terraform plan incorrect diff with json based definition

[ghost]

This issue was originally opened by @richardgavel as hashicorp/terraform#24212. It was migrated here as a result of the provider split. The original body of the issue is below.

---

Json encode is showing up with differences inside the JSON. Not sure is this is within the AWS provider or the engine. Only noticed with 0.12 due to the better diff rendering.

Terraform Version

0.12.21

Terraform Configuration Files

data "template_file" "task" {
  template = file("task-definition.json")

  vars = {
    aws_region         = data.aws_region.current.name
    connection_string  = "Server=${aws_db_instance.this.address};Database=quartz;Uid=${aws_db_instance.this.username};Pwd=${aws_db_instance.this.password}"
    log_group_name     = aws_cloudwatch_log_group.this.name
    okta_client_id     = local.okta_client_id
    okta_client_secret = local.okta_client_secret
    okta_domain        = local.okta_domain
    service_image      = "${data.aws_ecr_repository.this.repository_url}:${var.service_image_tag}"
  }
}

resource "aws_ecs_task_definition" "this" {
  container_definitions    = data.template_file.task.rendered
}

Expected Behavior

container_definitions.environment should show no diffs, since none of the values changed values

Actual Behavior

differences are showing, it's reordering (I'm guessing alphabetizing it?)

` ~ container_definitions = jsonencode( ~ [ # forces replacement ~ {

• cpu = 0 -> null ~ environment = [
  • {
    • name = "Okta:ClientSecret"
    • value = "xxx" }, { name = "Okta:ClientId" value = "xxx" }, ~ { ~ name = "Quartz:quartz.dataSource.default.connectionString" -> "Okta:ClientSecret" ~ value = "Server=xx.us-east-1.rds.amazonaws.com;Database=quartz;Uid=master;Pwd=xxx" -> "xxx" }, { name = "Okta:OktaDomain" value = "ascendon.okta.com" },
  • {
    • name = "Quartz:quartz.dataSource.default.connectionString"
    • value = "Server=xxx.us-east-1.rds.amazonaws.com;Database=quartz;Uid=master;Pwd=xxx" }, ] essential = true ~ image = "xxx.dkr.ecr.us-east-1.amazonaws.com/xxx:42434" -> "xxx.dkr.ecr.us-east-1.amazonaws.com/xxx:42437" logConfiguration = { logDriver = "awslogs" options = { awslogs-group = "xxx" awslogs-region = "us-east-1" awslogs-stream-prefix = "fargate" } }
• mountPoints = [] -> null name = "xxx" ~ portMappings = [ ~ { containerPort = 80
  • hostPort = 80 -> null protocol = "tcp" }, ]
• volumesFrom = [] -> null } # forces replacement, ]`

[ewbankkit]

Similar:

• https://github.com/terraform-providers/terraform-provider-aws/issues/12056

[justinretzolk]

Hey @richardgavel 👋 Thank you for taking the time to file this issue! Given that there's been a number of AWS provide releases since you initially filed it, can you confirm whether you're still experiencing this behavior?