resource group removes implicit included scope on second apply

[lorenyeung]

Hi there,

Thank you for opening an issue. Please note that we try to keep the Terraform issue tracker reserved for bug reports and feature requests. For general usage questions, please see: https://www.terraform.io/community.html.

Affected Resource(s)

harness_platform_resource_group

If this issue appears to affect multiple resources, it may be an issue with Terraform's core, so please mention this.

Terraform Configuration Files

terraform {
    required_providers {
        harness = {
            source = "harness/harness"
            version = "0.31.4"
        }
    }
}

provider "harness" {
    endpoint   = "https://app.harness.io/gateway"
    account_id = var.account_id
    platform_api_key    = var.api_key
}


resource "harness_platform_resource_group" "production_environments" {
  identifier  = join("_", ["production_environments", var.rg_id])
  name        = join("_", ["production_environments", var.rg_id])
  description = "Resource group production environment access"

  account_id           = var.account_id
  org_id               = var.org_id
  project_id           = var.project_id
  allowed_scope_levels = ["project"]
  resource_filter {
    include_all_resources = false
    resources {
      resource_type = "ENVIRONMENT"
      attribute_filter {
        attribute_name   = "type"
        attribute_values = ["Production"]
      }
    }
    resources {
      resource_type = "SERVICE"
    }
    resources {
      resource_type = "PIPELINE"
    }
    resources {
      resource_type = "GITOPS_APP"
    }
  }

  tags = ["managed-by:terraform"]
}

Debug Output

Please provider a link to a GitHub Gist containing the complete debug output: https://www.terraform.io/docs/internals/debugging.html. Please do NOT paste the debug output in the issue; just paste a link to the Gist.

Expected Behavior

when running terraform apply without

  included_scopes {
    filter = "EXCLUDING_CHILD_SCOPES"
    account_id = var.account_id
    org_id = var.org_id
    project_id = var.project_id
  }

the resource group should inject it in implicitly. On first terraform apply, it does. But running terraform apply again (e.g for a change), removes the included scopes, which breaks the RBAC association:

Actual Behavior

What actually happened? It removes it on second apply:

terraform apply
harness_platform_resource_group.production_environments: Refreshing state... [id=production_environments_preprod_rg_admin2]

Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols:
  ~ update in-place

Terraform will perform the following actions:

  # harness_platform_resource_group.production_environments will be updated in-place
  ~ resource "harness_platform_resource_group" "production_environments" {
        id                   = "production_environments_preprod_rg_admin2"
        name                 = "production_environments_preprod_rg_admin2"
        tags                 = [
            "managed-by:terraform",
        ]
        # (7 unchanged attributes hidden)

      - included_scopes {
          - account_id = "<account ID>" -> null
          - filter     = "EXCLUDING_CHILD_SCOPES" -> null
          - org_id     = "default" -> null
          - project_id = "technical_exercise" -> null
        }

        # (1 unchanged block hidden)
    }

Plan: 0 to add, 1 to change, 0 to destroy.

Do you want to perform these actions?
  Terraform will perform the actions described above.
  Only 'yes' will be accepted to approve.

Steps to Reproduce

Please list the steps required to reproduce the issue, for example:

1. terraform apply to create resource
2. terraform apply again with minimal (or no) change
3. observe removal of included scope, and binding is no longer working. Note that it still exists in the UI

Important Factoids

Are there anything atypical about your accounts that we should know? For example: Running in EC2 Classic? Custom version of OpenStack? Tight ACLs?
No. It looks like you can work around this by explicitly providing the include scope value:

  included_scopes {
    filter = "EXCLUDING_CHILD_SCOPES"
    account_id = var.account_id
    org_id = var.org_id
    project_id = var.project_id
  }