Description
When a value is added to disabled_rule_ids, Terraform correctly detects the change and applies it successfully.
However, after removing the value from the Terraform configuration, terraform plan reports no changes, even though the rule is still configured remotely.
As a result, the configuration cannot be reverted using Terraform.
Steps to reproduce
resource "stackit_cdn_distribution" "example" {
project_id = var.project_id
config = {
# ...
waf = {
disabled_rule_ids = [
"@builtin/crs/request/942140"
]
}
}
}
- Run
terraform apply
- Verify that the rule is successfully configured
- Remove or comment out the
disabled_rule_ids attribute.
- Run
terraform plan or terraform apply
Actual behavior
No changes. Your infrastructure matches the configuration.
Although the disabled_rule_ids configuration has been removed from the Terraform configuration, Terraform does not detect any changes and therefore never removes the rule from the remote resource.
Expected behavior
Terraform should detect that disabled_rule_ids has been removed from the configuration and generate an update plan that removes the rule from the remote resource.
- disabled_rule_ids = [
"@builtin/crs/request/942140",
]
before applying the update.
Environment
- OS: Windows
- Terraform version (see
terraform --version): v1.15.8
- Version of the STACKIT Terraform provider:
v0.104.0
Additional information
Adding values to disabled_rule_ids works correctly and the provider successfully updates the resource.
The issue only occurs when removing previously configured values. Since Terraform reports "No changes", users cannot remove disabled WAF rules through Terraform once they have been applied.
This may indicate that the provider does not correctly compare the configured state with the remote state for disabled_rule_ids during the planning phase.
During testing, the same behavior appears to affect other WAF list attributes as well (for example enabled_rule_ids, enabled_rule_group_ids, disabled_rule_group_ids, log_only_rule_ids, and similar attributes), although only disabled_rule_ids has been verified in detail so far.
Additionally, after successfully applying disabled_rule_ids, the STACKIT Portal still displays the corresponding WAF rule as active instead of disabled. It is currently unclear whether this is only a UI issue in the portal or whether the rule is not being persisted correctly by the backend.
Description
When a value is added to disabled_rule_ids, Terraform correctly detects the change and applies it successfully.
However, after removing the value from the Terraform configuration, terraform plan reports no changes, even though the rule is still configured remotely.
As a result, the configuration cannot be reverted using Terraform.
Steps to reproduce
terraform applydisabled_rule_idsattribute.terraform planorterraform applyActual behavior
No changes. Your infrastructure matches the configuration.
Although the disabled_rule_ids configuration has been removed from the Terraform configuration, Terraform does not detect any changes and therefore never removes the rule from the remote resource.
Expected behavior
Terraform should detect that disabled_rule_ids has been removed from the configuration and generate an update plan that removes the rule from the remote resource.
before applying the update.
Environment
terraform --version):v1.15.8v0.104.0Additional information
Adding values to
disabled_rule_idsworks correctly and the provider successfully updates the resource.The issue only occurs when removing previously configured values. Since Terraform reports "No changes", users cannot remove disabled WAF rules through Terraform once they have been applied.
This may indicate that the provider does not correctly compare the configured state with the remote state for
disabled_rule_idsduring the planning phase.During testing, the same behavior appears to affect other WAF list attributes as well (for example
enabled_rule_ids,enabled_rule_group_ids,disabled_rule_group_ids,log_only_rule_ids, and similar attributes), although onlydisabled_rule_idshas been verified in detail so far.Additionally, after successfully applying
disabled_rule_ids, the STACKIT Portal still displays the corresponding WAF rule as active instead of disabled. It is currently unclear whether this is only a UI issue in the portal or whether the rule is not being persisted correctly by the backend.