compute_firewall_policy_rule Not Recognizing Existing State from v6.9.0 to 6.11.0

[jornjohnson]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request.
• Please do not leave +1 or me too comments, they generate extra noise for issue followers and do not help prioritize the request.
• If you are interested in working on this issue or have submitted a pull request, please leave a comment.
• If an issue is assigned to a user, that user is claiming responsibility for the issue.
• Customers working with a Google Technical Account Manager or Customer Engineer can ask them to reach out internally to expedite investigation and resolution of this issue.

Terraform Version & Provider Version(s)

Terraform v1.9.8
on x86_64

• provider registry.terraform.io/hashicorp/google v6.9.0 vs v6.11.0
• provider registry.terraform.io/hashicorp/google-beta v6.9.0 to v6.11.0

Affected Resource(s)

google_compute_firewall_policy_rule

Terraform Configuration

resource "google_compute_firewall_policy_rule" "rule" {
  provider = google-beta
  for_each = var.ip_rules

  firewall_policy         = google_compute_firewall_policy.policy.id
  action                  = each.value.action
  direction               = each.value.direction
  priority                = each.value.priority
  target_resources        = each.value.target_resources
  target_service_accounts = each.value.target_service_accounts
  enable_logging          = each.value.logging
  # preview                 = each.value.preview
  match {
    # description = each.value.description
    src_ip_ranges  = each.value.direction == "INGRESS" ? each.value.ranges : null
    dest_ip_ranges = each.value.direction == "EGRESS" ? each.value.ranges : null
    dynamic "layer4_configs" {
      for_each = each.value.ports
      iterator = port
      content {
        ip_protocol = port.key
        ports       = port.value
      }
    }
  }
}

Debug Output

<script src="https://gist.github.com/jornjohnson/81107a0c80b953ba78cfd23615f8576e.js"></script>

Expected Behavior

Our pipeline performs a Terraform Refresh before running a Terraform Plan to reconcile any changes to the environment. The affected Hierarchal Firewall Policy (HFP) Rules should persist in state (as they still exist) and Terraform should not attempt to rewrite them.

Actual Behavior

The Terraform Refresh does not recognize v6.9.0 HFP statefile records when running v6.11.0 or later of the Google provider. This removes those resources from the statefile and attempts to recreate them during the plan stage of our pipelines even though they still exist.

Steps to reproduce

1. terraform plan/apply - Create google_firewall_policy_rule using Google provider v6.9.0.
2. terraform refresh - using Google provider v6.11.0
3. terraform plan - using Google provider v6.11.0

Important Factoids

No response

References

Possibly related to #20160 as that was the only related changelog entry to this observed behavior

[trodge]

Until the fix is released it should be possible to work around this by using the short form name to refer to the firewall policy.

[shuyama1]

Sorry, I hit the wrong button earlier. This should be resolved by the linked PR and the fix will be released in v6.14.1