Terraform Compliance is checking the live resources instead the changes to be deployed (the before instead of the after). If you have a plan pointing to a live resource that is non compliant, it's fails even after fixing the code that will fix that live resource. This only happens when resources were already deployed, so with new resources, this is not a problem.
I reproduced this bug (?) using the resources aws_security_group and aws_security_group_rule.
To Reproduce
Create a Security Group (aws_security_group) with a Security Group rule (aws_security_group_rule) and deploy it.
Create a Terraform Compliance scenario to check the previous rule:
Feature: AwsEc2SecurityGroup feature
Scenario: AwsEc2SecurityGroup 8081 must be restricted
Given I have AWS Security Group defined
When it has ingress
Then it must have ingress
Then it must not have tcp protocol and port 8081 for 0.0.0.0/0
Test the terraform compliance policy against the code from point 1, should fail:
Feature: AwsEc2SecurityGroup feature
Scenario: AwsEc2SecurityGroup 8081 must be restricted
Given I have AWS Security Group defined
When it has ingress
Then it must have ingress
Then it must not have tcp protocol and port 8081 for 0.0.0.0/0
Description
Terraform Compliance is checking the live resources instead the changes to be deployed (the before instead of the after). If you have a plan pointing to a live resource that is non compliant, it's fails even after fixing the code that will fix that live resource. This only happens when resources were already deployed, so with new resources, this is not a problem. I reproduced this bug (?) using the resources
aws_security_group
andaws_security_group_rule
.To Reproduce
aws_security_group
) with a Security Group rule (aws_security_group_rule
) and deploy it.Create a Terraform Compliance scenario to check the previous rule:
Test the terraform compliance policy against the code from point 1, should fail:
It still failing, but the code is now correct. Terraform Compliance is failing against the "live" resource instead of the changes we want to apply.
Feature File:
Sample Terraform Code: BEFORE:
AFTER:
Expected Behavior: Terraform Compliance should check the changes, not the live resource, so after fixing the code, should be green.
Tested Versions:
v1.3.34
Terraform v1.0.2