aws_route resource generates constant diff in terraform plan when specifying only the network_interface_id as a route target

[ghost]

This issue was originally opened by @ttcl19 as hashicorp/terraform#27426. It was migrated here as a result of the provider split. The original body of the issue is below.

---

Terraform Version

Terraform v0.13.5
AWS Provider version v3.22.0

Terraform Configuration Files

resource "aws_route_table" "aws_rtb" {
  vpc_id = module.foo_vpc.vpc_id
  tags = {
    Name = "rtb"
  }

  dynamic "route" {
    for_each = local.dhcp_route
    content {
      cidr_block                = route.key // This is a CIDR string
      egress_only_gateway_id    = ""
      gateway_id                = ""
      local_gateway_id          = ""
      ipv6_cidr_block           = ""
      nat_gateway_id            = ""
      network_interface_id      = route.value[1] // This is a string in a list
      transit_gateway_id        = ""
      vpc_peering_connection_id = ""
      vpc_endpoint_id           = ""
    }
  }

Debug Output

      + {
          + cidr_block                = "172.30.92.0/24"
          + egress_only_gateway_id    = ""
          + gateway_id                = ""
          + instance_id               = ""
          + ipv6_cidr_block           = ""
          + local_gateway_id          = ""
          + nat_gateway_id            = ""
          + network_interface_id      = "eni-1234"
          + transit_gateway_id        = ""
          + vpc_endpoint_id           = ""
          + vpc_peering_connection_id = ""
        },
      - {
          - cidr_block                = "172.30.92.0/24"
          - egress_only_gateway_id    = ""
          - gateway_id                = ""
          - instance_id               = "i-5678"
          - ipv6_cidr_block           = ""
          - local_gateway_id          = ""
          - nat_gateway_id            = ""
          - network_interface_id      = "eni-1234"
          - transit_gateway_id        = ""
          - vpc_endpoint_id           = ""
          - vpc_peering_connection_id = ""
        },

Expected Behavior

No diff for existing routes.

And being able to push a new route with network_interface_id as a target, either by specifying both the instance_id AND the network_interface_id, or only the network_interface_id but without it creating diffs afterwards in terraform plan (due to not specifying instance_id)

Actual Behavior

We see a permanent diff for existing routes because the instance ID isn't in the configuration, but we can't explicitly set the instance_id because only one of instance_id or network_interface_id can be set for terraform apply.

Steps to Reproduce

Create an aws_route resource with route config blocks.

[ewbankkit]

@ttcl19 Thanks for raising this issue.
I can reproduce with this configuration:

func testAccAWSRouteTableConfigIpv4NetworkInterfaceAttached(rName, destinationCidr string) string {
	return composeConfig(
		testAccLatestAmazonNatInstanceAmiConfig(),
		testAccAvailableAZsNoOptInConfig(),
		testAccAvailableEc2InstanceTypeForAvailabilityZone("data.aws_availability_zones.available.names[0]", "t3.micro", "t2.micro"),
		fmt.Sprintf(`
resource "aws_vpc" "test" {
  cidr_block = "10.1.0.0/16"

  tags = {
    Name = %[1]q
  }
}

resource "aws_subnet" "test" {
  cidr_block        = "10.1.1.0/24"
  vpc_id            = aws_vpc.test.id
  availability_zone = data.aws_availability_zones.available.names[0]

  tags = {
    Name = %[1]q
  }
}

resource "aws_network_interface" "test" {
  subnet_id = aws_subnet.test.id

  tags = {
    Name = %[1]q
  }
}

resource "aws_instance" "test" {
  ami           = data.aws_ami.amzn-ami-nat-instance.id
  instance_type = data.aws_ec2_instance_type_offering.available.instance_type

  network_interface {
    device_index         = 0
    network_interface_id = aws_network_interface.test.id
  }

  tags = {
    Name = %[1]q
  }
}

resource "aws_route_table" "test" {
  vpc_id = aws_vpc.test.id

  route {
    cidr_block           = %[2]q
    network_interface_id = aws_network_interface.test.id
  }

  tags = {
    Name = %[1]q
  }

  # Wait for the ENI attachment.
  depends_on = [aws_instance.test]
}
`, rName, destinationCidr))
}

$ make testacc TEST=./aws/ TESTARGS='-run=TestAccAWSRouteTable_IPv4_To_NetworkInterface_Attached'
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./aws -v -count 1 -parallel 20 -run=TestAccAWSRouteTable_IPv4_To_NetworkInterface_Attached -timeout 120m
=== RUN   TestAccAWSRouteTable_IPv4_To_NetworkInterface_Attached
=== PAUSE TestAccAWSRouteTable_IPv4_To_NetworkInterface_Attached
=== CONT  TestAccAWSRouteTable_IPv4_To_NetworkInterface_Attached
    resource_aws_route_table_test.go:916: Step 1/2 error: After applying this test step and performing a `terraform refresh`, the plan was not empty.
        stdout
        
        
        An execution plan has been generated and is shown below.
        Resource actions are indicated with the following symbols:
          ~ update in-place
        
        Terraform will perform the following actions:
        
          # aws_route_table.test will be updated in-place
          ~ resource "aws_route_table" "test" {
                id               = "rtb-0e2d220656157daa7"
                owner_id         = "123456789012"
                propagating_vgws = []
              ~ route            = [
                  + {
                      + cidr_block                = "10.2.0.0/16"
                      + egress_only_gateway_id    = ""
                      + gateway_id                = ""
                      + instance_id               = ""
                      + ipv6_cidr_block           = ""
                      + local_gateway_id          = ""
                      + nat_gateway_id            = ""
                      + network_interface_id      = "eni-09b0706208ef5c8c8"
                      + transit_gateway_id        = ""
                      + vpc_endpoint_id           = ""
                      + vpc_peering_connection_id = ""
                    },
                  - {
                      - cidr_block                = "10.2.0.0/16"
                      - egress_only_gateway_id    = ""
                      - gateway_id                = ""
                      - instance_id               = "i-0274d90fb176fc428"
                      - ipv6_cidr_block           = ""
                      - local_gateway_id          = ""
                      - nat_gateway_id            = ""
                      - network_interface_id      = "eni-09b0706208ef5c8c8"
                      - transit_gateway_id        = ""
                      - vpc_endpoint_id           = ""
                      - vpc_peering_connection_id = ""
                    },
                ]
                tags             = {
                    "Name" = "tf-acc-test-239919094786320031"
                }
                vpc_id           = "vpc-00c66d249162ef6ed"
            }
        
        Plan: 0 to add, 1 to change, 0 to destroy.

--- FAIL: TestAccAWSRouteTable_IPv4_To_NetworkInterface_Attached (403.84s)
FAIL
FAIL	github.com/terraform-providers/terraform-provider-aws/aws	403.936s
FAIL
GNUmakefile:27: recipe for target 'testacc' failed
make: *** [testacc] Error 1

[ewbankkit]

I'm going to close this issue as a duplicate of #1426 so that we can concentrate discussion in the linked issue.
Please add any additional comments there.

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thanks!