resource ibm_resource_key is not tainted by change to role

[powellquiring]

resource "ibm_resource_key" "objectstorage" {
  name                 = "${var.environment_name}-cos-hmac-secret"
  role                 = "Manager"
  resource_instance_id = ibm_resource_instance.objectstorage.id

  parameters = {
     HMAC: true
  }
}

Cange the role from Manager to Writer results in not resources delete/created

➜  terraform git:(master) ✗ tfa
ibm_is_vpc.vpc: Refreshing state... [id=r006-9b206835-620a-4a6c-9fab-b71447a6e75b]
ibm_resource_instance.objectstorage: Refreshing state... [id=crn:v1:bluemix:public:cloud-object-storage:global:a/713c783d9a507a53135fe6793c37cc74:fb28c2eb-7194-4c12-9e07-509e14694804::]
ibm_is_subnet.subnet11: Refreshing state... [id=0717-e8dff7d9-97a6-4b1f-a9a4-dec5561818ef]
ibm_resource_key.objectstorage: Refreshing state... [id=crn:v1:bluemix:public:cloud-object-storage:global:a/713c783d9a507a53135fe6793c37cc74:fb28c2eb-7194-4c12-9e07-509e14694804:resource-key:0ffba0d4-98e5-4e0b-ac74-8441a4bc075c]
ibm_container_vpc_cluster.cluster: Refreshing state... [id=bvv4hf6d01poqc2kfn3g]
kubernetes_secret.cos: Refreshing state... [id=default/ikscos001]
kubernetes_service.nginx: Refreshing state... [id=default/ikscos001nginx-service]
kubernetes_deployment.deployment: Refreshing state... [id=default/ikscos001nginx-deployment]
kubernetes_persistent_volume_claim.pvc: Refreshing state... [id=default/ikscos001]
kubernetes_ingress.example_ingress: Refreshing state... [id=default/ikscos001]

Apply complete! Resources: 0 added, 0 changed, 0 destroyed.

version

➜  terraform git:(master) ✗ tf version
Terraform v0.14.4
+ provider registry.terraform.io/hashicorp/kubernetes v1.13.3
+ provider registry.terraform.io/hashicorp/null v3.0.0
+ provider registry.terraform.io/ibm-cloud/ibm v1.13.1

[hkantare]

Fixed in latest release
https://github.com/IBM-Cloud/terraform-provider-ibm/releases/tag/v1.21.1

[kavya498]

Closing this..based on above comments..

[dzmitry-alchanau]

Hello, seems like fix for this issue introduced new one. When I upgraded provider to v1.21.1 and run terraform plan it says that ibm_resource_key resource will be replaced, although no changes were made to this resource.
So the only change has been made
terraform { required_version = ">= 0.13" required_providers { ibm = { source = "IBM-Cloud/ibm" version = "1.21.1" # version chaged from 1.20.0 to 1.21.1 } } }

And after this change I began to receive following out in terraform plan

` # ibm_resource_key.svc-ftp-eu must be replaced
-/+ resource "ibm_resource_key" "svc-ftp-eu" {
~ credentials = (sensitive value)
~ crn = "crn:v1:bluemix:public:cloud-object-storage:global:a/c8d5dfc2b7fcaf83ef524f51dc6740e7:dac561e0-57fa-476d-aafe-ffa917f2d588:resource-key:0f53a481-34a4-4d98-a719-c8d92b4f3f70" -> (known after apply)
~ id = "crn:v1:bluemix:public:cloud-object-storage:global:a/c8d5dfc2b7fcaf83ef524f51dc6740e7:dac561e0-57fa-476d-aafe-ffa917f2d588:resource-key:0f53a481-34a4-4d98-a719-c8d92b4f3f70" -> (known after apply)
name = "svc-test"
~ parameters = { # forces replacement
+ "HMAC" = "true"
}
resource_instance_id = "crn:v1:bluemix:public:cloud-object-storage:global:a/c8d5dfc2b7fcaf83ef524f51dc6740e7:dac561e0-57fa-476d-aafe-ffa917f2d588::"
role = "Writer"
~ status = "active" -> (known after apply)
tags = [
"managed_by_terraform",
]
}

Plan: 1 to add, 0 to change, 1 to destroy.
`

And I assume it started behaving like this because of the change to parameters block https://github.com/kavya498/terraform-provider-ibm/blob/eb6338aecb6860ffcffecb81f8bdbfd90032dbf1/ibm/resource_ibm_resource_key.go#L65, after removing from it DiffSuppressFunc: applyOnce,

[kavya498]

We will fix in upcoming release..
As a workaround please add lifecycle block in your resource..

 lifecycle {
                ignore_changes=["parameters"]
            }