Infinite diff on google_access_context_manager_service_perimeter when identity IDENTITY_TYPE_UNSPECIFIED is used

[steenblik]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request.
• Please do not leave +1 or me too comments, they generate extra noise for issue followers and do not help prioritize the request.
• If you are interested in working on this issue or have submitted a pull request, please leave a comment.
• If an issue is assigned to the modular-magician user, it is either in the process of being autogenerated, or is planned to be autogenerated soon. If an issue is assigned to a user, that user is claiming responsibility for the issue. If an issue is assigned to hashibot, a community member has claimed the issue already.

Terraform Version

1.5.2

Affected Resource(s)

• google_access_context_manager_service_perimeter

Terraform Configuration Files

A simplified Terraform configuration which suffers from the issue.

resource "google_access_context_manager_access_policy" "this" {
  parent = "organizations/<REDACTED>"
  title  = "policy"
}

resource "google_access_context_manager_service_perimeter" "this" {
  parent         = "accessPolicies/${google_access_context_manager_access_policy.this.name}"
  name           = "accessPolicies/${google_access_context_manager_access_policy.this.name}/servicePerimeters/core"
  title          = "core"
  perimeter_type = "PERIMETER_TYPE_REGULAR"
  use_explicit_dry_run_spec = true
  spec {
    restricted_services = ["storage.googleapis.com"]

    vpc_accessible_services {
      enable_restriction = true
      allowed_services   = ["storage.googleapis.com"]
    }

    ingress_policies {
      ingress_from {
        sources {
        }
        identity_type = "IDENTITY_TYPE_UNSPECIFIED"
        identities    = ["serviceAccount:<REDACTED>@<REDACTED>.iam.gserviceaccount.com"]
      }
    }
    egress_policies {
      egress_from {
        identity_type = "IDENTITY_TYPE_UNSPECIFIED"
        identities    = ["serviceAccount:<REDACTED>@<REDACTED>.iam.gserviceaccount.com"]
      }
    }
  }
}

Debug Output

Terraform will perform the following actions:

  # google_access_context_manager_service_perimeter.this will be updated in-place
  ~ resource "google_access_context_manager_service_perimeter" "this" {
        id                        = "accessPolicies/<REDACTED>/servicePerimeters/core"
        name                      = "accessPolicies/<REDACTED>/servicePerimeters/core"
        # (4 unchanged attributes hidden)

      ~ spec {
            # (3 unchanged attributes hidden)

          ~ egress_policies {
              ~ egress_from {
                  + identity_type = "IDENTITY_TYPE_UNSPECIFIED"
                    # (1 unchanged attribute hidden)
                }
            }

          ~ ingress_policies {
              ~ ingress_from {
                  + identity_type = "IDENTITY_TYPE_UNSPECIFIED"
                    # (1 unchanged attribute hidden)

                  + sources {}
                }
            }

            # (1 unchanged block hidden)
        }
    }

Plan: 0 to add, 1 to change, 0 to destroy.

Expected Behavior

Terraform should recognise that there is no update to perform.

Actual Behavior

Terraform continuously updates the vpc-sc perimeter due to the use of the IDENTITY_TYPE_UNSPECIFIED identity type.

Steps to Reproduce

1. terraform apply

Important Factoids

References

• #0000

b/320968882

[edwardmedia]

I can repro. API does not have identity_type in the response when it is set to IDENTITY_TYPE_UNSPECIFIED. Below is the snippet of a response.

       "egressPolicies": [
         {
           "egressFrom": {
             "identities": [
 "serviceAccount:<REDACTED>@<REDACTED>.iam.gserviceaccount.com"
             ]
           }
         }
       ],

It looks like DiffSuppressFunc is needed to fix this.

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.