terraform-google-modules/terraform-google-cloud-nat

log_config_enable doesn't have effect on v1.3.0

aorfanos opened this issue · 5 comments

aorfanos commented

Relates to latest release, #35 and #24 .

I am using the following configuration:

module "cloud-nat" {
  source                           = "terraform-google-modules/cloud-nat/google"
  version                          = "1.3.0"
  project_id                       = var.project_id
  region                           = var.region
  router                           = "a-cloud-router"
  create_router                    = true
  network                          = "mynetwork"
  tcp_established_idle_timeout_sec = "180"
  log_config_enable                = false

The above always results in a '1 to change' for log_config:

      - log_config {
          - enable = false -> null
          - filter = "ALL" -> null
        }
github-actions commented

This issue is stale because it has been open 60 days with no activity. Remove stale label or comment or this will be closed in 7 days

aorfanos commented

This issue is stale because it has been open 60 days with no activity. Remove stale label or comment or this will be closed in 7 days

Can't remove the label, so comment it is

morgante commented

I believe this is an upstream bug, please open a provider issue.

lra commented

Same issue, I don't think this is an upstream bug, if you set log_config_enable=true, apply and set log_config_enable=false, the module does not set the log_config block anymore, and the provider assume it does not change, leading to a drift that cannot be fixed: there is not way to disable logging with this module once it's been enabled once.

The module should express the block, enabled or not.

Edit: Workaround: deleting and recreating the google_compute_router_nat fixes the issue.

morgante commented

@lra That is an upstream issue. Removing the block entirely should be equivalent to disabling it. Feel free to open an issue here: https://github.com/hashicorp/terraform-provider-google