title: terraform keeps forcing new resource/force replacement for container definition with default parameters
body: <p>I am bringing up <code>aws_ecs_task_defintion</code> with following terraform configuration.</p>
  <p>I pass <code>local.image_tag</code> as variable to control the deployment of our ecr image through terraform.</p>
  <p>I am able to bring up the ecs_cluster on initial terraform plan/apply cycle just fine.</p>
  <p>However, on the subsequent terraform plan/apply cycle, terraform is forcing the new container definition and thats why redeploying the entire task definition even though our ecr image <code>local.image_tag</code> remains just same</p>
  <p>This behaviour, is causing the unintended task definition recycle without any changes to the ecr image and just terraform forcing values with defaults.</p>
  <p><strong>TF Config</strong></p>
  <pre><code>resource &quot;aws_ecs_task_definition&quot; &quot;this_task&quot; {
    family                   = &quot;this-service&quot;
    execution_role_arn       = var.this_role
    task_role_arn            = var.this_role
    network_mode             = &quot;awsvpc&quot;
    requires_compatibilities = [&quot;FARGATE&quot;]
    cpu                      = 256
    memory                   = var.env != &quot;prod&quot; ? 512 : 1024
    tags                     = local.common_tags
    # Log the to datadog if it's running in the prod account.
    container_definitions = (
      &lt;&lt;TASK_DEFINITION
  [
      {
          &quot;essential&quot;: true,
          &quot;image&quot;: &quot;AWS_ACCOUNT_ID.dkr.ecr.us-west-2.amazonaws.com/thisisservice:${local.image_tag}&quot;,
          &quot;environment&quot; :[
              {&quot;name&quot;:&quot;ID&quot;, &quot;value&quot;:&quot;${jsondecode(data.aws_secretsmanager_secret_version.this_decrypt.secret_string)[&quot;id&quot;]}&quot;},
              {&quot;name&quot;:&quot;SECRET&quot;,&quot;value&quot;:&quot;${jsondecode(data.aws_secretsmanager_secret_version.this_decrypt.secret_string)[&quot;secret&quot;]}&quot;},
              {&quot;name&quot;:&quot;THIS_SOCKET_URL&quot;,&quot;value&quot;:&quot;${local.websocket_url}&quot;},
              {&quot;name&quot;:&quot;THIS_PLATFORM_API&quot;,&quot;value&quot;:&quot;${local.platform_api}&quot;},
              {&quot;name&quot;:&quot;REDISURL&quot;,&quot;value&quot;:&quot;${var.redis_url}&quot;},
              {&quot;name&quot;:&quot;BASE_S3&quot;,&quot;value&quot;:&quot;${aws_s3_bucket.ec2_vp.id}&quot;}
          ],
          &quot;name&quot;: &quot;ec2-vp&quot;,
          &quot;logConfiguration&quot;: {
              &quot;logDriver&quot;: &quot;awsfirelens&quot;,
              &quot;options&quot;: {
                  &quot;Name&quot;: &quot;datadog&quot;,
                  &quot;apikey&quot;: &quot;${jsondecode(data.aws_secretsmanager_secret_version.datadog_api_key[0].secret_string)[&quot;api_key&quot;]}&quot;,
                  &quot;Host&quot;: &quot;http-intake.logs.datadoghq.com&quot;,
                  &quot;dd_service&quot;: &quot;this&quot;,
                  &quot;dd_source&quot;: &quot;this&quot;,
                  &quot;dd_message_key&quot;: &quot;log&quot;,
                  &quot;dd_tags&quot;: &quot;cluster:${var.cluster_id},Env:${var.env}&quot;,
                  &quot;TLS&quot;: &quot;on&quot;,
                  &quot;provider&quot;: &quot;ecs&quot;
              }
          },
          &quot;portMappings&quot;: [
              {
                  &quot;containerPort&quot;: 443,
                  &quot;hostPort&quot;: 443
              }
          ]
      },
      {
          &quot;essential&quot;: true,
          &quot;image&quot;: &quot;amazon/aws-for-fluent-bit:latest&quot;,
          &quot;name&quot;: &quot;log_router&quot;,
          &quot;firelensConfiguration&quot;: {
              &quot;type&quot;: &quot;fluentbit&quot;,
              &quot;options&quot;: { &quot;enable-ecs-log-metadata&quot;: &quot;true&quot; }
          }
      
      }
  ]
  TASK_DEFINITION
  )
  }
  </code></pre>
  <pre><code>
  
  
  -/+ resource &quot;aws_ecs_task_definition&quot; &quot;this_task&quot; {
                ~ arn                      = &quot;arn:aws:ecs:ca-central-1:AWS_ACCOUNT_ID:task-definition/this:4&quot; -&gt; (known after apply)
                ~ container_definitions    = jsonencode(
                    ~ [ # forces replacement
                        ~ {
                            - cpu              = 0 -&gt; null
                              environment      = [
                                  {
                                      name  = &quot;BASE_S3&quot;
                                      value = &quot;thisisthevalue&quot;
                                  },
                                  {
                                      name  = &quot;THIS_PLATFORM_API&quot;
                                      value = &quot;thisisthevlaue&quot;
                                  },
                                  {
                                      name  = &quot;SECRET&quot;
                                      value = &quot;thisisthesecret&quot;
                                  },
                                  {
                                      name  = &quot;ID&quot;
