Permadiff in google_access_context_manager_service_perimeter

[pfilourenco]

Hi,

I'm using vpc-sc module and I have permanent diff on my terraform state when I have bridge perimeters with only enforce(status) config or with only dry-run(spec) config .

Problem:
TF plan:

 # module.vpc-sc[0].google_access_context_manager_service_perimeter.bridge["landing_to_prod"] will be updated in-place
  ~ resource "google_access_context_manager_service_perimeter" "bridge" {
        id                        = "accessPolicies/XXXXXXXX/servicePerimeters/landing_to_prod"
        name                      = "accessPolicies/XXXXXXXX/servicePerimeters/landing_to_prod"
        # (4 unchanged attributes hidden)

      + spec {
          + resources = []
        }

        # (1 unchanged block hidden)
    }

Code:

cloud-foundation-fabric/modules/vpc-sc/service-perimeters-bridge.tf

Lines 30 to 34 in 72a1189

	spec {
	resources = each.value.spec_resources == null ? [] : each.value.spec_resources
	}
	status {
	resources = each.value.status_resources == null ? [] : each.value.status_resources

Possible code solution using dynamic blocks(like you have for regular perimeters):

  dynamic spec {
    for_each = each.value.spec_resources == null ? [] : each.value.spec_resources
    content {
      resources = each.value.spec_resources
    }
  }
  dynamic status {
    for_each = each.value.status_resources == null ? [] : each.value.status_resources 
    content {
      resources = each.value.status_resources
    }
  }