Revoke client vpn ingress on destroy

user_5392215 0
Viewed 154

I'm trying to revoke vpn client ingress rule on 'destroy' in Terrafrom. Everything worked fine with terraform 0.12 Unfortunately, after upgrading to version 0.14, the same method no longer works. Here is what I have:

resource "null_resource" "client_vpn_ingress" {
  provisioner "local-exec" {
    when = create
    command = "aws ec2 authorize-client-vpn-ingress --client-vpn-endpoint-id ${aws_ec2_client_vpn_endpoint.vpn_endpoint.id} --target-network-cidr ${var.vpc_cidr_block} --authorize-all-groups --region ${var.aws_region} --profile ${var.profile}"
}
  provisioner "local-exec" {
    when = destroy
    command = "aws ec2 revoke-client-vpn-ingress --client-vpn-endpoint-id ${aws_ec2_client_vpn_endpoint.vpn_endpoint.id} --target-network-cidr ${var.vpc_cidr_block} --revoke-all-groups --region ${var.aws_region} --profile ${var.profile}"
}
}

and here is the error message:

Error: Invalid reference from destroy provisioner

on vpn_client_endpoint.tf line 84, in resource "null_resource" "client_vpn_ingress": 84: command = "aws ec2 revoke-client-vpn-ingress --client-vpn-endpoint-id ${aws_ec2_client_vpn_endpoint.vpn_endpoint.id} --target-network-cidr ${var.vpc_cidr_block} --revoke-all-groups --region ${var.aws_region} --profile ${var.profile}"

Destroy-time provisioners and their connection configurations may only reference attributes of the related resource, via 'self', 'count.index', or 'each.key'.

References to other resources during the destroy phase can cause dependency cycles and interact poorly with create_before_destroy.

Unfortunately I'm no longer able to use Terraform 0.12

Does anyone have any idea how to revoke it on 'terraform destroy' in version >= 0.14 ?

terraform amazon-web-services
1 Answers

As of version 2.70.0 of the Terraform AWS provider (see this GitHub comment), you can now do something like this:

resource "aws_ec2_client_vpn_authorization_rule" "vpn_auth_rule" {
  depends_on             = [
    aws_ec2_client_vpn_endpoint.vpn
  ]
  client_vpn_endpoint_id = aws_ec2_client_vpn_endpoint.vpn.id
  target_network_cidr    = "0.0.0.0/0"
  authorize_all_groups   = true
}

This way the ingress rule will be handled as a first-class resource in state by Terraform and you won't have to worry about if/when the command is executed.

user_43041230
Related