Answers: <p>Figured it out!
  The problem is that those DNS settings set in <code>aws_vpc_peering_connection_options</code> cannot be set until the peering connection is active (approved). It was only depending on <code>aws_vpc_peering_connection</code> existing, therefore was running at the same time or before <code>aws_vpc_peering_connection_accepter</code>.</p>
  
  <p>This was simply fixed in <code>aws_vpc_peering_connection_options</code> by getting the <code>vpc_peering_connection_id</code> from <code>aws_vpc_peering_connection_accepter</code> instead of <code>aws_vpc_peering_connection</code>, so that the terraform dependency tree would automatically have the dependency work in the correct order.</p>
  
  <p>Before:</p>
  
  <pre><code>resource "aws_vpc_peering_connection_options" "sb_vpc_peering_options" {
    vpc_peering_connection_id = aws_vpc_peering_connection.sb_vpc_peering.id
  
    accepter {
      allow_remote_vpc_dns_resolution = var.accepter_dns_resolution
    }
  
    requester {
      allow_remote_vpc_dns_resolution = var.requester_dns_resolution
    }
  }
  </code></pre>
  
  <p>After:</p>
  
  <pre><code>resource "aws_vpc_peering_connection_options" "sb_vpc_peering_options" {
    vpc_peering_connection_id = aws_vpc_peering_connection_accepter.sb_vpc_peering_accepter.id
  
    accepter {
      allow_remote_vpc_dns_resolution = var.accepter_dns_resolution
    }
  
    requester {
      allow_remote_vpc_dns_resolution = var.requester_dns_resolution
    }
  }
  </code></pre>
  
Answers: CC BY-SA 4.0
Answers: 2020-05-01T13:17:57.353Z
Answers: 2020-05-01T13:17:57.353Z
Answers: apdcm
Body: <p>I have the following configuration file:</p>
  
  <p><code>environment/main.tf</code>:</p>
  
  <pre><code>resource "aws_vpc_peering_connection" "sb_vpc_peering" {
    vpc_id      = var.vpc_id
    peer_vpc_id = var.peer_vpc_id
    peer_region = var.peer_region
  
    #Other vars
  }
  
  resource "aws_vpc_peering_connection_accepter" "sb_vpc_peering_accepter" {
    vpc_peering_connection_id = aws_vpc_peering_connection.sb_vpc_peering.id
    auto_accept               = true
  }
  
  resource "aws_vpc_peering_connection_options" "sb_vpc_peering_options" {
    vpc_peering_connection_id = aws_vpc_peering_connection.sb_vpc_peering.id
  
    accepter {
      allow_remote_vpc_dns_resolution = var.accepter_dns_resolution
    }
  
    requester {
      allow_remote_vpc_dns_resolution = var.requester_dns_resolution
    }
  }
  
  </code></pre>
  
  <p>The problem here is that last block in <code>resource "aws_vpc_peering_connection_options" "sb_vpc_peering_options"</code>:</p>
  
  <pre><code>  accepter {
      allow_remote_vpc_dns_resolution = var.accepter_dns_resolution
    }
  
    requester {
      allow_remote_vpc_dns_resolution = var.requester_dns_resolution
    }
  </code></pre>
  
  <p>This causes the following error:</p>
  
  <pre><code>Error: error modifying VPC Peering Connection (pcx-084fe8578b2935b6a) Options: OperationNotPermitted: Peering pcx-084fe8578b2935b6a is not active. Peering options can be added only to active peerings.
      status code: 400, request id: 2aa0a163-e9db-4c55-aee5-4f7ffbbf8b9f
  
    on ../../../aws/vpc/peering-connection-accepter/main.tf line 15, in resource "aws_vpc_peering_connection_options" "sb_vpc_peering_options":
    15: resource "aws_vpc_peering_connection_options" "sb_vpc_peering_options" {
  </code></pre>
  
  <p>If I give it a couple of minutes and run <code>terraform apply</code> again, it works as the VPC has been given time to become active.</p>
  
  <p>I originally had that DNS resolution bit within the <code>aws_vpc_peering_connection</code> resource itself, but the same error occurred so I separated them like this but that did not fix the issue.</p>
  
