Terrafrom 11 refresh failed due multiple VPC Endpoint Services matched

[KursLabIgor]

Started getting error for terraform 11 and module version 1.72

Error: Error refreshing state: 1 error occurred:
* module.vpc.data.aws_vpc_endpoint_service.s3: 1 error occurred:
* module.vpc.data.aws_vpc_endpoint_service.s3: data.aws_vpc_endpoint_service.s3: multiple VPC Endpoint Services matched; use additional constraints to reduce matches to a single VPC Endpoint Service

 plan: prep ## Run terraform plan
	@echo "$(BOLD)Run terraform plan for $(ENV) environment and $(WORKSPACE) workspace$(RESET)"
	@./aws-vault exec ${ENV} -- ./terraform get
	@./aws-vault exec ${ENV} -- ./terraform plan \
		-lock=true \
		-input=false \
		-refresh=true \
		-var-file="$(VARS)" \
		-var app=$(APPLICATION) \
		-out=tfplan

[antonbabenko]

Terraform 0.11 is not supported anymore. Please upgrade to use Terraform 0.12.26 or newer.

[yi2020]

@antonbabenko it's not a TF issue. This is an AWS issue. They all of a sudden added two endpoints by default - one gateway and one interface - for the S3:

-----------------------------------------------------: timestamp=2021-02-03T16:09:41.797+0200
2021-02-03T16:09:41.797+0200 [INFO]  plugin.terraform-provider-aws_v3.26.0_x5: 2021/02/03 16:09:41 [DEBUG] [aws-sdk-go] <?xml version=“1.0” encoding=“UTF-8"?>
<DescribeVpcEndpointServicesResponse xmlns=“http://ec2.amazonaws.com/doc/2016-11-15/”>
    <requestId>6ca56d9d-dc66-4018-94ea-afb3c401726d</requestId>
    <serviceDetailSet>
        <item>
            <acceptanceRequired>false</acceptanceRequired>
            <availabilityZoneSet>
                <item>eu-west-1a</item>
                <item>eu-west-1b</item>
                <item>eu-west-1c</item>
            </availabilityZoneSet>
            <baseEndpointDnsNameSet>
                <item>s3.eu-west-1.amazonaws.com</item>
            </baseEndpointDnsNameSet>
            <managesVpcEndpoints>false</managesVpcEndpoints>
            <owner>amazon</owner>
            <serviceId>vpce-svc-0f1f533e5ce5f9742</serviceId>
            <serviceName>com.amazonaws.eu-west-1.s3</serviceName>
            <serviceType>
                <item>
                    <serviceType>Gateway</serviceType>
                </item>
            </serviceType>
            <tagSet/>
            <vpcEndpointPolicySupported>true</vpcEndpointPolicySupported>
        </item>
        <item>
            <acceptanceRequired>false</acceptanceRequired>
            <availabilityZoneSet>
                <item>eu-west-1a</item>
                <item>eu-west-1b</item>
                <item>eu-west-1c</item>
            </availabilityZoneSet>
            <baseEndpointDnsNameSet>
                <item>s3.eu-west-1.vpce.amazonaws.com</item>
            </baseEndpointDnsNameSet>
            <managesVpcEndpoints>false</managesVpcEndpoints>
            <owner>amazon</owner>
            <serviceId>vpce-svc-0baafdadd7fd9e20e</serviceId>
            <serviceName>com.amazonaws.eu-west-1.s3</serviceName>
            <serviceType>
                <item>
                    <serviceType>Interface</serviceType>
                </item>
            </serviceType>
            <tagSet/>
Supported>true</vpcEndpointPolicySupported>
        </item>
    </serviceDetailSet>
    <serviceNameSet>
        <item>com.amazonaws.eu-west-1.s3</item>
        <item>com.amazonaws.eu-west-1.s3</item>
    </serviceNameSet>
</DescribeVpcEndpointServicesResponse>: timestamp=2021-02-03T16:09:41.797+0200
2021/02/03 16:09:41 [ERROR] eval: *terraform.evalReadDataRefresh, err: multiple VPC Endpoint Services matched; use additional constraints to reduce matches to a single VPC Endpoint Service
2021/02/03 16:09:41 [ERROR] eval: *terraform.EvalSequence, err: multiple VPC Endpoint Services matched; use additional constraints to reduce matches to a single VPC Endpoint Service
2021-02-03T16:09:42.316+0200 [INFO]  plugin.terraform-provider-aws_v3.26.0_x5: 2021/02/03 16:09:42 [DEBUG] [aws-sdk-go] DEBUG: Response ec2/DescribeVpcEndpointServices Details:
---[ RESPONSE ]--------------------------------------

If you try running the complete-vpc example right now you'll fail with any TF version.

[yi2020]

@KursLabIgor looks like this was fixed 18 hours ago (#573), pull a new version of this module.

[antonbabenko]

This could have been prevented if this module would look not ANY VPC endpoint available for the specific service, but filter using service_type filter in vpc_endpoint_service. This is what we have in the latest version (released yesterday).

Closing this issue, since Terraform 0.11 is out of scope for a rather long time.

[antonbabenko]

@KursLabIgor I have just released the fix in 1.73.0 for Terraform 0.11 users. The release has no new functionality other than the fix for the issue with the VPC endpoint for S3.

Check this pinned issue for more details about various solutions - #582

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues. If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.