Resource ciscoise_network_access_policy_set wrong state handling when using children blocks

[KubaMazurkiewicz]

Prerequisites

• [x] Have you tested the operation in the API directly?
• [x] Do you have the latest Terraform provider version?
• [x] Review the compatibility matrix before opening an issue.

Describe the bug State of id parameter under children block is not properly handled by the provider. Terraform suggests updating resource every time I run terraform plan/apply even though there are no changes in terraform code.

I'm using following terraform code

resource "ciscoise_network_access_policy_set" "policy_sets" {
  provider = ciscoise

  parameters {
    description  = "Test Policy"
    is_proxy     = false
    name         = "New Policy Set 6"
    service_name = "Default Network Access"
    state        = "enabled"
    condition {
      condition_type = "ConditionAndBlock"
      is_negate      = false

      children {
        condition_type = "ConditionReference"
        id             = "eeba3cbc-de57-4171-a0f5-dfbe0d012af4"
      }
      children {
        id             = "49ec9c17-6987-43ef-9478-a42111c59b81"
        condition_type = "ConditionReference"
      }
    }
  }
}

When I run this code for first time im receiving expected output from terraform apply:

terraform apply
ciscoise_network_access_policy_set.policy_sets: Refreshing state... [id=id:=f028687c-c4c8-4969-89cd-edaad750af43\name:=New Policy Set 6]

Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following
symbols:
  + create

Terraform will perform the following actions:

  # ciscoise_network_access_policy_set.policy_sets will be created
  + resource "ciscoise_network_access_policy_set" "policy_sets" {
      + id           = (known after apply)
      + item         = (known after apply)
      + last_updated = (known after apply)

      + parameters {
          + default      = (known after apply)
          + description  = "Test Policy"
          + hit_counts   = (known after apply)
          + id           = (known after apply)
          + is_proxy     = "false"
          + link         = (known after apply)
          + name         = "New Policy Set 6"
          + rank         = (known after apply)
          + service_name = "Default Network Access"
          + state        = "enabled"

          + condition {
              + attribute_name      = (known after apply)
              + attribute_value     = (known after apply)
              + condition_type      = "ConditionAndBlock"
              + description         = (known after apply)
              + dictionary_name     = (known after apply)
              + dictionary_value    = (known after apply)
              + id                  = (known after apply)
              + is_negate           = "false"
              + link                = (known after apply)
              + name                = (known after apply)
              + operator            = (known after apply)
              + week_days           = (known after apply)
              + week_days_exception = (known after apply)

              + children {
                  + attribute_name  = (known after apply)
                  + attribute_value = (known after apply)
                  + condition_type  = "ConditionReference"
                  + dictionary_name = (known after apply)
                  + id              = "eeba3cbc-de57-4171-a0f5-dfbe0d012af4"
                  + is_negate       = (known after apply)
                  + link            = (known after apply)
                  + operator        = (known after apply)
                }
              + children {
                  + attribute_name  = (known after apply)
                  + attribute_value = (known after apply)
                  + condition_type  = "ConditionReference"
                  + dictionary_name = (known after apply)
                  + id              = "49ec9c17-6987-43ef-9478-a42111c59b81"
                  + is_negate       = (known after apply)
                  + link            = (known after apply)
                  + operator        = (known after apply)
                }
            }
        }
    }

Plan: 1 to add, 0 to change, 0 to destroy.

Do you want to perform these actions?
  Terraform will perform the actions described above.
  Only 'yes' will be accepted to approve.

  Enter a value: yes

ciscoise_network_access_policy_set.policy_sets: Creating...
ciscoise_network_access_policy_set.policy_sets: Creation complete after 1s [id=id:=5ea12a8e-7448-47c2-8376-ff6725915d27\name:=New Policy Set 6]

Apply complete! Resources: 1 added, 0 changed, 0 destroyed.

After apply when I run terraform plan again without any modifications to TF code im getting following result:

terraform plan 
ciscoise_network_access_policy_set.policy_sets: Refreshing state... [id=id:=5ea12a8e-7448-47c2-8376-ff6725915d27\name:=New Policy Set 6]

Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following
symbols:
  ~ update in-place

Terraform will perform the following actions:

  # ciscoise_network_access_policy_set.policy_sets will be updated in-place
  ~ resource "ciscoise_network_access_policy_set" "policy_sets" {
        id   = "id:=5ea12a8e-7448-47c2-8376-ff6725915d27\\name:=New Policy Set 6"
        # (1 unchanged attribute hidden)

      ~ parameters {
            id           = "5ea12a8e-7448-47c2-8376-ff6725915d27"
            name         = "New Policy Set 6"
            # (8 unchanged attributes hidden)

          ~ condition {
                # (5 unchanged attributes hidden)

              ~ children {
                  + id             = "eeba3cbc-de57-4171-a0f5-dfbe0d012af4"
                    # (3 unchanged attributes hidden)
                }
              ~ children {
                  + id             = "49ec9c17-6987-43ef-9478-a42111c59b81"
                    # (3 unchanged attributes hidden)
                }
            }
        }
    }

Plan: 0 to add, 1 to change, 0 to destroy.

Expected behavior Resource ciscoise_network_access_policy_set should not suggest adding id parameter under children every time terraform plan/apply runs.

