Unable to update preview status on google_compute_region_security_policy_rule

[jasonloewen]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request.
• Please do not leave +1 or me too comments, they generate extra noise for issue followers and do not help prioritize the request.
• If you are interested in working on this issue or have submitted a pull request, please leave a comment.
• If an issue is assigned to a user, that user is claiming responsibility for the issue.
• Customers working with a Google Technical Account Manager or Customer Engineer can ask them to reach out internally to expedite investigation and resolution of this issue.

Terraform Version & Provider Version(s)

Terraform v1.6.1

• provider registry.terraform.io/hashicorp/google v6.16.0
• provider registry.terraform.io/hashicorp/google-beta v6.16.0

Affected Resource(s)

google_compute_region_security_policy_rule

Terraform Configuration

Code

• Using the cloud-armor regional submodule

module "cloud_armor-regional" {
  source  = "GoogleCloudPlatform/cloud-armor/google//modules/regional-backend-security-policy"
  version = "4.0"

  project_id  = var.project_id
  name        = var.policy_name
  description = var.description
  type        = var.type
  region      = var.region

  # Pre-configured WAF Rules

  pre_configured_rules = {

    "sqli_preconfigured" = {
      description             = "SQLi Sensitivity Level ${var.sqli_rule.sensitivity}"
      action                  = "deny(${var.sqli_rule.deny_http_response_code})"
      priority                = 1000
      preview                 = false
      target_rule_set         = "sqli-v33-stable"
      sensitivity_level       = var.sqli_rule.sensitivity
      exclude_target_rule_ids = var.sqli_rule.exclusions
    }
}

Plan

regional.google_compute_region_security_policy_rule.pre_configured_rules["sqli_preconfigured"] will be updated in-place
  ~ resource "google_compute_region_security_policy_rule" "pre_configured_rules" {
        id              = "projects/sdb-cloudinf-pac12a0/regions/us-central1/securityPolicies/************/priority/1000"
      ~ preview         = true -> false
        # (6 unchanged attributes hidden)

        # (1 unchanged block hidden)
    }

Debug Output

No response

Expected Behavior

The Cloud Armor rule should have it's preview status updated to false

Actual Behavior

• Terraform indicates a successful apply
• The Cloud Armor rule did not change the value appropriately.

Steps to reproduce

1. terraform apply

Important Factoids

No response

References

Basically a mirror of this issue, but for the regional resource.

b/391435972

[ggtisc]

Confirmed issue with details:

Used code:

resource "google_compute_region_security_policy" "policy_20949" {
  provider    = google-beta
  region      = "us-central1"
  name        = "policy-20949"
  description = "something"
  type        = "CLOUD_ARMOR"
}

resource "google_compute_region_security_policy_rule" "policy_rule_20949" {
  provider        = google-beta
  region          = "us-central1"
  security_policy = google_compute_region_security_policy.policy_20949.name
  description     = "something"
  priority        = 100
  action          = "allow"
  preview         = true

  match {
    versioned_expr = "SRC_IPS_V1"
    
    config {
      src_ip_ranges = ["10.10.0.0/16"]
    }
  }
}

Description:

After creating the resources when the value of google_compute_region_security_policy_rule.preview changes from true to false a couple of things happen:

1. The google_compute_region_security_policy was duplicated on the tfstate file leaving 2 google_compute_region_security_policies one with a true value and the other with a false value for the google_compute_region_security_policy.preview argument (this happens just for google_compute_region_security_policy not for google_compute_region_security_policy_rule)
2. On the other hand, the google_compute_region_security_policy_rule resource was not updated and kept the value of true for the preview argument
3. Each time a terraform apply is executed results in a permadiff due to the last action