Resource "aws_default_network_acl" orphaned subnet_ids

[jeremyciak]

I'm not sure what changed but it seems like something recently corresponds with the blurb here on Managing Subnets in the Default Network ACL for the aws_default_network_acl resource. I am getting continuously prompted that the currently associated subnets will be removed. I believe this module either needs to populate the subnet_ids value for the aws_default_network_acl resource or the following lifecycle configuration on the resource is needed:

resource "aws_default_network_acl" "default" {
  # ... other configuration ...

  lifecycle {
    ignore_changes = [subnet_ids]
  }
}

[antonbabenko]

Fixed in #530

v2.60.0 has been just released.

[lorengordon]

Hmm, so the linked PR ended up only working if all the subnets are created by this module. If someone creates a subnet outside the module, it gets associated with the default NACL, and you continue to get a persistent diff. I think for this particular resource, the lifecycle ignore_changes is actually a better option.

  lifecycle {
    ignore_changes = [subnet_ids]
  }

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues. If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.