware middleware=middlewares.AwsNetworkACLExpander
DEBU[0012] Starting middleware middleware=middlewares.AwsNatGatewayEipAssoc
DEBU[0012] Ignoring aws_eip_association as it is associated to a nat gateway id=eipassoc-00000000000000001 type=aws_eip_association
DEBU[0012] Ignoring aws_eip_association as it is associated to a nat gateway id=eipassoc-00000000000000002 type=aws_eip_association
DEBU[0012] Ignoring aws_eip_association as it is associated to a nat gateway id=eipassoc-00000000000000003 type=aws_eip_association
DEBU[0012] Ignoring aws_eip_association as it is associated to a nat gateway id=eipassoc-00000000000000004 type=aws_eip_association
DEBU[0012] Ignoring aws_eip_association as it is associated to a nat gateway id=eipassoc-00000000000000005 type=aws_eip_association
DEBU[0012] Ignoring aws_eip_association as it is associated to a nat gateway id=eipassoc-00000000000000006 type=aws_eip_association
DEBU[0012] Ignoring aws_eip_association as it is associated to a nat gateway id=eipassoc-00000000000000007 type=aws_eip_association
DEBU[0012] Ignoring aws_eip_association as it is associated to a nat gateway id=eipassoc-00000000000000008 type=aws_eip_association
DEBU[0012] Starting middleware middleware=middlewares.AwsBucketPolicyExpander
DEBU[0012] Starting middleware middleware=middlewares.AwsSQSQueuePolicyExpander
DEBU[0012] Starting middleware middleware=middlewares.AwsDefaultSQSQueuePolicy
DEBU[0012] Starting middleware middleware=middlewares.AwsSNSTopicPolicyExpander
DEBU[0012] Starting middleware middleware=*middlewares.AwsRoleManagedPolicyExpander
DEBU[0012] Starting middleware middleware=middlewares.TagsAllManager
DEBU[0012] Starting middleware middleware=middlewares.EipAssociationExpander
DEBU[0012] Starting middleware middleware=middlewares.AwsRDSClusterInstanceExpander
DEBU[0012] Starting middleware middleware=middlewares.AwsApiGatewayDeploymentExpander
DEBU[0012] Starting middleware middleware=middlewares.AwsApiGatewayResourceExpander
DEBU[0012] Starting middleware middleware=middlewares.AwsApiGatewayApiExpander
DEBU[0012] Starting middleware middleware=middlewares.AwsApiGatewayRestApiPolicyExpander
DEBU[0012] Starting middleware middleware=middlewares.AwsConsoleApiGatewayGatewayResponse
DEBU[0012] Starting middleware middleware=middlewares.AwsApiGatewayDomainNamesReconciler
DEBU[0012] Starting middleware middleware=middlewares.AwsApiGatewayBasePathMappingReconciler
DEBU[0012] Starting middleware middleware=middlewares.AwsEbsEncryptionByDefaultReconciler
DEBU[0012] Starting middleware middleware=middlewares.AwsALBTransformer
DEBU[0012] Starting middleware middleware=middlewares.AwsALBListenerTransformer
DEBU[0012] Starting middleware middleware=*middlewares.GoogleIAMBindingTransformer
DEBU[0012] Starting middleware middleware=*middlewares.GoogleStorageBucketIAMPolicyTransformer
DEBU[0012] Starting middleware middleware=*middlewares.GoogleComputeInstanceGroupManagerReconciler
DEBU[0012] Starting middleware middleware=middlewares.AzurermRouteExpander
DEBU[0012] Starting middleware middleware=middlewares.AzurermSubnetExpander
DEBU[0012] Starting middleware middleware=*middlewares.AwsS3BucketPublicAccessBlockReconciler
DEBU[0012] Starting middleware middleware=middlewares.AwsDefaults

[n2N8Z]

Moving the AwsNatGatewayEipAssoc middleware after EipAssociationExpander has not resolved the issue.

DEBU[0013] Starting middleware middleware=middlewares.EipAssociationExpander
DEBU[0013] Starting middleware middleware=middlewares.AwsNatGatewayEipAssoc
DEBU[0013] Ignoring aws_eip_association as it is associated to a nat gateway id=eipassoc-00000000000000001 type=aws_eip_association
DEBU[0013] Ignoring aws_eip_association as it is associated to a nat gateway id=eipassoc-00000000000000002 type=aws_eip_association
DEBU[0013] Ignoring aws_eip_association as it is associated to a nat gateway id=eipassoc-00000000000000003 type=aws_eip_association
DEBU[0013] Ignoring aws_eip_association as it is associated to a nat gateway id=eipassoc-00000000000000004 type=aws_eip_association
DEBU[0013] Ignoring aws_eip_association as it is associated to a nat gateway id=eipassoc-00000000000000005 type=aws_eip_association
DEBU[0013] Ignoring aws_eip_association as it is associated to a nat gateway id=eipassoc-00000000000000006 type=aws_eip_association
DEBU[0013] Ignoring aws_eip_association as it is associated to a nat gateway id=eipassoc-00000000000000007 type=aws_eip_association
DEBU[0013] Ignoring aws_eip_association as it is associated to a nat gateway id=eipassoc-00000000000000008 type=aws_eip_association

[n2N8Z]

fixed by #1619

[patch-the-dog]

This issue has been referenced in the v0.39.0 release.

[cloud-config-ro]

This issue has been referenced in the v0.39.0 release.

[cloud-config-ro]

This issue has been referenced in the v0.39.0 release.