[aws] importing ec2 instance with network interface attached causes diff.

[gustavlarson]

Importing an already existing EC2 instance with a network interface attached fails due to diff in ec2 resource.

Steps to reproduce

1. Create an ec2 instance and network interface in one stack:

from pulumi_aws import ec2

network_interface = ec2.NetworkInterface(
    "network_interface",
    subnet_id="subnet-0a0f98a33a9cd40a4",
)

instance = ec2.Instance(
    "instance",
    ami="ami-050fdc53cf6ba8f7f",
    instance_type="t3.micro",
    availability_zone="eu-north-1a",
    network_interfaces=[
        ec2.InstanceNetworkInterfaceArgs(
            network_interface_id=network_interface.id,
            device_index=0,
        ),
    ],
)

2. Run pulumi up
3. Switch to another stack
4. Import the newly created resources:

from pulumi.resource import ResourceOptions
from pulumi_aws import ec2

network_interface = ec2.NetworkInterface(
    "network_interface",
    subnet_id="subnet-0a0f98a33a9cd40a4",
    opts=ResourceOptions(import_="eni-0ff7d35c45748dc3b"),
)

instance = ec2.Instance(
    "instance",
    ami="ami-050fdc53cf6ba8f7f",
    instance_type="t3.micro",
    availability_zone="eu-north-1a",
    network_interfaces=[
        ec2.InstanceNetworkInterfaceArgs(
            network_interface_id=network_interface.id,
            device_index=0,
        ),
    ],
    opts=ResourceOptions(import_="i-08cd798ed18377fa7"),
)

5. Run pulumi preview

Expected: Both resources imported without any errors.
Actual: Diff in the instance:

$ pulumi preview
Previewing update (pulumi-bug-guslar):
     Type                         Name                                 Plan       Info
 +   pulumi:pulumi:Stack          pulumi-bug-report-pulumi-bug-guslar  create     
 =   ├─ aws:ec2:NetworkInterface  network_interface                    import     
 =   └─ aws:ec2:Instance          instance                             import     [diff: ~networkInterfaces]; 1 warning
 
Diagnostics:
  aws:ec2:Instance (instance):
    warning: inputs to import do not match the existing resource; importing this resource will fail

$ pulumi preview --diff
Previewing update (pulumi-bug-guslar):
+ pulumi:pulumi:Stack: (create)
    [urn=urn:pulumi:pulumi-bug-guslar::pulumi-bug-report::pulumi:pulumi:Stack::pulumi-bug-report-pulumi-bug-guslar]
    = aws:ec2/networkInterface:NetworkInterface: (import)
        [id=eni-0ff7d35c45748dc3b]
        [urn=urn:pulumi:pulumi-bug-guslar::pulumi-bug-report::aws:ec2/networkInterface:NetworkInterface::network_interface]
        [provider=urn:pulumi:pulumi-bug-guslar::pulumi-bug-report::pulumi:providers:aws::default_4_7_0::04da6b54-80e4-46f7-96ec-b56ff0331ba9]
        attachments     : [
            [0]: {
                attachmentId: "eni-attach-01d35080d3c18ba38"
                deviceIndex : 0
                instance    : "i-08cd798ed18377fa7"
            }
        ]
        interfaceType   : "interface"
        ipv6AddressCount: 0
        privateIp       : "10.187.112.141"
        privateIps      : [
            [0]: "10.187.112.141"
        ]
        privateIpsCount : 0
        securityGroups  : [
            [0]: "sg-0cecdd8c10ddf3364"
        ]
        sourceDestCheck : true
        subnetId        : "subnet-0a0f98a33a9cd40a4"
        tags            : {
        }
        tagsAll         : {
        }
warning: inputs to import do not match the existing resource; importing this resource will fail
    = aws:ec2/instance:Instance: (import)
        [id=i-08cd798ed18377fa7]
        [urn=urn:pulumi:pulumi-bug-guslar::pulumi-bug-report::aws:ec2/instance:Instance::instance]
        [provider=urn:pulumi:pulumi-bug-guslar::pulumi-bug-report::pulumi:providers:aws::default_4_7_0::04da6b54-80e4-46f7-96ec-b56ff0331ba9]
      ~ networkInterfaces: [
          + [0]: {
                  + deleteOnTermination: false
                  + deviceIndex        : 0
                  + networkInterfaceId : "eni-0ff7d35c45748dc3b"
                }
        ]
Resources:             
    + 1 to create
    = 2 to import
    3 changes

$ pulumi version
v3.4.0

$ pip list | grep pulumi
pulumi          3.4.0
pulumi-aws      4.7.0

[lukehoban]

Curious @gustavlarson, does this work correctly if you pass this in step 4:

        ec2.InstanceNetworkInterfaceArgs(
            network_interface_id="eni-0ff7d35c45748dc3b",
            device_index=0,
        ),

I would not expect that to be necessary, but I am curious if it does unblock this.

Also - do you know if it works if you do pulumi up --skip-preview?

[gustavlarson]

Thanks for the suggestion @lukehoban .
Neither of your suggestions made any difference, the pulumi up still fails to import the Instance since the resource do not match.

$ pulumi up --skip-preview
Updating (pulumi-bug-guslar):
     Type                         Name                                 Status                   Info
     pulumi:pulumi:Stack          pulumi-bug-report-pulumi-bug-guslar  **failed**               1 error
 =   ├─ aws:ec2:NetworkInterface  network_interface                    imported                 
 =   └─ aws:ec2:Instance          instance                             **importing failed**     1 error
 
Diagnostics:
  pulumi:pulumi:Stack (pulumi-bug-report-pulumi-bug-guslar):
    error: update failed
 
  aws:ec2:Instance (instance):
    error: inputs to import do not match the existing resource
 
Resources:
    = 1 imported
    1 unchanged

Duration: 4s

[lukehoban]

Re-confirmed that this still occurs.

If you remove the commented out lines below - it works.

instance = ec2.Instance(
    "instance",
    ami="ami-050fdc53cf6ba8f7f",
    instance_type="t3.micro",
    availability_zone="eu-north-1c",
    network_interfaces=[
        # ec2.InstanceNetworkInterfaceArgs(
        #     network_interface_id=network_interface.id,
        #     device_index=0,
        # ),
    ],
    opts=pulumi.ResourceOptions(import_="i-0d18d9afc7f26c266"),
)

However, a refresh after that doesn't populate the network interfaces, and uncommenting and pulumi up results in a replace both before and after a refresh. So there is still a limitation for this scenario. Would be interesting to compare to what pulumi import and terraform import result in, and whether this is a Pulumi issue or an upstream issue.

[corymhall]

The root cause of this is an upstream issue hashicorp/terraform-provider-aws#16567