Ordering for scopes doesn't match input

[jsoref]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment
• If an issue is assigned to the "modular-magician" user, it is either in the process of being autogenerated, or is planned to be autogenerated soon. If an issue is assigned to a user, that user is claiming responsibility for the issue. If an issue is assigned to "hashibot", a community member has claimed the issue already.

Terraform Version

Terraform v0.12.16
+ provider.google v3.3.0

Affected Resource(s)

• google_compute_instance_template
  (It affects other things as well, but I'm going to use it as an example)

Terraform Configuration Files

data "google_compute_image" "debian9" {
  family  = "debian-9"
  project = "debian-cloud"
}

resource "google_compute_instance_template" "my-template" {
  name         = "my-template"
  machine_type = "n1-standard-1"

  disk {
    source_image = data.google_compute_image.debian9.self_link
    auto_delete  = true
    device_name  = "boot"
    disk_size_gb = 10
    disk_type    = "pd-ssd"
    boot         = true
  }

  service_account {
    scopes = [
      "https://www.googleapis.com/auth/devstorage.read_only",
      "https://www.googleapis.com/auth/logging.write",
      "https://www.googleapis.com/auth/monitoring.write",
      "https://www.googleapis.com/auth/service.management.readonly",
      "https://www.googleapis.com/auth/servicecontrol",
      "https://www.googleapis.com/auth/trace.append",
    ]
  }
}

Debug Output

Expected Behavior

We have an existing instance template, when we run:

gcloud compute instance-templates describe original-node-template

The output lists:

    scopes:
    - https://www.googleapis.com/auth/devstorage.read_only
    - https://www.googleapis.com/auth/logging.write
    - https://www.googleapis.com/auth/monitoring.write
    - https://www.googleapis.com/auth/service.management.readonly
    - https://www.googleapis.com/auth/servicecontrol
    - https://www.googleapis.com/auth/trace.append

I expect to be able to reproduce that output using terraform.

---

Right now, the order produced by terraform appears to be fixed (as opposed to random per run, so, that's something, I guess).
There are two possible outcomes that I could imagine:

1. Honor the order of the input
2. Sort the list

The outcome that actually happens, which is neither of these, is unexpected and unhelpful.

Actual Behavior

The plan output shows:

      + service_account {
          + email  = ...
          + scopes = [
              + "https://www.googleapis.com/auth/devstorage.read_only",
              + "https://www.googleapis.com/auth/logging.write",
              + "https://www.googleapis.com/auth/monitoring.write",
              + "https://www.googleapis.com/auth/service.management.readonly",
              + "https://www.googleapis.com/auth/servicecontrol",
              + "https://www.googleapis.com/auth/trace.append",
            ]
        }

But, the new describe output shows:

    scopes:
    - https://www.googleapis.com/auth/devstorage.read_only
    - https://www.googleapis.com/auth/logging.write
    - https://www.googleapis.com/auth/service.management.readonly
    - https://www.googleapis.com/auth/servicecontrol
    - https://www.googleapis.com/auth/trace.append
    - https://www.googleapis.com/auth/monitoring.write

Steps to Reproduce

1. terraform plan
2. terraform apply
3. gcloud compute instance-templates describe my-template

Important Factoids

[edwardmedia]

@jsoref Can you provide use cases why you think this is an issue?

[jsoref]

We're trying to migrate from existing templates. Being able to generate the exact format that our existing templates has would be nice.

Or being able to predict the format (by having it match what we enter) would be nice.

Even having it generate a sorted format would be nice.

The fact that it does none of these things is just mind-boggling.

Or simply put: The plan should match the results.

[edwardmedia]

@jsoref sorry for the behavior that causes your inconvenience. I doubt if these use cases are widely asked for and any related changes will be implemented soon. Before you see any changes in provider side, have you thought of applying ordering code in your side using something like https://www.terraform.io/docs/configuration/functions/sort.html? Based on the reality, I am closing this issue. If you strongly think this a must have behavior, please file another issue and state the reason. Thank you

[jsoref]

@edwardmedia: As you can see, our input to terraform and the terraform plan are both sorted.

What kind of sort function would possibly result in the output yielded by terraform apply?

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. If you feel I made an error 🤖 🙉 , please reach out to my human friends 👉 [email protected]. Thanks!