only modify 'enable_waf_fail_open' argument if configured on create

hashicorp · Dec 6, 2021 · 3660b44 · 3660b44
1 parent 83f1d84
commit 3660b44
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 1 deletion.
diff --git a/.changelog/22072.txt b/.changelog/22072.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_lb: Correctly configure `enable_waf_fail_open` during resource creation
+```
diff --git a/internal/service/elbv2/load_balancer.go b/internal/service/elbv2/load_balancer.go
@@ -487,7 +487,12 @@ func resourceLoadBalancerUpdate(d *schema.ResourceData, meta interface{}) error
 			})
 		}
 
-		if d.HasChange("enable_waf_fail_open") || d.IsNewResource() {
+		// The "waf.fail_open.enabled" attribute is not available in all AWS regions
+		// e.g. us-gov-east-1; thus, we can instead only modify the attribute as a result of d.HasChange()
+		// to avoid "ValidationError: Load balancer attribute key 'waf.fail_open.enabled' is not recognized"
+		// when modifying the attribute right after resource creation.
+		// Reference: https://github.com/hashicorp/terraform-provider-aws/issues/22037
+		if d.HasChange("enable_waf_fail_open") {
 			attributes = append(attributes, &elbv2.LoadBalancerAttribute{
 				Key:   aws.String("waf.fail_open.enabled"),
 				Value: aws.String(strconv.FormatBool(d.Get("enable_waf_fail_open").(bool))),