Reproducing Terraform GH Issue #4488

terraform.log

$ terraform plan
Refreshing Terraform state prior to plan...


The Terraform execution plan has been generated and is shown below.
Resources are shown in alphabetical order for quick scanning. Green resources
will be created (or destroyed and then created if an existing resource
exists), yellow resources are being changed in-place, and red resources
will be destroyed.

Note: You didn't specify an "-out" parameter to save this plan, so when
"apply" is called, Terraform can't guarantee this is what will execute.

+ aws_launch_configuration.ubuntus
    associate_public_ip_address: "" => "0"
    ebs_block_device.#:          "" => "<computed>"
    ebs_optimized:               "" => "<computed>"
    enable_monitoring:           "" => "1"
    image_id:                    "" => "ami-20d3fc4a"
    instance_type:               "" => "t2.micro"
    key_name:                    "" => "<computed>"
    name:                        "" => "<computed>"
    root_block_device.#:         "" => "<computed>"
    security_groups.#:           "" => "<computed>"

+ aws_security_group.blue
    description: "" => "Managed by Terraform"
    egress.#:    "" => "<computed>"
    ingress.#:   "" => "<computed>"
    name:        "" => "<computed>"
    owner_id:    "" => "<computed>"
    vpc_id:      "" => "<computed>"

+ aws_security_group_rule.blue
    from_port:                "" => "0"
    protocol:                 "" => "-1"
    security_group_id:        "" => "${aws_security_group.blue.id}"
    self:                     "" => "0"
    source_security_group_id: "" => "<computed>"
    to_port:                  "" => "0"
    type:                     "" => "egress"


Plan: 3 to add, 0 to change, 0 to destroy.

$ terraform apply
aws_security_group.blue: Creating...
  description: "" => "Managed by Terraform"
  egress.#:    "" => "<computed>"
  ingress.#:   "" => "<computed>"
  name:        "" => "<computed>"
  owner_id:    "" => "<computed>"
  vpc_id:      "" => "<computed>"
aws_security_group.blue: Creation complete
aws_security_group_rule.blue: Creating...
  from_port:                "" => "0"
  protocol:                 "" => "-1"
  security_group_id:        "" => "sg-a379afdb"
  self:                     "" => "0"
  source_security_group_id: "" => "<computed>"
  to_port:                  "" => "0"
  type:                     "" => "egress"
aws_launch_configuration.ubuntus: Creating...
  associate_public_ip_address: "" => "0"
  ebs_block_device.#:          "" => "<computed>"
  ebs_optimized:               "" => "<computed>"
  enable_monitoring:           "" => "1"
  image_id:                    "" => "ami-20d3fc4a"
  instance_type:               "" => "t2.micro"
  key_name:                    "" => "<computed>"
  name:                        "" => "<computed>"
  root_block_device.#:         "" => "<computed>"
  security_groups.#:           "" => "1"
  security_groups.296453320:   "" => "sg-a379afdb"
aws_security_group_rule.blue: Creation complete
aws_launch_configuration.ubuntus: Creation complete

Apply complete! Resources: 3 added, 0 changed, 0 destroyed.

The state of your infrastructure has been saved to the path
below. This state is required to modify and destroy your
infrastructure, so keep it safe. To inspect the complete state
use the `terraform show` command.

State path: terraform.tfstate

$ perl -i -pe 's/blue/red/g' main.tf

$ terraform plan
Refreshing Terraform state prior to plan...

aws_security_group.blue: Refreshing state... (ID: sg-a379afdb)
aws_launch_configuration.ubuntus: Refreshing state... (ID: terraform-eaxfyqtpwvgtpd7o4kbsapxwzm)

The Terraform execution plan has been generated and is shown below.
Resources are shown in alphabetical order for quick scanning. Green resources
will be created (or destroyed and then created if an existing resource
exists), yellow resources are being changed in-place, and red resources
will be destroyed.

Note: You didn't specify an "-out" parameter to save this plan, so when
"apply" is called, Terraform can't guarantee this is what will execute.

~ aws_launch_configuration.ubuntus
    security_groups.#: "" => "<computed>"

- aws_security_group.blue

+ aws_security_group.red
    description: "" => "Managed by Terraform"
    egress.#:    "" => "<computed>"
    ingress.#:   "" => "<computed>"
    name:        "" => "<computed>"
    owner_id:    "" => "<computed>"
    vpc_id:      "" => "<computed>"

+ aws_security_group_rule.red
    from_port:                "" => "0"
    protocol:                 "" => "-1"
    security_group_id:        "" => "${aws_security_group.red.id}"
    self:                     "" => "0"
    source_security_group_id: "" => "<computed>"
    to_port:                  "" => "0"
    type:                     "" => "egress"


Plan: 2 to add, 1 to change, 1 to destroy.

$ terraform apply
aws_security_group.blue: Refreshing state... (ID: sg-a379afdb)
aws_launch_configuration.ubuntus: Refreshing state... (ID: terraform-eaxfyqtpwvgtpd7o4kbsapxwzm)
aws_security_group.blue: Destroying...
aws_security_group.red: Creating...
  description: "" => "Managed by Terraform"
  egress.#:    "" => "<computed>"
  ingress.#:   "" => "<computed>"
  name:        "" => "<computed>"
  owner_id:    "" => "<computed>"
  vpc_id:      "" => "<computed>"
aws_security_group.blue: Destruction complete
aws_security_group.red: Creation complete
aws_security_group_rule.red: Creating...
  from_port:                "" => "0"
  protocol:                 "" => "-1"
  security_group_id:        "" => "sg-6366b01b"
  self:                     "" => "0"
  source_security_group_id: "" => "<computed>"
  to_port:                  "" => "0"
  type:                     "" => "egress"
aws_security_group_rule.red: Creation complete
Error applying plan:

1 error(s) occurred:

* aws_launch_configuration.ubuntus: diffs didn't match during apply. This is a bug with Terraform and should be reported.

Terraform does not automatically rollback in the face of errors.
Instead, your Terraform state file has been partially updated with
any resources that successfully completed. Please address the error
above and apply again to incrementally change your infrastructure.