Closed LubosMagda closed 2 months ago
Hi @LubosMagda ! Thanks for raising this issue. This happens because the provider assumes (incorrectly) that it will only be managing non-default resources and will always set the default
property to false
.
I agree it should be smarter in this situation though. I'll look to adjust this in a patch release in a week or so.
Regarding #631 - this is something we're actively looking in to as we understand the extra work needed to remove this demo configuration from environments. Ideally it will be solved in the API, but in the short term we're looking at a CLI tool that should help.
The impacted resources are listed below alphabetically, with an action plan for each:
pingone_mfa_fido_policy
- This is a deprecated resource, will not fix. See Upgrade MFA Policies to use FIDO2 with Passkeyspingone_mfa_fido2_policy
- This will be fixed in the upcoming release v0.26.1
pingone_mfa_policy
- This needs additional work to upgrade the Terraform SDK, which is expected within the next few weekspingone_notification_policy
- This will be fixed in the upcoming release v0.26.1
pingone_password_policy
- This needs additional work to upgrade the Terraform SDK. This needs additional work to upgrade the Terraform SDK, which is expected within the next few weekspingone_risk_policy
- This will be fixed in the upcoming release v0.26.1
pingone_sign_on_policy
- This will be fixed in the upcoming release v0.26.1
pingone_verify_policy
- This will be fixed in the upcoming release v0.26.1
Community Note
PingOne Terraform provider Version
0.26.0
Terraform Version
1.6.3
Affected Resource(s)
pingone_mfa_policy
pingone_mfa_fido2_policy
pingone_notification_policy
default
parameterTerraform Configuration Files
Debug Output
terraform-apply.log
Expected Behavior
Terraform should be able to modify resources after the state sync (terraform refresh) post manual changes in the terraformed resources.
Actual Behavior
Terraform is not able to manage the state of a P1MFA resource that was manually modified and synced using
terraform refresh
.Steps to Reproduce
terraform apply
to create the env with demo resources + My Passkeys FIDO policyterraform state show module.pingone_environment.pingone_mfa_fido2_policy.passkeys_policy
shows thatdefault = false
, this is set correctly as the default FIDO policy is the Passkeys demo policy created with the environment (see this bug)terraform apply -refresh-only
correctly detects a change in the state of the My Passkeys FIDO policy and ignores the demo resources as it is not aware of them:Terraform detected the following changes made outside of Terraform since the last "terraform apply" which may have affected this plan:
module.pingone_environment.pingone_mfa_fido2_policy.passkeys_policy has changed
~ resource "pingone_mfa_fido2_policy" "passkeys_policy" { ~ default = false -> true id = "38bb1ae3-9d7b-49bc-adcb-fe45b7085524" name = "My Passkeys"
(10 unchanged attributes hidden)
module.pingone_environment.pingone_mfa_fido2_policy.passkeys_policy: Modifying... [id=38bb1ae3-9d7b-49bc-adcb-fe45b7085524] ╷ │ Error: Error when calling
UpdateFIDO2Policy
: The request violates a constraint imposed by the service. │ │ with module.pingone_environment.pingone_mfa_fido2_policy.passkeys_policy, │ on .terraform/modules/pingone_environment/modules/administration.tf line 29, in resource "pingone_mfa_fido2_policy" "passkeys_policy": │ 29: resource "pingone_mfa_fido2_policy" "passkeys_policy" { │ │ PingOne Error Details: │ ID: 18d345d8-01dd-431c-aad2-77b2237f61e4 │ Code: REQUEST_FAILED │ Message: The request violates a constraint imposed by the service. │ Details object: [{"code":"CONSTRAINT_VIOLATION","message":"You cannot change the default policy to a non-default policy. Instead, designate a new policy as the default."}] ╵