Terraform fails to modify DNS settings a recently created VPC Peering connection because it is not yet active

Question

I have the following configuration file:

environment/main.tf:

resource "aws_vpc_peering_connection" "sb_vpc_peering" {
  vpc_id      = var.vpc_id
  peer_vpc_id = var.peer_vpc_id
  peer_region = var.peer_region

  #Other vars
}

resource "aws_vpc_peering_connection_accepter" "sb_vpc_peering_accepter" {
  vpc_peering_connection_id = aws_vpc_peering_connection.sb_vpc_peering.id
  auto_accept               = true
}

resource "aws_vpc_peering_connection_options" "sb_vpc_peering_options" {
  vpc_peering_connection_id = aws_vpc_peering_connection.sb_vpc_peering.id

  accepter {
    allow_remote_vpc_dns_resolution = var.accepter_dns_resolution
  }

  requester {
    allow_remote_vpc_dns_resolution = var.requester_dns_resolution
  }
}

The problem here is that last block in resource "aws_vpc_peering_connection_options" "sb_vpc_peering_options":

  accepter {
    allow_remote_vpc_dns_resolution = var.accepter_dns_resolution
  }

  requester {
    allow_remote_vpc_dns_resolution = var.requester_dns_resolution
  }

This causes the following error:

Error: error modifying VPC Peering Connection (pcx-084fe8578b2935b6a) Options: OperationNotPermitted: Peering pcx-084fe8578b2935b6a is not active. Peering options can be added only to active peerings.
    status code: 400, request id: 2aa0a163-e9db-4c55-aee5-4f7ffbbf8b9f

  on ../../../aws/vpc/peering-connection-accepter/main.tf line 15, in resource "aws_vpc_peering_connection_options" "sb_vpc_peering_options":
  15: resource "aws_vpc_peering_connection_options" "sb_vpc_peering_options" {

If I give it a couple of minutes and run terraform apply again, it works as the VPC has been given time to become active.

I originally had that DNS resolution bit within the aws_vpc_peering_connection resource itself, but the same error occurred so I separated them like this but that did not fix the issue.

Do I need to somehow have some sort of sleep before applying the options?

Answer 1

Figured it out! The problem is that those DNS settings set in aws_vpc_peering_connection_options cannot be set until the peering connection is active (approved). It was only depending on aws_vpc_peering_connection existing, therefore was running at the same time or before aws_vpc_peering_connection_accepter.

This was simply fixed in aws_vpc_peering_connection_options by getting the vpc_peering_connection_id from aws_vpc_peering_connection_accepter instead of aws_vpc_peering_connection, so that the terraform dependency tree would automatically have the dependency work in the correct order.

Before:

resource "aws_vpc_peering_connection_options" "sb_vpc_peering_options" {
  vpc_peering_connection_id = aws_vpc_peering_connection.sb_vpc_peering.id

  accepter {
    allow_remote_vpc_dns_resolution = var.accepter_dns_resolution
  }

  requester {
    allow_remote_vpc_dns_resolution = var.requester_dns_resolution
  }
}

After:

resource "aws_vpc_peering_connection_options" "sb_vpc_peering_options" {
  vpc_peering_connection_id = aws_vpc_peering_connection_accepter.sb_vpc_peering_accepter.id

  accepter {
    allow_remote_vpc_dns_resolution = var.accepter_dns_resolution
  }

  requester {
    allow_remote_vpc_dns_resolution = var.requester_dns_resolution
  }
}