  <p>Do I need to somehow have some sort of sleep before applying the options?</p>
  
Tags: <amazon-web-services><terraform>
Title: Terraform fails to modify DNS settings a recently created VPC Peering connection because it is not yet active
UserDisplayName: apdcm
ThreadText: # Terraform fails to modify DNS settings a recently created VPC Peering connection because it is not yet active
  
  (Asked by: username_0 on 2020-04-30)
  
  I have the following configuration file:
  
  `environment/main.tf`:
  
  ```
  resource "aws_vpc_peering_connection" "sb_vpc_peering" {
    vpc_id      = var.vpc_id
    peer_vpc_id = var.peer_vpc_id
    peer_region = var.peer_region
  
    #Other vars
  }
  
  resource "aws_vpc_peering_connection_accepter" "sb_vpc_peering_accepter" {
    vpc_peering_connection_id = aws_vpc_peering_connection.sb_vpc_peering.id
    auto_accept               = true
  }
  
  resource "aws_vpc_peering_connection_options" "sb_vpc_peering_options" {
    vpc_peering_connection_id = aws_vpc_peering_connection.sb_vpc_peering.id
  
    accepter {
      allow_remote_vpc_dns_resolution = var.accepter_dns_resolution
    }
  
    requester {
      allow_remote_vpc_dns_resolution = var.requester_dns_resolution
    }
  }
  
  ```
  
  The problem here is that last block in `resource "aws_vpc_peering_connection_options" "sb_vpc_peering_options"`:
  
  ```
    accepter {
      allow_remote_vpc_dns_resolution = var.accepter_dns_resolution
    }
  
    requester {
      allow_remote_vpc_dns_resolution = var.requester_dns_resolution
    }
  
  ```
  
  This causes the following error:
  
  ```
  Error: error modifying VPC Peering Connection (pcx-084fe8578b2935b6a) Options: OperationNotPermitted: Peering pcx-084fe8578b2935b6a is not active. Peering options can be added only to active peerings.
      status code: 400, request id: 2aa0a163-e9db-4c55-aee5-4f7ffbbf8b9f
  
    on ../../../aws/vpc/peering-connection-accepter/main.tf line 15, in resource "aws_vpc_peering_connection_options" "sb_vpc_peering_options":
    15: resource "aws_vpc_peering_connection_options" "sb_vpc_peering_options" {
  
  ```
  
  If I give it a couple of minutes and run `terraform apply` again, it works as the VPC has been given time to become active.
  
  I originally had that DNS resolution bit within the `aws_vpc_peering_connection` resource itself, but the same error occurred so I separated them like this but that did not fix the issue.
  
  Do I need to somehow have some sort of sleep before applying the options?
  
  **Tags:** amazon-web-services, terraform
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_0 on 2020-05-01. Score: 4 | Accepted answer
  
  Figured it out!
  The problem is that those DNS settings set in `aws_vpc_peering_connection_options` cannot be set until the peering connection is active (approved). It was only depending on `aws_vpc_peering_connection` existing, therefore was running at the same time or before `aws_vpc_peering_connection_accepter`.
  
  This was simply fixed in `aws_vpc_peering_connection_options` by getting the `vpc_peering_connection_id` from `aws_vpc_peering_connection_accepter` instead of `aws_vpc_peering_connection`, so that the terraform dependency tree would automatically have the dependency work in the correct order.
  
  Before:
  
  ```
  resource "aws_vpc_peering_connection_options" "sb_vpc_peering_options" {
    vpc_peering_connection_id = aws_vpc_peering_connection.sb_vpc_peering.id
  
    accepter {
      allow_remote_vpc_dns_resolution = var.accepter_dns_resolution
    }
  
    requester {
      allow_remote_vpc_dns_resolution = var.requester_dns_resolution
    }
  }
  
  ```
  
  After:
  
  ```
  resource "aws_vpc_peering_connection_options" "sb_vpc_peering_options" {
    vpc_peering_connection_id = aws_vpc_peering_connection_accepter.sb_vpc_peering_accepter.id
  
    accepter {
      allow_remote_vpc_dns_resolution = var.accepter_dns_resolution
    }
  
    requester {
      allow_remote_vpc_dns_resolution = var.requester_dns_resolution
    }
  }
  
  ```
  
  
  ---
  
  