r/aws_lb_listener: Updating protocol from TLS to TCP leads to "ValidationError: An SSL policy cannot be specifed for TCP listeners"

[ewbankkit]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

resource "aws_lb_listener" "foo" {
  ...
  protocol          = "TLS"
  ssl_policy        = "ELBSecurityPolicy-TLS-1-2-Ext-2018-06"
  ...
}

$ terraform apply

✅

Change to:

resource "aws_lb_listener" "foo" {
  ...
  protocol          = "TCP"
  ssl_policy        = "" # Or removed completely
  ...
}

$ terraform plan
...
protocol:        "TLS" => "TCP"
...
$ terraform apply
...
Error modifying LB Listener: ValidationError: An SSL policy cannot be specifed for TCP listeners
...

❌

NLB support for TLS added via #7338.

[ewbankkit]

The problem is that https://github.com/terraform-providers/terraform-provider-aws/blob/f1c24b3125d85bffc33394e7e931f9557881cefd/aws/resource_aws_lb_listener.go#L344-L346 returns ok as true with sslPolicy equal to ELBSecurityPolicy-TLS-1-2-Ext-2018-06, the value set during resource creation.

[ewbankkit]

See this comment.

[Rohithzr]

@ewbankkit I viewed the comment you linked but I did not understand the solution to the issue. where do I set enable_dns_hostnames = false/true.

[ewbankkit]

@Rohithzr Unfortunately there currently is no solution 😞 due to the way that Terraform handles Optional + Computed attributes (which the ssl_policy attribute is).

[Rohithzr]

@ewbankkit ah! got you, that's actually a sad thing considering it seems very simple in this specific case.
I am actually trying to delay the situation where i would have to fork about 3-4 repositories (maybe more) of tf script that I am deploying. Because I need to modify the nlb listener created by that module's sub module. :(
https://serverfault.com/questions/970658/terraform-modify-lb-listener

[Frogvall]

Tainting the resource got me around this issue. Could turn out to be very annoying in the long run, since we run terraform apply in our ci/cd pipeline.

[github-actions]

Marking this issue as stale due to inactivity. This helps our maintainers find and focus on the active issues. If this issue receives no comments in the next 30 days it will automatically be closed. Maintainers can also remove the stale label.

If this issue was automatically closed and you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thank you!

[tophercullen]

This is still an issue in the latest provider.

[nisalupendra]

We still have this issue

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.