Terraform destroy API Gateway with VPC Link fails

Question

Setup

Terraform v 0.11.14
OpenAPI spec 3.0 to define the body of my API Gateway

Terraform Resources

I've created a Private API Gateway which routes traffic to an NLB via VPC Links. I have deployed the API, but for brevity I've omitted that resource from the below since it is trivial.

resource "aws_api_gateway_rest_api" "this" {
  name        = "MyAPI"
  body        = "${file("./api-spec.yaml")}"

  endpoint_configuration {
    types = ["PRIVATE"]
  }
}

resource "aws_lb" "app" {
  name               = "MyNLB"
  internal           = true
  load_balancer_type = "network"
  subnets            = ["MySubnetIds"]
}

resource "aws_api_gateway_vpc_link" "nlb" {
  name        = "api-gateway-to-nlb"
  target_arns = ["${aws_lb.app.arn}"]
}

The VPC Link is referenced in the api-spec.yaml file. The relevant section is:

paths:
  /items:
    get:
      summary: Gets a collection of items
      responses:
        '200':
          description: Ok
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/Item'
      x-amazon-apigateway-integration:
        type:              http_proxy
        httpMethod:        GET
        uri:               https://my-internal-nlb/api/v1/items
        connectionType:    "VPC_LINK"
        connectionId:      "${vpclink_id}"
        responses:
          default:
            statusCode: '200'

Issue

When I run terraform destroy, I get the following message:

Error: Error applying plan:

1 error occurred:
* aws_api_gateway_vpc_link.nlb (destroy): 1 error occurred:
* aws_api_gateway_vpc_link.nlb: error deleting API Gateway VPC Link (bgzpv1): BadRequestException: Cannot delete vpc link. Vpc link 'bgzpv1', is referenced in deployed stages [POST:50f55s:development, GET:50f55s:development] in format of [Method:Resource:Stage] and also in undeployed integration [GET:50f55s, POST:50f55s] in format of [Method:Resource]. status code: 400, request id: d9a9667b-8099-11e9-98d1-9f899674f4b9

If I wait a few minutes and then run terraform destroy again, the following resources are destroyed:

aws_lb.app
aws_api_gateway_vpc_link.nlb

I've had a google, but can't find much information on the topic. There was a ticket raised on the AWS support forums, but this was a while ago and AWS indicated they were going to fix the problem

Christopher Thomas Christopher Thomas · Accepted Answer · 2020-03-04T16:17:15

The actual answer to this is slightly different from what @dtelaroli mentioned and I've been researching what the problem might be.

When API Gateway is deployed, it's built into a distribution and pushed to CloudFront where it's served.

If you reference a VPC link, this link is built into the distribution and pushed to CloudFront also. That's why when this API is deployed, the VPC link can't be destroyed. Because it's being used in a live CloudFront distribution.

In order to destroy the VPC link, you'd need to first delete the integration which targets the VPC link, then deploy the API Gateway again, this will mean your API is probably broken at this stage, but now you will be able to delete the VPC Link.

You should at this point be able to destroy your API Gateway, or rebuild it in some way, because CloudFront no longer contains that connection to the VPC link anymore.

I'm unable to think how this can be scripted or built into terraform by using null resources or things like that, but that's the reason the problem is happening.

Terraform destroy API Gateway with VPC Link fails

1 Answers