MQ Broker should be recreate when id for SG changed

[ByJacob]

Describe the Bug

╷
│ Error: updating MQ Broker (b-f9764a70-79ab-41de-ba60-2f722296ba50) security groups: BadRequestException: Changing security groups is not supported for RabbitMQ brokers.
│ {
│   RespMetadata: {
│     StatusCode: 400,
│     RequestID: "52d88252-71f0-4800-9c41-aa8455b174bf"
│   },
│   ErrorAttribute: "securityGroups",
│   Message_: "Changing security groups is not supported for RabbitMQ brokers."
│ }
│ 
│   with module.rabbitmq.aws_mq_broker.default[0],
│   on ../../modules/mq/main.tf line 89, in resource "aws_mq_broker" "default":
│   89: resource "aws_mq_broker" "default" {
│ 
╵

Expected Behavior

id for security group don't change, or recreate rabbitMQ broker whe security_id was change

Steps to Reproduce

1. Create rabbitmq
2. Create sq
3. add new SQ to rabbitmq by variable allowed_security_group_ids
4. apply changes

Screenshots

No response

Environment

• LINUX
• Terraform v1.3.6
• Module: 3.1.0

Additional Context

No response

[zfalen]

+1 - Still an issue in March 2024

[jbouse]

+1 - Ran into this situation also with changing the allowed_cidr_blocks variable value. It appears Amazon MQ doesn't allow SG ID to be changed once set so almost should have preserve_security_group_id set to true by default so it doesn't attempt to create a new SG. This would not help adding additional existing SGs to a broker after deployment though as the OP is attempting it appears.

[udhayavit]

+1 - still same issue in May 2025

[decoded4620]

+1 Same issue June 2025

[jwtracy]

+1. This absolutely broke the hell out of my infrastucture. it deletes all the rules on the sg, then fails to replace it. all the lifecycle rule null_resource and random ID stuff makes this extremely challenging to do any fixes.

[IUAD1IFS]

You can provide

  preserve_security_group_id : true

for avoid SG recreation