Insufficient ip_address blocks for aws_route53_resolver_endpoint

[christianmeyer]

Terraform Version

Terraform v0.12.5

Terraform Configuration Files

resource "aws_route53_resolver_endpoint" "inbound" {
  name      = "${local.name_prefix}inbound-endpoint"
  direction = "INBOUND"

  security_group_ids = [
    aws_security_group.inbound.id,
  ]

  dynamic "ip_address" {
    for_each = aws_subnet.this.*.id
    iterator = subnet_id
    content {
      subnet_id = subnet_id.value
    }
  }

  tags      = var.tags
}

Expected Behavior

Pass validation and then create two ip_address blocks during planning.

Actual Behavior

Error: Insufficient ip_address blocks

  on  line 0:
  (source code not available)

At least 2 "ip_address" blocks are required.

It's failing the validation.

Steps to Reproduce

Run terraform validate with two or more elements in aws_subnet.this.*.id.

References

• Dynamic blocks with unknown for_each can fail MinItems validation #21436
• Allow providers to re-validate the final resource config #21555

[michalmedvecky]

+1
@christianmeyer did you find any workaround for this?

[michalmedvecky]

Btw for me, it fails only with an outbound resolver, inbound works ...

[michalmedvecky]

I did not mention I'm not using dynamic, but static configuration instead:

resource "aws_route53_resolver_endpoint" "adp-outbound" {
  name      = "adp-outbound-resolver"
  direction = "OUTBOUND"

  security_group_ids = [ aws_security_group.dns-proxy-sg.id ]

  ip_address {
    subnet_id = var.resolver_subnet_id_1a
    ip = "11.224.73.53"
  }

  ip_address {
    subnet_id = var.resolver_subnet_id_1a
    ip        = "11.224.73.62"
  }
}

And the result is a bit different:

Error: insufficient items for attribute "ip_address"; must have at least 2

@jbardin does your fix address this as well? Unfortunately this issue is heavily affecting me ..

[jbardin]

@michalmedvecky,

If looks like the aws_route53_resolver_endpoint resource is checking that only subnet_id is unique to each entry, so supplying the same value for both results in the error you see.

[michalmedvecky]

But this is an incorrect assumption. In R53 console I am allowed to create resolver endpoints with multiple IP addresses in the same subnet.

[jbardin]

@michalmedvecky, If that's the case, please file an issue with the AWS provider, so they can correct the resource. It's not something we can fix from within terraform core. Thanks!

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.