Security group tags created by EKS could be overridden

[pcheung-sfdc]

Description

Starting with 18.14.0, this introduced a resource to override tags of the cluster primary SG. This could be used to override a tag used by EKS to delete the SG when destroying the cluster, leaving the SG lingering and unmanaged, which can prevent destroying the VPC it's in.

• [ X] ✋ I have searched the open/closed issues and my issue is not listed.

⚠️ Note

Before you submit an issue, please perform the following first:

1. Remove the local .terraform directory (! ONLY if state is stored remotely, which hopefully you are following that best practice!): rm -rf .terraform/
2. Re-initialize the project root to pull down modules: terraform init
3. Re-attempt your terraform plan or apply and check if the issue still persists

Versions

• Module version [Required]: 18.14.0 and above

• Terraform version: v1.1.7

• Provider version(s): ~v4.0

Reproduction Code [Required]

Steps to reproduce the behavior:
Pass in a "Name" tag to the module like for example:

module "eks" {
...
  tags = {
    Name = "foo"
  }
}

Expected behavior

The cluster primary SG is automatically generated when creating an EKS cluster is also automatically removed when destroying the cluster.

Actual behavior

The cluster primary SG is not being destroyed if its tags are overridden.

Terminal Output Screenshot(s)

Additional context

[bryantbiggs]

you should be able to re-override using cluster_tags

[pcheung-sfdc]

Any good reason not to set the cluster_tags?
If not, I can create a PR to specify the cluster_tags

[bryantbiggs]

No - we try to provide an "additional" tag for select resources where users might want to provide tags specific to that resource. var.tags is generic across all resources and var.cluster_tags is applied to just the cluster (i.e. - control plane)

[antonbabenko]

This issue has been resolved in version 18.20.2 🎉

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues. If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.