2

I have the following configuration file:

environment/main.tf:

resource "aws_vpc_peering_connection" "sb_vpc_peering" {
  vpc_id      = var.vpc_id
  peer_vpc_id = var.peer_vpc_id
  peer_region = var.peer_region

  #Other vars
}

resource "aws_vpc_peering_connection_accepter" "sb_vpc_peering_accepter" {
  vpc_peering_connection_id = aws_vpc_peering_connection.sb_vpc_peering.id
  auto_accept               = true
}

resource "aws_vpc_peering_connection_options" "sb_vpc_peering_options" {
  vpc_peering_connection_id = aws_vpc_peering_connection.sb_vpc_peering.id

  accepter {
    allow_remote_vpc_dns_resolution = var.accepter_dns_resolution
  }

  requester {
    allow_remote_vpc_dns_resolution = var.requester_dns_resolution
  }
}

The problem here is that last block in resource "aws_vpc_peering_connection_options" "sb_vpc_peering_options":

  accepter {
    allow_remote_vpc_dns_resolution = var.accepter_dns_resolution
  }

  requester {
    allow_remote_vpc_dns_resolution = var.requester_dns_resolution
  }

This causes the following error:

Error: error modifying VPC Peering Connection (pcx-084fe8578b2935b6a) Options: OperationNotPermitted: Peering pcx-084fe8578b2935b6a is not active. Peering options can be added only to active peerings.
    status code: 400, request id: 2aa0a163-e9db-4c55-aee5-4f7ffbbf8b9f

  on ../../../aws/vpc/peering-connection-accepter/main.tf line 15, in resource "aws_vpc_peering_connection_options" "sb_vpc_peering_options":
  15: resource "aws_vpc_peering_connection_options" "sb_vpc_peering_options" {

If I give it a couple of minutes and run terraform apply again, it works as the VPC has been given time to become active.

I originally had that DNS resolution bit within the aws_vpc_peering_connection resource itself, but the same error occurred so I separated them like this but that did not fix the issue.

Do I need to somehow have some sort of sleep before applying the options?

2

Figured it out! The problem is that those DNS settings set in aws_vpc_peering_connection_options cannot be set until the peering connection is active (approved). It was only depending on aws_vpc_peering_connection existing, therefore was running at the same time or before aws_vpc_peering_connection_accepter.

This was simply fixed in aws_vpc_peering_connection_options by getting the vpc_peering_connection_id from aws_vpc_peering_connection_accepter instead of aws_vpc_peering_connection, so that the terraform dependency tree would automatically have the dependency work in the correct order.

Before:

resource "aws_vpc_peering_connection_options" "sb_vpc_peering_options" {
  vpc_peering_connection_id = aws_vpc_peering_connection.sb_vpc_peering.id

  accepter {
    allow_remote_vpc_dns_resolution = var.accepter_dns_resolution
  }

  requester {
    allow_remote_vpc_dns_resolution = var.requester_dns_resolution
  }
}

After:

resource "aws_vpc_peering_connection_options" "sb_vpc_peering_options" {
  vpc_peering_connection_id = aws_vpc_peering_connection_accepter.sb_vpc_peering_accepter.id

  accepter {
    allow_remote_vpc_dns_resolution = var.accepter_dns_resolution
  }

  requester {
    allow_remote_vpc_dns_resolution = var.requester_dns_resolution
  }
}

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.