Encrypted flag cannot be specified since device /dev/sda1 has a snapshot specified

This issue was originally opened by @jayudhandha as hashicorp/terraform#18059. It was migrated here as a result of the provider split. The original body of the issue is below.

---

Hi,

I am migrating my Autoscaling groups to use launch_template instead of launch_configuration. (To support T2 Unlimited)

Below is my code snippet.

resource "aws_launch_template" "test_launch_template" {
  image_id = "ami_id"
  name_prefix     = "test-pref"
  instance_type   = "t2.small"
  key_name        = "jayesh"
  vpc_security_group_ids = ["sg-23423432","sg-23452115"]
  user_data       = "${base64encode(data.template_file.user_data.rendered)}"
  
  iam_instance_profile {
	name = "test"
  } 
  disable_api_termination = true
  instance_initiated_shutdown_behavior = "terminate"

  block_device_mappings {
	device_name = "/dev/sda1"
	ebs {
      delete_on_termination = true
      volume_size           = "${var.volume_size}"
    }
  }
    
  credit_specification {
    cpu_credits = "unlimited"
  }
  lifecycle {
    create_before_destroy = "true"
  }  
}

While running terraform apply I am getting below error.

1 error(s) occurred:

• aws_autoscaling_group.test_asg: 1 error(s) occurred:
• aws_autoscaling_group.test_asg: Error creating AutoScaling Group: ValidationError: You must use a valid fully-formed launch template. the encrypted flag cannot be specified since device /dev/sda1 has a snapshot specified.
  status code: 400, request id: 7902a390-58de-11e8-af77-87d327f8b121

May be any parameter is missing but i am not sure which one.

As per error, It looks that encrypted parameter is specified. But i haven't passed that. Then why this error is coming?

Thanks in advance!

[djdevin]

I'm getting the same thing along with #4570

[snemetz]

Same thing. You guys are faster at submitting the bug report :)
I tried a number of setting to get around it. None worked.
It appears that terraform is always sending the encrypted parameter, but the api only accepts it under some conditions.

[djdevin]

I have it unset in the console and I still got the error

Failed to create Auto Scaling group
You must use a valid fully-formed launch template. the encrypted flag cannot be specified since device /dev/sda1 has a snapshot specified.

Either an issue with AWS or something in the background I'm not seeing...

[ankurkgupta]

The issue is, when creating a launch template from AWS there is an option "Do not include in template" for encrypted flag, but when creating launch template with terraform there is no way to set this option. It defaults to "false".

[cowdude]

Facing the same issue. Removing the block_device_mappings argument fixed it (but I can no longer tweak the root volume size).

[zioalex]

Same problem here. I tried:

 block_device_mappings {
    device_name = "/dev/sda1"
    ebs {
      volume_size = 30
      encrypted   = false
    }
 }

but I get the same results. No problem with not root devices.
Any advice here? How to change the root device size?

[yardensachs]

Anyone has a work around until this is merged?

[cowdude]

@yardensachs We kept using good old AWS launch configurations instead of launch templates for configuring our ASG instances.

https://www.terraform.io/docs/providers/aws/r/launch_configuration.html