terraform destroy error - aws_security_group: DependencyViolation: resource sg-XXX has a dependent object

Question

Following Terraform script always returns following error when destroying the infrastructure. Notice that security group "GC-SG-VPC1" is being used in ingress rule in security group "default". During destroy Terraform attempts to delete "GC-SG-VPC1" and fails after multiple retries.

Any suggestions to get around this is much appreciated.

aws_security_group: DependencyViolation: resource sg-XXX has a dependent object

# Security Group GC-SG-VPC1
resource "aws_security_group" "GC-SG-VPC1" {
  name   = "GC-SG-VPC1"
  vpc_id = aws_vpc.vpc1.id

  tags = {
    Name = "GCTF-SG-VPC1"
  }
  #SSH and all PING
  ingress {
    description = "Allow SSH"
    from_port   = 22
    to_port     = 22
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  ingress {
    description = "Allow all PING"
    from_port   = -1
    to_port     = -1
    protocol    = "icmp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  ingress {
    description = "Allow iPERF3"
    from_port   = 5201
    to_port     = 5201
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

# Security Group default
resource "aws_default_security_group" "default" {
  vpc_id = aws_vpc.vpc1.id

  ingress {
    description = "Default SG for VPC1"
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    self        = true
  }

  ingress {
    description     = "Include EC2 SG in VPC1 default SG"
    from_port       = 0
    to_port         = 0
    protocol        = "-1"
    security_groups = [aws_security_group.GC-SG-VPC1.id]
  }

  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }

  tags = {
    Name = "Default VPC1-SG"
  }
}

Answer 1

You shouldn't be using aws_default_security_group, as this is in most cases not needed and considered as an advance feature. Default SG can't be deleted, nor TF deletes it rules, as explained in the docs:

All ingress or egress rules will be left as they are at the time of removal.

Since you bound your GC-SG-VPC1 with aws_default_security_group, you have to go to AWS console and manually remove this relationship, as TF does not do it.

Then, instead of aws_default_security_group use just regular aws_security_group.