Closed jkoermer-eqxm closed 6 months ago
Voting for Prioritization
Volunteering to Work on This Issue
AWS docs say, "You can enable in-transit encryption on a cluster only when creating the cluster. You cannot toggle in-transit encryption on and off by modifying a cluster." which indicates to me that this is not a fixable or a bug.
I didn't post a comment here but a few months ago I created this PR which fixes this issue: https://github.com/hashicorp/terraform-provider-aws/pull/30403
Add an upvote on the PR and hopefully hashicorp takes a look at it more quickly. :)
(GitHub automatically posts an "activity" item above but it isn't a comment so it is easy to miss.)
There also seems to be an option (at least on Redis 7.0.7) that allows encrytion in transit to be switched as per the screenshot:
If switching to Preferred
the cluster modifies, and it is then possible to disable entirely if required.
The options in the console do not appear to be available in the AWS terraform provider.
[!WARNING] This issue has been closed, meaning that any additional comments are hard for our team to see. Please assume that the maintainers will not see them.
Ongoing conversations amongst community members are welcome, however, the issue will be locked after 30 days. Moving conversations to another venue, such as the AWS Provider forum, is recommended. If you have additional concerns, please open a new issue, referencing this one where needed.
This functionality has been released in v5.47.0 of the Terraform AWS Provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.
For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template. Thank you!
I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues. If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.
Terraform Core Version
0.12.31
AWS Provider Version
4.62
Affected Resource(s)
aws_elasticache_replication_group
Expected Behavior
Updating the seeing for transit encryption enabled: transit_encryption_enabled = true | false
Should just modify the cluster. Running any either of the following commands will modify the existing cluster and not require the cluster to be rebuilt: aws elasticache modify-replication-group --replication-group-id cache-cluster --transit-encryption-enabled --transit-encryption-mode preferred --apply-immediately aws elasticache modify-replication-group --replication-group-id cache-cluster--no-transit-encryption-enabled --apply-immediately
Actual Behavior
Running terraform plan or apply cause the resource to be recreated:
~ transit_encryption_enabled = true -> false # forces replacement
Modifying the transit encryption outside of terraform and updating terraform to match allows for the resource to plan/apply as expected.
Relevant Error/Panic Output Snippet
No response
Terraform Configuration Files
Steps to Reproduce
Create an elasticache instance. Modify the value of
transit_encryption_enabled
Debug Output
No response
Panic Output
No response
Important Factoids
No response
References
This is related to a couple of additional open issues relating to elasticache transit encryption. Including: https://github.com/hashicorp/terraform-provider-aws/issues/29403 https://github.com/hashicorp/terraform-provider-aws/issues/26367 https://docs.aws.amazon.com/cli/latest/reference/elasticache/modify-cache-cluster.html
I think this gets resolved with this PR: https://github.com/hashicorp/terraform-provider-aws/pull/30403
Would you like to implement a fix?
No