[Bug]: aws_wafv2_web_acl_logging_configuration filter ordering is undefined

Terraform Core Version

0.13.7

AWS Provider Version

5.7.0

Affected Resource(s)

resource aws_wafv2_web_acl_logging_configuration -> logging_filter -> filter

Expected Behavior

Listing multiple filter blocks should apply the filters in order.

To quote the AWS Console:

If a request matches a filter condition, stop filtering and take the corresponding filter action. AWS WAF applies filters in the order shown, starting from the top.

So order is important. But the filter block has been defined as a schema.TypeSet which means the ordering is ignored/lost.

https://github.com/hashicorp/terraform-provider-aws/blob/main/internal/service/wafv2/web_acl_logging_configuration.go#L65L66

Actual Behavior

The filters are applied in "random" order.

Relevant Error/Panic Output Snippet

No response

Terraform Configuration Files

resource "aws_cloudwatch_log_group" "waf_app_logs" {
  provider = aws.us
  name     = "aws-waf-logs-app"

  retention_in_days = 30
}

resource "aws_wafv2_web_acl_logging_configuration" "waf_app_logs" {
  provider     = aws.us
  resource_arn = aws_wafv2_web_acl.waf_app.arn

  log_destination_configs = [aws_cloudwatch_log_group.waf_app_logs.arn]

  logging_filter {
    default_behavior = "KEEP"

    filter {
      behavior    = "KEEP"
      requirement = "MEETS_ANY"

      // Keep things flagged by the BotControl managed rule group
      condition {
        label_name_condition {
          label_name = "awswaf:managed:aws:bot-control:signal:known_bot_data_center"
        }
      }
    }

    // Drop anything let through with ALLOW
    filter {
      behavior    = "DROP"
      requirement = "MEETS_ALL"

      condition {
        action_condition {
          action = "ALLOW"
        }
      }
    }
  }

  redacted_fields {
    query_string {}
  }
  redacted_fields {
    single_header {
      name = "authorization"
    }
  }
}

Steps to Reproduce

Define a aws_wafv2_web_acl_logging_configuration with more than one filter
Apply/plan. Note that the order may not be the same
Go into AWS console and explicitly reorder the rules
Do terraform plan and note how it doesn't see any changes

Debug Output

No response

Panic Output

No response

Important Factoids

No response

References

No response

hashicorp / terraform-provider-aws

[Bug]: aws_wafv2_web_acl_logging_configuration filter ordering is undefined #32665

Terraform Core Version

AWS Provider Version

Affected Resource(s)

Expected Behavior

Actual Behavior

Relevant Error/Panic Output Snippet

Terraform Configuration Files

Steps to Reproduce

Debug Output

Panic Output

Important Factoids

References

Would you like to implement a fix?

Community Note