VPC deletion fails due to receiving late information about the route table dependency

[markoeremija]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform CLI and Terraform AWS Provider Version

Terraform v0.14.9
+ provider registry.terraform.io/hashicorp/aws v3.34.0
+ provider registry.terraform.io/hashicorp/null v3.0.0
+ provider registry.terraform.io/hashicorp/random v3.1.0

Your version of Terraform is out of date! The latest version
is 0.14.10. You can update by downloading from https://www.terraform.io/downloads.html

Affected Resource(s)

• aws_route_table
• aws_vpc

Terraform Configuration Files

resource "aws_route_table" "public_subnet_rtb" {
  for_each = var.enable_public_access ? aws_subnet.public_subnet : {}
  vpc_id   = aws_vpc.vpc.id
  tags = merge(local.tags, {
    Name = "${each.value.tags.Name}-rtb"
  })
}

resource "aws_vpc" "vpc" {
  cidr_block                       = var.vpc_cidr_block
  assign_generated_ipv6_cidr_block = var.vpc_enable_ipv6
  enable_dns_hostnames             = var.vpc_enable_dns_hostnames
  enable_dns_support               = var.vpc_enable_dns_support
  tags                             = merge(local.tags, { Name = var.vpc_name })
}

Debug Output

Error: Provider produced inconsistent result after apply

When applying changes to
module.vpc.aws_route_table.public_subnet_rtb["us-east-1a"], provider
"registry.terraform.io/hashicorp/aws" produced an unexpected new value: Root 
resource was present, but now absent.

This is a bug in the provider, which should be reported in the provider's own
issue tracker.

Expected Behavior

The route table should have been created and attached to the VPC.

Actual Behavior

Route table was attached to the VPC, but the request timed out before VPC was aware of the route table. In the subsequent terraform destroy, there was an error that the VPC cannot be deleted because there are dependencies which were not deleted:

Error: Error deleting VPC: DependencyViolation: The vpc 'vpc-xxxxxxxxxxxxxxxxx' has dependencies and cannot be deleted.
	status code: 400, request id: xxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx

The issue seems to be a result of eventual consistency where the information about the resource that was created was relayed to the VPC module too late.

Steps to Reproduce

1. terraform apply
2. terraform destroy

Important Factoids

AWS region used: us-east-1

[ewbankkit]

Related:

• Implement d.IsNewResource() Checks In Resource Read Functions #16796

@markoeremija Thanks for raising this issue.
The error handling for timeouts on route table creation was improved in #17319, released in Terraform AWS Provider v3.35.0 (the route table resource will now be marked as tainted on failed creation and so deleted by Terraform on next terraform apply). This should mean that no orphaned AWS route table resource remains.

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thanks!