associate_public_ip_address forcing new resource when instance powered off

[hashibot]

This issue was originally opened by @AlexLast as hashicorp/terraform#14397. It was migrated here as part of the provider split. The original body of the issue is below.

---

Terraform Version

Terraform v0.9.5

Affected Resource(s)

• aws_instance

Expected Behavior

• No resources were changed, a new resource should not be forced

Actual Behavior

• A new resource is forced on apply

associate_public_ip_address: "false" => "true" (forces new resource)

Steps to Reproduce

1. Create an AWS instance with associate_public_ip_address set to true
2. Stop said instance (in our case it's a bastion we want powered off)
3. terraform plan/apply
4. New EC2 instance resource will be forced

Important Factoids

We want to have our bastion instance powered off when not in use, having this new resource forced creates a new instance any time the bastion is powered off and a change is made elsewhere. Can the instance status be checked to make sure it's running before this resource is forced? Thanks!

[AlexLast]

Any news on this?

[fxp0]

Any news on this?

[tdmalone]

I think this can be worked around by using the lifecycle block:

lifecycle {
  ignore_changes = ["associate_public_ip_address"]
}

I've tested this with two of my instances that were triggering on associate_public_ip_address when stopped, and they're now ignored with this rule in place. And when I start them up again, they still acquire a public IP as desired.

[github-actions]

Marking this issue as stale due to inactivity. This helps our maintainers find and focus on the active issues. If this issue receives no comments in the next 30 days it will automatically be closed. Maintainers can also remove the stale label.

If this issue was automatically closed and you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thank you!

[next-jesusmanuelnavarro]

FYI: This is still happening on Terraform v0.12.24 and aws provider 2.55.0.

[rick-masters]

When an instance is stopped, terraform cannot determine the correct value of associate_public_ip_address and should leave it alone. But right now it incorrectly interprets the current state and sets the value to false.

Here is some background information on how this operates:

The associate setting is sent to AWS in the RunInstances API call in the InstanceNetworkInterfaceSpecification parameter. It puts this parameter on the primary network interface. So, this is really a network interface setting.

After the instance starts running, terraform examines the primary network interface in the DescribeInstancesResponse, looking for an "association" parameter. If that is present it updates associate_public_ip_address to true. If it is not present, it sets it to false. But the presence of the association is an ephemeral state that disappears in a stopped state so this is not reliable.

When an instance is stopped AWS does not provide the actual setting from any API call as far as I can tell. It does appear to exist somewhere inside AWS because it reassigns public ips when the instance is restarted, and it will continue to override the subnet setting for associating public ips.

This fix is to not update that setting if the instance is in a stopped state. Pull request submitted.

Issue #10047 is a duplicate.

[github-actions]

Marking this issue as stale due to inactivity. This helps our maintainers find and focus on the active issues. If this issue receives no comments in the next 30 days it will automatically be closed. Maintainers can also remove the stale label.

If this issue was automatically closed and you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thank you!

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.