                                      value = &quot;thisistheid&quot;
                                  },
                                  {
                                      name  = &quot;THIS_SOCKET_URL&quot;
                                      value = &quot;thisisthevalue&quot;
                                  },
                                  {
                                      name  = &quot;REDISURL&quot;
                                      value = &quot;thisisthevalue&quot;
                                  },
                              ]
                              essential        = true
                              image            = &quot;AWS_ACCOUNT_ID.dkr.ecr.us-west-2.amazonaws.com/this:v1.0.0-develop.6&quot;
                              logConfiguration = {
                                  logDriver = &quot;awsfirelens&quot;
                                  options   = {
                                      Host           = &quot;http-intake.logs.datadoghq.com&quot;
                                      Name           = &quot;datadog&quot;
                                      TLS            = &quot;on&quot;
                                      apikey         = &quot;thisisthekey&quot;
                                      dd_message_key = &quot;log&quot;
                                      dd_service     = &quot;this&quot;
                                      dd_source      = &quot;this&quot;
                                      dd_tags        = &quot;thisisthetags&quot;
                                      provider       = &quot;ecs&quot;
                                  }
                              }
                            - mountPoints      = [] -&gt; null
                              name             = &quot;ec2-vp&quot;
                            ~ portMappings     = [
                                ~ {
                                      containerPort = 443
                                      hostPort      = 443
                                    - protocol      = &quot;tcp&quot; -&gt; null
                                  },
                              ]
                            - volumesFrom      = [] -&gt; null
                          } # forces replacement,
                        ~ {
                            - cpu                   = 0 -&gt; null
                            - environment           = [] -&gt; null
                              essential             = true
                              firelensConfiguration = {
                                  options = {
                                      enable-ecs-log-metadata = &quot;true&quot;
                                  }
                                  type    = &quot;fluentbit&quot;
                              }
                              image                 = &quot;amazon/aws-for-fluent-bit:latest&quot;
                            - mountPoints           = [] -&gt; null
                              name                  = &quot;log_router&quot;
                            - portMappings          = [] -&gt; null
                            - user                  = &quot;0&quot; -&gt; null
                            - volumesFrom           = [] -&gt; null
                          } # forces replacement,
                      ]
                  )
                  cpu                      = &quot;256&quot;
                  execution_role_arn       = &quot;arn:aws:iam::AWS_ACCOUNTID:role/thisistherole&quot;
                  family                   = &quot;this&quot;
                ~ id                       = &quot;this-service&quot; -&gt; (known after apply)
                  memory                   = &quot;512&quot;
                  network_mode             = &quot;awsvpc&quot;
                  requires_compatibilities = [
                      &quot;FARGATE&quot;,
                  ]
                ~ revision                 = 4 -&gt; (known after apply)
                  tags                     = {
                      &quot;Cluster&quot;      = &quot;this&quot;
                      &quot;Env&quot;          = &quot;this&quot;
                      &quot;Name&quot;         = &quot;this&quot;
                      &quot;Owner&quot;        = &quot;this&quot;
                      &quot;Proj&quot;         = &quot;this&quot;
                      &quot;SuperCluster&quot; = &quot;this&quot;
                      &quot;Terraform&quot;    = &quot;true&quot;
                  }
                  task_role_arn            = &quot;arn:aws:iam::AWS_ACCOUNT+ID:role/thisistherole&quot;
              }
  </code></pre>
  <p>Above is the terraform plan that is forcing new task definition/container definition.</p>
  <p>As you can see , terraform is replacing all default values with null or empty. I have double check the terraform.tfstate file it already generated from the previous run and those values are exactly the same as its showing on the above plan.</p>
  <p>I am not sure why this unintended behaviour is happening and want to have some clues on how to fix this.</p>
  <p>I am using terraform 0.12.25 and latest terraform aws provider.</p>