A duplicate Security Group rule was found

a side effect of a now-fixed Terraform issue causing two security groups with

identical attributes but different source_security_group_ids to overwrite each

information and instructions for recovery. Error: InvalidPermission.Duplicate: the specified rule "peer: sg-<censored>, TCP, from port: 80, to port: 80, ALLOW" already exists

こういうこと:

SG Aのルール: allow from SG B

SG Bのルール: allow from SG A

このP-Rは上記の問題を解決していて今は起こらないはずだが、なぜ2021年に起きたのか。

Terraform currently provides both a standalone Security Group Rule resource (a single ingress or egress rule), and a Security Group resource with ingress and egress rules defined in-line. At this time you cannot use a Security Group with in-line rules in conjunction with any Security Group Rule resources. Doing so will cause a conflict of rule settings and will overwrite rules.

これは上記のハッシュ化ルールと組み合わせると起きそうなことである。

再現したコード・変更は以下の通り:

code:before.tf

resource "aws_security_group" "sg-a" {

vpc_id = "..."

ingress {

from_port = 80

to_port = 80

protocol = "-1"

}

}

code:after.tf

resource "aws_security_group" "sg-a" {

vpc_id = "..."

}

resource "aws_security_group_rule" "sg-a-ingress" {

type = "ingress"

security_group_id = aws_security_group.sg-a.id

from_port = 0

to_port = 0

protocol = "-1"

source_security_group = "<another security group id>"

}

code:diff.diff

diff --git a/./terraform/aws/staging/before.tf b/./terraform/aws/staging/after.tf

index c5af220..95c3339 100644

--- a/./terraform/aws/staging/before.tf

+++ b/./terraform/aws/staging/after.tf

@@ -1,9 +1,12 @@

resource "aws_security_group" "sg-a" {

vpc_id = "..."

- ingress {

- from_port = 80

- to_port = 80

- protocol = "-1"

- }

+}

+

+resource "aws_security_group_rule" "sg-a-ingress" {

+ type = "ingress"

+ security_group_id = aws_security_group.sg-a.id

+ from_port = 0

+ to_port = 0

+ protocol = "-1"

+ source_security_group = "<another security group id>"

}

対処方法:

という変更のapplyをそれぞれ分ける。

……という手順になると思う。