aws_vpc_peering_connection fails to manage "requester" options when using peering across accounts

[cornfeedhobo]

Terraform Version

Terraform v0.11.3

Affected Resource(s)

• aws_vpc_peering_connection

Terraform Configuration Files

resource "aws_vpc_peering_connection" "requester" {
  provider = "aws.requester"

  count = "${local.enabled}"
  tags  = "${merge(local.tags, map("Side", "Requestor"))}"

  peer_owner_id = "${var.accepter-account_id}"
  peer_vpc_id   = "${var.accepter-vpc_id}"
  vpc_id        = "${var.requester-vpc_id}"

  requester {
    allow_remote_vpc_dns_resolution = "true" // this isn't allowed using cross-account?
  }

  accepter {
    allow_remote_vpc_dns_resolution = "true" // this is ignored when not using auto-accept?
  }
}

resource "aws_vpc_peering_connection_accepter" "accepter" {
  provider = "aws.accepter"

  count = "${local.enabled}"
  tags  = "${merge(local.tags, map("Side", "Acceptor"))}"

  vpc_peering_connection_id = "${aws_vpc_peering_connection.requester.id}"
  auto_accept               = "true"
}

Expected Behavior

The requester block should apply, but there is no mechanism to supply different credentials for just that operation.

Actual Behavior

* aws_vpc_peering_connection.requester: Error modifying VPC Peering Connection options: OperationNotPermitted: User 012345678901 does not have permission to modify the accepter side peering options

Steps to Reproduce

1. terraform apply

Important Factoids

This seems to only relate to peering VPCs in different accounts.

Suggested solution

If the AST has a aws_vpc_peering_connection_accepter, use it, and it's provider, to apply the configuration block.

[ajcann]

I've also just run into this issue.

[ewbankkit]

I think this is the same problem with the allow_remote_vpc_dns_resolution attribute as in

• Multi-account VPC Peering doesn't accept - rest of plan completes after manual acceptance #3850
• Can't set allow_remote_vpc_dns_resolution = true for aws_vpc_peering_connection #3069

See also #3097.

[ewbankkit]

See my comments here that attempt to explain why this can't be resolved without a new aws_vpc_peering_connection_options resource.

[bflad]

The new aws_vpc_peering_connection_options resource for managing these dependency issues has been merged via #3909 and will release with v1.17.0 of the AWS provider, likely in two days.

[bflad]

The new resource has been released in version 1.17.0 of the AWS provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thanks!