From f14297845669579e702f85cbf39724020d16f92e Mon Sep 17 00:00:00 2001
From: Mitchell Hashimoto <mitchell.hashimoto@gmail.com>
Date: Thu, 27 Oct 2016 08:44:59 -0400
Subject: [PATCH] terraform: add test to verify tainted resources don't process
 ignore_changes

For #7855
---
 terraform/context_plan_test.go                | 45 +++++++++++++++++++
 terraform/eval_diff.go                        |  3 +-
 terraform/terraform_test.go                   | 15 +++++++
 .../plan-taint-ignore-changes/main.tf         |  7 +++
 4 files changed, 69 insertions(+), 1 deletion(-)
 create mode 100644 terraform/test-fixtures/plan-taint-ignore-changes/main.tf

diff --git a/terraform/context_plan_test.go b/terraform/context_plan_test.go
index c0fc555b9..2cadb5ab8 100644
--- a/terraform/context_plan_test.go
+++ b/terraform/context_plan_test.go
@@ -1937,6 +1937,51 @@ func TestContext2Plan_taint(t *testing.T) {
 	}
 }
 
+func TestContext2Apply_taintIgnoreChanges(t *testing.T) {
+	m := testModule(t, "plan-taint-ignore-changes")
+	p := testProvider("aws")
+	p.ApplyFn = testApplyFn
+	p.DiffFn = testDiffFn
+	s := &State{
+		Modules: []*ModuleState{
+			&ModuleState{
+				Path: rootModulePath,
+				Resources: map[string]*ResourceState{
+					"aws_instance.foo": &ResourceState{
+						Type: "aws_instance",
+						Primary: &InstanceState{
+							ID: "foo",
+							Attributes: map[string]string{
+								"vars": "foo",
+								"type": "aws_instance",
+							},
+							Tainted: true,
+						},
+					},
+				},
+			},
+		},
+	}
+	ctx := testContext2(t, &ContextOpts{
+		Module: m,
+		Providers: map[string]ResourceProviderFactory{
+			"aws": testProviderFuncFixed(p),
+		},
+		State: s,
+	})
+
+	plan, err := ctx.Plan()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	actual := strings.TrimSpace(plan.String())
+	expected := strings.TrimSpace(testTerraformPlanTaintIgnoreChangesStr)
+	if actual != expected {
+		t.Fatalf("bad:\n%s", actual)
+	}
+}
+
 // Fails about 50% of the time before the fix for GH-4982, covers the fix.
 func TestContext2Plan_taintDestroyInterpolatedCountRace(t *testing.T) {
 	m := testModule(t, "plan-taint-interpolated-count")
diff --git a/terraform/eval_diff.go b/terraform/eval_diff.go
index e0c3d6788..7152ea6f3 100644
--- a/terraform/eval_diff.go
+++ b/terraform/eval_diff.go
@@ -185,7 +185,8 @@ func (n *EvalDiff) processIgnoreChanges(diff *InstanceDiff) error {
 		return nil
 	}
 
-	// If the resource has been tainted we shouldn't alter the Diff
+	// If the resource has been tainted then we don't process ignore changes
+	// since we MUST recreate the entire resource.
 	if diff.DestroyTainted {
 		return nil
 	}
diff --git a/terraform/terraform_test.go b/terraform/terraform_test.go
index bc01b68d6..a1265cefa 100644
--- a/terraform/terraform_test.go
+++ b/terraform/terraform_test.go
@@ -1369,6 +1369,21 @@ aws_instance.foo:
   num = 2
 `
 
+const testTerraformPlanTaintIgnoreChangesStr = `
+DIFF:
+
+DESTROY/CREATE: aws_instance.foo
+  type: "" => "aws_instance"
+  vars: "" => "foo"
+
+STATE:
+
+aws_instance.foo: (tainted)
+  ID = foo
+  type = aws_instance
+  vars = foo
+`
+
 const testTerraformPlanMultipleTaintStr = `
 DIFF:
 
diff --git a/terraform/test-fixtures/plan-taint-ignore-changes/main.tf b/terraform/test-fixtures/plan-taint-ignore-changes/main.tf
new file mode 100644
index 000000000..ff95d6596
--- /dev/null
+++ b/terraform/test-fixtures/plan-taint-ignore-changes/main.tf
@@ -0,0 +1,7 @@
+resource "aws_instance" "foo" {
+  vars = "foo"
+
+  lifecycle {
+    ignore_changes = ["vars"]
+  }
+}