[Bug]: aws_lb_listener import returns invalid configuration, with both default_action.target_group_arn and default_action.forward.target_group.arn

[robbycuenot]

Terraform Core Version

1.7.5

AWS Provider Version

5.46.0

Affected Resource(s)

aws_lb_listener

Expected Behavior

When importing a aws_lb_listener resource with aws_lb_listener.example.default_action[0].forward.target_group.arn specified, the value aws_lb_listener.example.default_action[0].target_group_arn should not be included in the returned config, as only one of the two values may be specified.

Actual Behavior

Both values are returned in the plan, showing a change in the configuration when there should not be one.

Example Output:

  # aws_lb_listener.example will be updated in-place
  # (imported from "arn:aws:elasticloadbalancing:us-west-2:012345678901:listener/app/example-app/0123456789012345/0123456789012345")
  ~ resource "aws_lb_listener" "example" {
        arn               = "arn:aws:elasticloadbalancing:us-west-2:012345678901:listener/app/example-app/0123456789012345/0123456789012345"
        certificate_arn   = "arn:aws:acm:us-west-2:012345678901:certificate/01234567-0123-0123-0123-012345678901"
        id                = "arn:aws:elasticloadbalancing:us-west-2:012345678901:listener/app/example-app/0123456789012345/0123456789012345"
        load_balancer_arn = "arn:aws:elasticloadbalancing:us-west-2:012345678901:loadbalancer/app/example-app/0123456789012345"
        port              = 443
        protocol          = "HTTPS"
        ssl_policy        = "ELBSecurityPolicy-2016-08"
        tags              = {}
        tags_all          = {}

      ~ default_action {
            order            = 1
          - target_group_arn = "arn:aws:elasticloadbalancing:us-west-2:012345678901:targetgroup/example-app/0123456789012345" -> null
            type             = "forward"

            forward {
                stickiness {
                    duration = 3600
                    enabled  = false
                }
                target_group {
                    arn    = "arn:aws:elasticloadbalancing:us-west-2:012345678901:targetgroup/example-app/0123456789012345"
                    weight = 1
                }
            }
        }

        mutual_authentication {
            ignore_client_certificate_expiry = false
            mode                             = "off"
        }
    }

Relevant Error/Panic Output Snippet

Attempting to match the returned configuration results in the following error:

│ Error: Invalid Attribute Combination
│ Only one of "default_action[0].target_group_arn" or "default_action[0].forward" can be specified.

Terraform Configuration Files

resource "aws_lb_listener" "example" {
  load_balancer_arn = aws_lb.example.arn
  port              = "443"
  protocol          = "HTTPS"
  ssl_policy        = "ELBSecurityPolicy-2016-08"
  certificate_arn   = aws_acm_certificate.example.arn

  default_action {
    order            = 1
    type             = "forward"
    forward {
      target_group {
        arn = aws_lb_target_group.example-app.arn
        weight = 1
      }
      stickiness {
        enabled = false
        duration = 3600
      }
    }
  }
}

import {
    to = aws_lb_listener.example
    id = "arn:aws:elasticloadbalancing:us-west-2:012345678901:listener/app/example-app/0123456789012345/0123456789012345"
}

Steps to Reproduce

Attempt to import an existing aws_lb_listener resource with aws_lb_listener.example.default_action[0].forward.target_group.arn specified

Debug Output

No response

Panic Output

No response

Important Factoids

No response

References

A similar bugfix was pushed in 5.36.0, per this closed issue: https://github.com/hashicorp/terraform-provider-aws/issues/35621

Would you like to implement a fix?

None