ResourceIdentity: Validate that identities do not change after Terraform stores it #1478
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
ansgarm
force-pushed
the
add-immutable-validation
branch
2 times, most recently
from
e9587a1 to
e170b2a
Compare
ansgarm
force-pushed
the
add-immutable-validation
branch
from
fce3e26 to
6b8733e
Compare
ansgarm
force-pushed
the
add-immutable-validation
branch
from
6b8733e to
929b999
Compare
austinvalle
previously approved these changes
May 14, 2025
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
PR description shamelessly stolen from hashicorp/terraform-plugin-framework#1137
This PR re-introduces the validation that previously lived in Terraform core (removed in hashicorp/terraform#36989), which ensures that resource identities do not change after Terraform core stores them in state.
The one tricky part of this PR is
ReadResource, which the protocol currently does not have sufficient information for us to determine if the state we are refreshing has already been stored (typical use-case) or if we are importing the resource. Rather than loosening how strict the validation is, I added a temporary key to a framework reservedprivatefield, which Terraform passes betweenImportResourceState -> ReadResource. Once we've read that field, we can skip validation of the identity, clear theprivatefield, then following refreshes will validate as normal.