<p>Figured it out!
The problem is that those DNS settings set in <code>aws_vpc_peering_connection_options</code> cannot be set until the peering connection is active (approved). It was only depending on <code>aws_vpc_peering_connection</code> existing, therefore was running at the same time or before <code>aws_vpc_peering_connection_accepter</code>.</p>

<p>This was simply fixed in <code>aws_vpc_peering_connection_options</code> by getting the <code>vpc_peering_connection_id</code> from <code>aws_vpc_peering_connection_accepter</code> instead of <code>aws_vpc_peering_connection</code>, so that the terraform dependency tree would automatically have the dependency work in the correct order.</p>

<p>Before:</p>

<pre><code>resource "aws_vpc_peering_connection_options" "sb_vpc_peering_options" {
  vpc_peering_connection_id = aws_vpc_peering_connection.sb_vpc_peering.id

  accepter {
    allow_remote_vpc_dns_resolution = var.accepter_dns_resolution
  }

  requester {
    allow_remote_vpc_dns_resolution = var.requester_dns_resolution
  }
}
</code></pre>

<p>After:</p>

<pre><code>resource "aws_vpc_peering_connection_options" "sb_vpc_peering_options" {
  vpc_peering_connection_id = aws_vpc_peering_connection_accepter.sb_vpc_peering_accepter.id

  accepter {
    allow_remote_vpc_dns_resolution = var.accepter_dns_resolution
  }

  requester {
    allow_remote_vpc_dns_resolution = var.requester_dns_resolution
  }
}
</code></pre>

CC BY-SA 4.0
2020-05-01T13:17:57.353Z
2020-05-01T13:17:57.353Z
apdcm
<p>I have the following configuration file:</p>

<p><code>environment/main.tf</code>:</p>

<pre><code>resource "aws_vpc_peering_connection" "sb_vpc_peering" {
  vpc_id      = var.vpc_id
  peer_vpc_id = var.peer_vpc_id
  peer_region = var.peer_region

  #Other vars
}

resource "aws_vpc_peering_connection_accepter" "sb_vpc_peering_accepter" {
  vpc_peering_connection_id = aws_vpc_peering_connection.sb_vpc_peering.id
  auto_accept               = true
}

resource "aws_vpc_peering_connection_options" "sb_vpc_peering_options" {
  vpc_peering_connection_id = aws_vpc_peering_connection.sb_vpc_peering.id

  accepter {
    allow_remote_vpc_dns_resolution = var.accepter_dns_resolution
  }

  requester {
    allow_remote_vpc_dns_resolution = var.requester_dns_resolution
  }
}

</code></pre>

<p>The problem here is that last block in <code>resource "aws_vpc_peering_connection_options" "sb_vpc_peering_options"</code>:</p>

<pre><code>  accepter {
    allow_remote_vpc_dns_resolution = var.accepter_dns_resolution
  }

  requester {
    allow_remote_vpc_dns_resolution = var.requester_dns_resolution
  }
</code></pre>

<p>This causes the following error:</p>

<pre><code>Error: error modifying VPC Peering Connection (pcx-084fe8578b2935b6a) Options: OperationNotPermitted: Peering pcx-084fe8578b2935b6a is not active. Peering options can be added only to active peerings.
    status code: 400, request id: 2aa0a163-e9db-4c55-aee5-4f7ffbbf8b9f

  on ../../../aws/vpc/peering-connection-accepter/main.tf line 15, in resource "aws_vpc_peering_connection_options" "sb_vpc_peering_options":
  15: resource "aws_vpc_peering_connection_options" "sb_vpc_peering_options" {
</code></pre>

<p>If I give it a couple of minutes and run <code>terraform apply</code> again, it works as the VPC has been given time to become active.</p>

<p>I originally had that DNS resolution bit within the <code>aws_vpc_peering_connection</code> resource itself, but the same error occurred so I separated them like this but that did not fix the issue.</p>

