terragrunt output dependency ARN isn't valid

[bigred247]

Hey all, i'm. getting the below error when running terragrunt apply. It is complaining about the ARN that is being ingested but looking at the error it seems to be pulling the correct value based on the output. Any idea what maybe causing this?

error message

│ Error: creating WAFv2 WebACL Association (arn:aws:wafv2:eu-west-2:1234567891011:regional/webacl/abcdeWebACL/7234ae53-53f3-4ebc-87aa-37b4c3f2fcb7,arn:aws:elasticloadbalancing:eu-west-2:1234567891011:loadbalancer/abcde-dev-lb-classic): WAFInvalidParameterException: Error reason: The ARN isn't valid. A valid ARN begins with arn: and includes other information separated by colons or slashes., field: RESOURCE_ARN, parameter: arn:aws:elasticloadbalancing:eu-west-2:1234567891011:loadbalancer/abcde-dev-lb-classic
│ {
│   RespMetadata: {
│     StatusCode: 400,
│     RequestID: "102e01f1-b8c9-4a2b-8347-59e20ec2433c"
│   },
│   Field: "RESOURCE_ARN",
│   Message_: "Error reason: The ARN isn't valid. A valid ARN begins with arn: and includes other information separated by colons or slashes., field: RESOURCE_ARN, parameter: arn:aws:elasticloadbalancing:eu-west-2:1234567891011:loadbalancer/abcde-dev-lb-classic",
│   Parameter: "arn:aws:elasticloadbalancing:eu-west-2:1234567891011:loadbalancer/abcde-dev-lb-classic",
│   Reason: "The ARN isn't valid. A valid ARN begins with arn: and includes other information separated by colons or slashes."
│ }
│ 
│   with aws_wafv2_web_acl_association.default_web_acl_association,
│   on main.tf line 130, in resource "aws_wafv2_web_acl_association" "default_web_acl_association":
│  130: resource "aws_wafv2_web_acl_association" "default_web_acl_association" {

terragrunt.hcl

include "root" {
  path = find_in_parent_folders()
}

locals {
  # Load the data from common.hcl
  common = read_terragrunt_config("../common.hcl")
}

dependency "bucket-waf" {
  config_path = "../s3/waf_bucket"
}

dependency "elb" {
  config_path = "../elb_classic"
}

dependency "ip-set" {
  config_path = "../ip-set"
}

# Set the generate config dynamically to the generate config in common.hcl
generate = local.common.generate

terraform {
  source = "git::[email protected]:pol-onesource/terraform-aws-waf.git?ref=master"

}

inputs = {
  web_acl_name                          = "poetsWebACL"
  web_acl_description                   = "Web ACL for Poets GoAnywhere Service"
  web_acl_scope                         = "REGIONAL"
  default_action                        = "block"
  s3_logging_arn                        = dependency.bucket-waf.outputs.s3_bucket_arn
  target_resource                       = dependency.elb.outputs.arn

outputs.tf

output "arn" {
  value = aws_elb.main.arn
}

---

Tracked in ticket #110147

[denis256]

Hi,
looks like WAFv2 has a different scheme for the ARN

https://repost.aws/questions/QUzpvTS6I6RXee9qmsdEz3lQ/questions/QUzpvTS6I6RXee9qmsdEz3lQ/can-t-associate-webacl-to-api-gateway-by-cloudformation

https://stackoverflow.com/questions/60955745/applying-webacl-to-api-gateway

[bigred247]

@denis256
Thanks for the heads up. So judging by this, i don't see how i can reference the arn that is output from my classic load balancer and ingest into my WAF terragrunt/terraform code. I suspect it's not possible. I've just switched from an app load balancer (where the arn did work) to a classic load balancer and have ran into this issue. I wonder if there is a compatibility issue between a wafv2 and a classic load balancer?