I am facing an issue with the Terraform state file.
Scenario 1: While running terraform plan, which does not show any changes, but there is a change in the security group(managed by terraform), a new rule was added programmatically. The same change is showing in terraform plan -refresh-only
Scenario 2: Manually added a tag to an EC2 instance(Managed by Terraform). While running terraform plan and terraform plan -refresh-only, the tag changes are showing on both commands.
Can anyone help me find the reason for scenario 1, i.e, why it is not showing that SG rule changes in terraform plan?
If the external change has no impact on the configuration, and causes no planned changes, it won’t be shown in a normal plan because it has no practical effect.
If you only want to update the stored state, which is what the -refresh-only flag is for, then Terraform will show any external changes there because external changes are the only thing there could be to save (otherwise the state would have been unchanged).
How did you determine “a new rule was added programmatically” as opposed to manually?
The most likely explanation is that something or someone besides that terraform root module/tfstate is making those changes. It could even be a different use of terraform under a different tfstate. Tags are especially likely to be changed elsewhere.
If it’s people making the change then education is the first step, combined with explicit agreement about what’s manage manually or via Terraform.
What I could not understand is that I have a security group and ec2 instance provisioned using Terraform. sg has 5 rules in it and ec2 instance that has 7 tags associated. When I add an extra tag in ec2 instance it shows in terraform plan and -refresh-only but I add an extra sg rule it does not show in terraform plan but shows in -refresh-only.
@ikhan, It all depends on the configuration and how the provider plans the changes for that resource. The tags attribute for example is probably not computed, so it must match the configuration and therefor the provider plans to revert the external changes. The security groups rules however could be computed based on other factors (IIRC that’s because they could be defined in multiple places), so the provider does not immediately try to revert them in the plan.