data.aws_subnets.default.ids known only after apply about terraform-aws-secure-baseline HOT 3 OPEN

Does anyone have a workaround for this? I'm also seeing it with version 2.0.0

from terraform-aws-secure-baseline.

For what it's worth, only the master/org management account is throwing the error. Other accounts process correctly

from terraform-aws-secure-baseline.

This is how I resolved things:

This issue looked due to the state for each aws_default_vpc being outdated/incompatible. At this time, there are 17 regions/default vpc resources, which seemed to line up with @WTPascoe's experiences of 17 error messages. I found a more specific error message eventually that looked like:

data could not be decoded from the state: unsupported attribute "ipv4_ipam_pool_id"

To get around that, I removed all of the aws_default_vpc resources from state and re-added each:

terraform state rm "module.secure_baseline.module.vpc_baseline_ap-northeast-2[0].aws_default_vpc.default"
terraform state rm "module.secure_baseline.module.vpc_baseline_ap-northeast-3[0].aws_default_vpc.default"
terraform state rm "module.secure_baseline.module.vpc_baseline_ap-south-1[0].aws_default_vpc.default"
....


terraform import "module.secure_baseline.module.vpc_baseline_ap-northeast-1[0].aws_default_vpc.default" vpc-123
terraform import "module.secure_baseline.module.vpc_baseline_ap-northeast-2[0].aws_default_vpc.default" vpc-456
terraform import "module.secure_baseline.module.vpc_baseline_ap-northeast-3[0].aws_default_vpc.default" vpc-789
terraform import "module.secure_baseline.module.vpc_baseline_ap-south-1[0].aws_default_vpc.default" vpc-4242
...

I then removed all of the aws_default_subnet resources. I commented out the data blocks and aws_default_subnet block from the vpc-baseline module. Then I ran terraform apply locally, since I was using a modified module. That allowed things to succeed and sync the state with my account. Finally, I restored the original code of the nozaq module (data blocks and default subnet resources) and ran terraform apply once more. That allowed the vpc-baseline module to once again manage default subnets.

from terraform-aws-secure-baseline.