Which means that this should be expected behaviour after terraform plan:

terraform plan 
ciscoise_network_access_policy_set.policy_sets: Refreshing state... [id=id:=f028687c-c4c8-4969-89cd-edaad750af43\name:=New Policy Set 6]

No changes. Your infrastructure matches the configuration.

This works fine for ciscoise_network_access_policy_set for conditition type "ConditionReference" without children block.

Screenshots Not relevant

Environment (please complete the following information):

• ISE version and patch: 3.1.0.518 patch 7
• Terraform version: v1.4.6
• ISE provider version: v0.6.18-beta
• OS version: MACOS 13.4

Additional context None

[fmunozmiranda]

Hey @KubaMazurkiewicz , plese try it again with new provider version and let us know if it works for you now.

[KubaMazurkiewicz]

hey, @fmunozmiranda with v0.6.19-beta its still not working (same as in v0.6.18-beta)

I created new policy set and run terraform apply again and still plan is showing 1 to change:

➜  ~ ise_tf$ terraform apply

Terraform used the selected providers to generate the following execution plan.
Resource actions are indicated with the following symbols:
  + create

Terraform will perform the following actions:

  # ciscoise_network_access_policy_set.policy_sets will be created
  + resource "ciscoise_network_access_policy_set" "policy_sets" {
      + id           = (known after apply)
      + item         = (known after apply)
      + last_updated = (known after apply)

      + parameters {
          + default      = (known after apply)
          + description  = "Test Policy"
          + hit_counts   = (known after apply)
          + id           = (known after apply)
          + is_proxy     = "false"
          + link         = (known after apply)
          + name         = "New Policy Set 97"
          + rank         = (known after apply)
          + service_name = "Default Network Access"
          + state        = "enabled"

          + condition {
              + attribute_name      = (known after apply)
              + attribute_value     = (known after apply)
              + condition_type      = "ConditionAndBlock"
              + description         = (known after apply)
              + dictionary_name     = (known after apply)
              + dictionary_value    = (known after apply)
              + id                  = (known after apply)
              + is_negate           = "false"
              + link                = (known after apply)
              + name                = (known after apply)
              + operator            = (known after apply)
              + week_days           = (known after apply)
              + week_days_exception = (known after apply)

              + children {
                  + attribute_name   = (known after apply)
                  + attribute_value  = (known after apply)
                  + condition_type   = "ConditionReference"
                  + dictionary_name  = (known after apply)
                  + dictionary_value = (known after apply)
                  + id               = "eeba3cbc-de57-4171-a0f5-dfbe0d012af4"
                  + is_negate        = (known after apply)
                  + link             = (known after apply)
                  + operator         = (known after apply)
                }
              + children {
                  + attribute_name   = (known after apply)
                  + attribute_value  = (known after apply)
                  + condition_type   = "ConditionReference"
                  + dictionary_name  = (known after apply)
                  + dictionary_value = (known after apply)
                  + id               = "49ec9c17-6987-43ef-9478-a42111c59b81"
                  + is_negate        = (known after apply)
                  + link             = (known after apply)
                  + operator         = (known after apply)
                }
            }
        }
    }

Plan: 1 to add, 0 to change, 0 to destroy.

Do you want to perform these actions?
  Terraform will perform the actions described above.
  Only 'yes' will be accepted to approve.

  Enter a value: yes

ciscoise_network_access_policy_set.policy_sets: Creating...
ciscoise_network_access_policy_set.policy_sets: Creation complete after 0s [id=id:=00cfa6a0-da0e-4b03-ae74-02acb301d486\name:=New Policy Set 97]

Apply complete! Resources: 1 added, 0 changed, 0 destroyed.

➜  ~ ise_tf$ terraform apply
ciscoise_network_access_policy_set.policy_sets: Refreshing state... [id=id:=00cfa6a0-da0e-4b03-ae74-02acb301d486\name:=New Policy Set 97]

Terraform used the selected providers to generate the following execution plan.
Resource actions are indicated with the following symbols:
  ~ update in-place

Terraform will perform the following actions:

  # ciscoise_network_access_policy_set.policy_sets will be updated in-place
  ~ resource "ciscoise_network_access_policy_set" "policy_sets" {
        id   = "id:=00cfa6a0-da0e-4b03-ae74-02acb301d486\\name:=New Policy Set 97"
        # (1 unchanged attribute hidden)

      ~ parameters {
            id           = "00cfa6a0-da0e-4b03-ae74-02acb301d486"
            name         = "New Policy Set 97"
            # (8 unchanged attributes hidden)

          ~ condition {
                # (5 unchanged attributes hidden)

              ~ children {
                  + id             = "eeba3cbc-de57-4171-a0f5-dfbe0d012af4"
                    # (3 unchanged attributes hidden)
                }
              ~ children {
                  + id             = "49ec9c17-6987-43ef-9478-a42111c59b81"
                    # (3 unchanged attributes hidden)
                }
            }
        }
    }

Plan: 0 to add, 1 to change, 0 to destroy.

Do you want to perform these actions?
  Terraform will perform the actions described above.
  Only 'yes' will be accepted to approve.

  Enter a value: 

[fmunozmiranda]

@KubaMazurkiewicz please try it again with 0.6.20-beta and let us know how does it go.

[KubaMazurkiewicz]

@fmunozmiranda with 0.6.20-beta it works fine. Thanks