<p>Do I need to somehow have some sort of sleep before applying the options?</p>

<amazon-web-services><terraform>
Terraform fails to modify DNS settings a recently created VPC Peering connection because it is not yet active
apdcm
# Terraform fails to modify DNS settings a recently created VPC Peering connection because it is not yet active

(Asked by: username_0 on 2020-04-30)

I have the following configuration file:
environment/main.tf:
resource "aws_vpc_peering_connection" "sb_vpc_peering" {
  vpc_id      = var.vpc_id
  peer_vpc_id = var.peer_vpc_id
  peer_region = var.peer_region

  #Other vars
}

resource "aws_vpc_peering_connection_accepter" "sb_vpc_peering_accepter" {
  vpc_peering_connection_id = aws_vpc_peering_connection.sb_vpc_peering.id
  auto_accept               = true
}

resource "aws_vpc_peering_connection_options" "sb_vpc_peering_options" {
  vpc_peering_connection_id = aws_vpc_peering_connection.sb_vpc_peering.id

  accepter {
    allow_remote_vpc_dns_resolution = var.accepter_dns_resolution
  }

  requester {
    allow_remote_vpc_dns_resolution = var.requester_dns_resolution
  }
}


The problem here is that last block in resource "aws_vpc_peering_connection_options" "sb_vpc_peering_options":
  accepter {
    allow_remote_vpc_dns_resolution = var.accepter_dns_resolution
  }

  requester {
    allow_remote_vpc_dns_resolution = var.requester_dns_resolution
  }

This causes the following error:
Error: error modifying VPC Peering Connection (pcx-084fe8578b2935b6a) Options: OperationNotPermitted: Peering pcx-084fe8578b2935b6a is not active. Peering options can be added only to active peerings.
    status code: 400, request id: 2aa0a163-e9db-4c55-aee5-4f7ffbbf8b9f

  on ../../../aws/vpc/peering-connection-accepter/main.tf line 15, in resource "aws_vpc_peering_connection_options" "sb_vpc_peering_options":
  15: resource "aws_vpc_peering_connection_options" "sb_vpc_peering_options" {

If I give it a couple of minutes and run terraform apply again, it works as the VPC has been given time to become active.
I originally had that DNS resolution bit within the aws_vpc_peering_connection resource itself, but the same error occurred so I separated them like this but that did not fix the issue.
Do I need to somehow have some sort of sleep before applying the options?

**Tags:** amazon-web-services, terraform


---

## 1 answers

### Answer by username_0 on 2020-05-01. Score: 4 | Accepted answer

Figured it out!
The problem is that those DNS settings set in aws_vpc_peering_connection_options cannot be set until the peering connection is active (approved). It was only depending on aws_vpc_peering_connection existing, therefore was running at the same time or before aws_vpc_peering_connection_accepter.
This was simply fixed in aws_vpc_peering_connection_options by getting the vpc_peering_connection_id from aws_vpc_peering_connection_accepter instead of aws_vpc_peering_connection, so that the terraform dependency tree would automatically have the dependency work in the correct order.
Before:
resource "aws_vpc_peering_connection_options" "sb_vpc_peering_options" {
  vpc_peering_connection_id = aws_vpc_peering_connection.sb_vpc_peering.id

  accepter {
    allow_remote_vpc_dns_resolution = var.accepter_dns_resolution
  }

  requester {
    allow_remote_vpc_dns_resolution = var.requester_dns_resolution
  }
}

After:
resource "aws_vpc_peering_connection_options" "sb_vpc_peering_options" {
  vpc_peering_connection_id = aws_vpc_peering_connection_accepter.sb_vpc_peering_accepter.id

  accepter {
    allow_remote_vpc_dns_resolution = var.accepter_dns_resolution
  }

  requester {
    allow_remote_vpc_dns_resolution = var.requester_dns_resolution
  }
}


---

