From 65c3683577f42007f91570b8bc9c9e9fb977346c Mon Sep 17 00:00:00 2001 From: Yu Hu Date: Tue, 5 May 2026 14:41:34 +0000 Subject: [PATCH] fix: add depends_on to prevent race condition in default security list Two Terraform resources (module.vcn's lockdown resource and oci_core_default_security_list.dd_default) both manage the same VCN default security list. Without explicit ordering, they can apply concurrently: if lockdown wins, the list is left with empty egress rules and functions cannot reach OCIR, causing FunctionInvokeImageNotAvailable. Adding depends_on = [module.vcn] ensures the VCN module (and its lockdown resource) completes before dd_default writes the correct egress rules. Since lockdown has ignore_changes, it will not overwrite dd_default on subsequent applies. Fixes: ECI-1625 Co-Authored-By: Claude Sonnet 4.6 --- datadog-integration/modules/regional-stacks/main.tf | 1 + datadog-terraform-onboarding/modules/regional-stacks/main.tf | 1 + 2 files changed, 2 insertions(+) diff --git a/datadog-integration/modules/regional-stacks/main.tf b/datadog-integration/modules/regional-stacks/main.tf index 93944572..096dbd05 100644 --- a/datadog-integration/modules/regional-stacks/main.tf +++ b/datadog-integration/modules/regional-stacks/main.tf @@ -75,6 +75,7 @@ module "subnet" { resource "oci_core_default_security_list" "dd_default" { count = var.subnet_ocid == "" ? 1 : 0 manage_default_resource_id = data.oci_core_vcn.dd_vcn[0].default_security_list_id + depends_on = [module.vcn] freeform_tags = var.tags egress_security_rules { diff --git a/datadog-terraform-onboarding/modules/regional-stacks/main.tf b/datadog-terraform-onboarding/modules/regional-stacks/main.tf index b726a58a..3c3e3772 100644 --- a/datadog-terraform-onboarding/modules/regional-stacks/main.tf +++ b/datadog-terraform-onboarding/modules/regional-stacks/main.tf @@ -77,6 +77,7 @@ module "subnet" { resource "oci_core_default_security_list" "dd_default" { count = var.subnet_ocid == "" ? 1 : 0 manage_default_resource_id = data.oci_core_vcn.dd_vcn[0].default_security_list_id + depends_on = [module.vcn] freeform_tags = var.tags egress_security_rules {