resource/pingone_application_flow_policy_assignment: Removal of policy in DV leads to "FlowId/PolicyId not found" error when the policy is invoked by client app

[patrickcping]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Thank you for opening an issue. Please note that we try to keep the Terraform issue tracker reserved for bug reports and feature requests. For general usage questions, please see: https://www.terraform.io/community.html.

PingOne Terraform provider Version

Terraform Version

Affected Resource(s)

• pingone_application_flow_policy_assignment

Terraform Configuration Files

# Copy-paste your PingOne related Terraform configurations here - for large Terraform configs,
# please use a service like Dropbox and share a link to the ZIP file. For
# security, you can also encrypt the files using our GPG public key.

# Remember to replace any account/customer sensitive information in the configuration before submitting the issue

TBC

Debug Output

N/a

Panic Output

N/a

Expected Behavior

Replacement of a davinci_application.xyz.policy set object will generate a new policy ID (davinci_application.xyz.policy.policy_id) that should be updated in the pingone_application_flow_policy_assignment resource. There exists a time when the davinci_application.xyz.policy object is removed from the platform but still assigned on the pingone_application_flow_policy_assignment resource.

When the pingone_application_flow_policy_assignment resource is updated with the new DV policy ID, this should be made successfully and have no negative impact to front end experience.

Actual Behavior

When the davinci_application.xyz.policy object is removed but still assigned to the application with the pingone_application_flow_policy_assignment resource, an inconsistency arises in the application. The pingone_application_flow_policy_assignment resource can be updated successfully, but the inconsistency remains.

Recommended interim workaround is to replace the tainted pingone_application_flow_policy_assignment resource: Terraform doc link and apply the replace_triggered_by lifecycle argument on the pingone_application_flow_policy_assignment, triggered by the policy_id on the davinci_application resource.

Steps to Reproduce

1. TBC

Important Factoids

References

• [BUG] Application Policy identifies change as replace terraform-provider-davinci#214
• https://registry.terraform.io/providers/pingidentity/davinci/latest/docs/resources/application#policy

[patrickcping]

This issue has been resolved within the platform APIs, and does not need a provider code change