Error during creation of instance from scratch with a random string included in the Name

[maksperovpm]

Description

Hi team, Hope you're doing well.

After upgrade to the latest version of Terraform cli and EC2 module we start experiencing an issue with EC2 instances creation.
We had no problems using the latest 5.x version.

The issue is caused by 2 factors:

1. a new resource was added to the module, specificaly this one >>> resource "aws_ec2_tag" "spot_instance".
2. (no issues before) we call this module from our private module and provide the calculated "name" attribute value that contains a random string

This is the name value we provide
name = join("-", [var.environment_name, var.server_name, random_string.name_suffix[0].result])

This is the error we get
on .terraform/modules/complete.ec2/main.tf line 612, in resource "aws_ec2_tag" "spot_instance":
│ 612: for_each = { for k, v in local.instance_tags : k => v if local.create && var.create_spot_instance }
│ ├────────────────
│ │ local.create is true
│ │ local.instance_tags is a map of string, known only after apply
│ │ var.create_spot_instance is false

Versions

• Module version [Required]:

• Terraform version:
  1.13.2

• Provider version(s):
  6.14.1

Reproduction Code [Required]

resource "random_string" "name_suffix" {
  length    = 2
  special   = false
  min_lower = 1
  min_upper = 1
}

module "ec2" {
  source  = "terraform-aws-modules/ec2-instance/aws"
  version = "6.1.1"
  create = var.create
  name  = join("-", ["ENV-NAME", "SERVER-NAME", random_string.name_suffix[0].result])
  ...
}

Expected behavior

Our stunning developers to find a better create condition for resource "aws_ec2_tag" "spot_instance" that will not fail the creation of instance from scratch because of a tag that includes a string from a parallel resource.

May the force be with you.

[dbaber]

You can always reset the name is a user_data command for now. That's what I ended up doing. Plus I still needed to set the actual hostname so might as well update the tags there too.

[maksperovpm]

You can always reset the name is a user_data command for now.

Yes, we can, only once on the first instance run or each time on restart the server set EC2 launch to run userdata, which is not handy in one hand. In another hand we had a lot of custom commands we need to run only once on first run to configure the server which will require us to implement a mechanism to skip this on next runs.

Moreover, userdata will restore the name, but what about terraform? it will notify on each plan that it wants to chnage instance tag Name, the thing we don't want to happen....beside that fact, on apply we'll have to restart the server to run userdata to restore the name.
We can use targeting but it's not a comfy.

I tried to create a separate tag resource and associate it with the instance, but, expectedly, module wants to set it's name tag value.

So, to not overcomplicate the things for endusers, I believe there is a more tricky condition for added recently "aws_ec2_tag" "spot_instance" resource that can fix this behavior and make our servers great again.

[dbaber]

One big down side I've now run into is tags on the volumes not being quite right since I have to name things after the fact. I'm thinking about jettisoning this module just so I can use a random resource in my Name tag(s). Or I'll pull this down and check in a hacked version and remove this problematic resource.

[dbaber]

I am literally just keeping around a hacked version with that resource commented out for now.

[bryantbiggs]

I am literally waiting for a minimum, deployable reproduction 😬

[maksperovpm]

I am literally waiting for a minimum, deployable reproduction 😬

Hi. What do you mean?
Do you want me to share a full code example for issue reproduction?

[bryantbiggs]

I am literally waiting for a minimum, deployable reproduction 😬

Hi. What do you mean? Do you want me to share a full code example for issue reproduction?

https://github.com/bryantbiggs/how-to-create-reproduction

[maksperovpm]

I am literally waiting for a minimum, deployable reproduction 😬

terraform {
  required_version = ">=1.13.0, <1.14.0"
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">=6.13.0"
    }
  }
}

provider "aws" {
  region  = "eu-west-2"
  profile = "YOUR_AWS_PROFILE_NAME"
}

data "aws_ami" "amazon_linux" {
  most_recent = true
  owners      = ["amazon"]
  name_regex  = "^al2023-ami-2023.*-x86_64"
}

data "aws_availability_zones" "available" {}

resource "random_string" "suffix" {
  length  = 2
  numeric = false
  upper   = false
  special = false
}

locals {
  vpc_cidr = "10.0.0.0/16"
  azs      = slice(data.aws_availability_zones.available.names, 0, 3)
  name     = join("-", ["Test", random_string.suffix.result])
}

module "ec2" {
  source             = "terraform-aws-modules/ec2-instance/aws"
  version            = "6.1.2"
  name               = local.name
  ignore_ami_changes = true
  ami                = data.aws_ami.amazon_linux.id
  instance_type      = "t3.micro"
  availability_zone  = element(module.vpc.azs, 0)
  subnet_id          = element(module.vpc.private_subnets, 0)
}

module "vpc" {
  source  = "terraform-aws-modules/vpc/aws"
  version = "~>6.0"

  name = local.name
  cidr = local.vpc_cidr

  azs             = slice(data.aws_availability_zones.available.names, 0, 3)
  private_subnets = [for k, v in local.azs : cidrsubnet(local.vpc_cidr, 4, k)]
  public_subnets  = [for k, v in local.azs : cidrsubnet(local.vpc_cidr, 8, k + 48)]
}

[bryantbiggs]

thank you!