Removing the last entitlement id or entitlement tag from a policy does not work

[jered-miller]

Terraform CLI, Terraform appgatesdp Provider Version, and Appgate Appliance version(s)

Terraform v1.4.6
on darwin_arm64

• provider registry.terraform.io/appgate/appgatesdp v1.3.0
• provider registry.terraform.io/hashicorp/aws v4.65.0
• provider registry.terraform.io/hashicorp/null v3.2.1
• provider registry.terraform.io/hashicorp/tls v4.0.4

Affected Resource(s)

• appgatesdp_policy

Terraform Configuration Files

Please include all Terraform configurations required to reproduce the bug. Bug reports without a functional reproduction may be closed without investigation.

resource "appgatesdp_policy" "this" {
  for_each = { for ap in var.access_policies : ap.name => ap }

  name              = each.value.name
  notes             = each.value.notes
  disabled          = !each.value.enabled

  type              = each.value.type

  entitlements      = [ for e in each.value.entitlements : appgatesdp_entitlement.this[e].id ]
  entitlement_links = each.value.entitlement_tags


  expression        = file("./policy_conditions/${each.value.condition_file}")

  tags      = each.value.tags
}

Debug Output

Panic Output

Expected Behavior

Removing the last entitlement by feeding it an empty set should remove it from the UI.

Actual Behavior

Running a terraform plan/apply in this context correctly shows that the entitlement will be removed, and apply reports that the action was successful. However, if this is the last entitlement id or entitlement tag, it does not actually remove it. If there is more than one of these items in the list of entitlements, it operates as expected.

Steps to Reproduce

1. terraform apply

Important Factoids

References

• #0000