OCI provider claims deletion of NSG related resources is successful even though it failed due to a lack of permissions.

smckend-bunnings commented 2 months ago

Community Note

Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
If you are interested in working on this issue or have submitted a pull request, please leave a comment

Issue Summary

We were wondering why a bunch of duplicate NSG resources were showing up in our OCI environment and recently realised that Terraform didn't actually have the required permissions to delete network related resources. Instead of failing whenever we tried to delete/replace network related issues, the Terraform OCI provider claims to have successfully deleted the resource(s) rather than failing due to a lack of permissions.

Terraform Version and Provider Version

terraform 1.1.9 oci 5.35.0

Affected Resource(s)

oci_core_network_security_group, oci_core_network_security_group_security_rule

affected_resources = oci_core_network_security_group, oci_core_network_security_group_security_rule

Expected Behavior

Terraform should fail to delete resources that it doesn't have permission to delete.

Actual Behavior

Terraform "says" it deletes the resource and removes it from state but the resource still exists in OCI.

Steps to Reproduce

Set up a policy that allows you to create network resources but not delete
Create a NSG with a rule via Terraform
Run a terraform destroy

tf-oci-pub commented 2 months ago

Thank you for reporting the issue. We observed the affected resources are not provided in the description or it's incorrect. We request you to add it in issue description as mentioned in below format. Example: affected_resources = oci_core_instance , oci_core_instances

If it's not related to any particular resource then mention affected resource as terraform. Example: affected_resources = terraform

As this works through automation, request you to follow exact syntax.

smckend-bunnings commented 2 months ago

Updated with affected resources syntax

sanne-bunnings commented 2 months ago

Any update on this @tf-oci-pub ?

smckend-bunnings commented 2 months ago

sanne-bunnings commented 2 months ago

Any update on this @tf-oci-pub ?

sanne-bunnings commented 2 months ago

@tf-oci-pub , Any update on this?

oracle / terraform-provider-oci