aws_security_group_rule InvalidPermission.Duplicate - Should be additive

[chrisferry]

I have a module which creates an ASG tied to an ELB
Within that module there is:

resource "aws_security_group_rule" "allow_elb_http_in" {
  type                     = "ingress"
  from_port                = "${var.elb_listen_port}"
  to_port                  = "${var.elb_listen_port}"
  protocol                 = "tcp"
  security_group_id        = "${var.security_group}"
  source_security_group_id = "${var.elb_security_group}"
}

I have several ASGs in the same APP-SG and several ELBs in the same ELB-SG
Some have overlapping listen ports which causes the following error when I try to apply:

* Error authorizing security group rules rules: InvalidPermission.Duplicate: the specified rule "peer: sg-xxxxxxxx, TCP, from port: 80, to port: 80, ALLOW" already exists

I think that the resource should allow for additive rules due to how the modules work

[phinze]

Thanks @chrisferry - this comes out of a chat we had in IRC.

Tagging this thinking since I'd like to see if there's any way for terraform to support this use case, which to me seems pretty common ( multiple disparate modules each wanting to slap rules onto a security group, some of which could overlap ).

[ghost]

This issue has been automatically migrated to hashicorp/terraform-provider-aws#12450 because it looks like an issue with that provider. If you believe this is not an issue with the provider, please reply to hashicorp/terraform-provider-aws#12450.

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.