Chhanging type in google_compute_security_policy does not cause the resource to be recreated

[xremming]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request.
• Please do not leave +1 or me too comments, they generate extra noise for issue followers and do not help prioritize the request.
• If you are interested in working on this issue or have submitted a pull request, please leave a comment.
• If an issue is assigned to a user, that user is claiming responsibility for the issue.
• Customers working with a Google Technical Account Manager or Customer Engineer can ask them to reach out internally to expedite investigation and resolution of this issue.

Terraform Version & Provider Version(s)

Terraform v1.9.7
on darwin_arm64

• provider registry.terraform.io/hashicorp/google v6.4.0
• provider registry.terraform.io/hashicorp/google-beta v6.4.0

Affected Resource(s)

google_compute_security_policy

Terraform Configuration

resource "google_compute_security_policy" "block" {
  name        = "block-public-requests"
  description = "Block all requests which are not from our offices."

  type = "CLOUD_ARMOR"

  rule {
    action      = "deny(403)"
    description = "Block all other requests."
    priority    = 2147483647

    match {
      versioned_expr = "SRC_IPS_V1"
      config {
        src_ip_ranges = ["*"]
      }
    }
  }
}

resource "google_compute_security_policy" "block" {
  name        = "block-public-requests"
  description = "Block all requests which are not from our offices."

  type = "CLOUD_ARMOR_EDGE"

  rule {
    action      = "deny(403)"
    description = "Block all other requests."
    priority    = 2147483647

    match {
      versioned_expr = "SRC_IPS_V1"
      config {
        src_ip_ranges = ["*"]
      }
    }
  }
}

Debug Output

No response

Expected Behavior

Changing the type e.g. from CLOUD_ARMOR to CLOUD_ARMOR_EDGE should recreate the resource.

Actual Behavior

Changing the type e.g. from CLOUD_ARMOR to CLOUD_ARMOR_EDGE causes it to update the resource without doing any real changes (plan will show the value to always be different).

Steps to reproduce

1. terraform apply

Important Factoids

No response

References

No response

[ggtisc]

Hi @xremming could you be more specific in what you are looking for with this change and how this change makes an improvement?

[xremming]

Most google provider resources will have fields such as this marked that changing them will recreate the resource. Since the type cannot be changed after creation, changing it should recreate the resource.

It seems that there is a PR to fix this: GoogleCloudPlatform/magic-modules#12233

[ggtisc]

Yes for now we just need to wait for the review and approval, but I'm trying to understand if this is enough or if you are looking for different purposes.

[xremming]

✅ Yes, that should be enough to handle this case.

[ggtisc]

Awesome! thanks for letting us know! Hope you a happy coding!

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.