[Bug]: permadiff in snowflake_network_policy_attachment and snowflake_legacy_service_user causes removal

[RobbertDM]

Terraform CLI Version

1.3.8

Terraform Provider Version

1.0.2

Company Name

No response

Terraform Configuration

resource "snowflake_network_policy_attachment" "network_policy_attachment" {
  for_each = local.purpose_env_combined_network_policies

  network_policy_name = upper(keys(each.value)[0])
  set_for_account     = false
  users               = [snowflake_legacy_service_user.purpose_env[each.key].name]
}


resource "snowflake_legacy_service_user" "purpose_env" {
  for_each                       = local.purpose_env
  name                           = upper("${each.value["purpose_slug"]}_${each.value["environment"]}")
  comment                        = "purpose-based user for ${each.value["purpose"]} in the ${each.value["environment"]} environment"
  password                       = REDACTED
  disabled                       = REDACTED
  display_name                   = REDACTED
  default_warehouse              = upper(each.key)
  default_role                   = snowflake_account_role.purpose_env[each.key].name
  default_namespace              = "${upper(each.value["environment"])}.${snowflake_schema.purpose_env[each.key].name}"
  must_change_password           = REDACTED
  default_secondary_roles_option = REDACTED
}

Category

category:resource

Object type(s)

resource:network_policy_attachment

Expected Behavior

I expect the network policy attachment to provisioned once and then at each subsequent terraform apply not to produce any differences.

Actual Behavior

Each terraform apply causes a diff for the network policy attachment:
First:

  # module.snowflake_purpose[0].snowflake_legacy_service_user.purpose_env["myproject_pro"] will be updated in-place
  ~ resource "snowflake_legacy_service_user" "purpose_env" {
        id                                            = "MYPROJECT_PRO"
        name                                          = "MYPROJECT_PRO"
      ~ network_policy                                = "NEO" -> (known after apply)
        # (66 unchanged attributes hidden)
    }

Then:

  # module.snowflake_purpose[0].snowflake_network_policy_attachment.network_policy_attachment["myproject_pro"] will be updated in-place
  ~ resource "snowflake_network_policy_attachment" "network_policy_attachment" {
        id                  = "NEO_attachment"
      ~ users               = [
          + "MYPROJECT_PRO",
        ]
        # (2 unchanged attributes hidden)
    }

After this, the cycle starts over. When the first one is applied, the network policy gets unattached from the service user!

Steps to Reproduce

• Create a snowflake_legacy_service_user
• Create a snowflake_network_policy
• Create a snowflake_network_policy_attachment and attach it to that user
• terraform apply twice.

How much impact is this issue causing?

Medium

Logs

No response

Additional Information

No response

Would you like to implement a fix?

• Yeah, I'll take it 😎

[sfc-gh-asawicki]

Hey @RobbertDM. Thanks for reaching out to us.

You should not use these two resources together; the network policy is settable on all user resources (including snowflake_legacy_service_user). PLease check this migration guide entry: https://github.com/Snowflake-Labs/terraform-provider-snowflake/blob/main/MIGRATION_GUIDE.md#breaking-change-snowflake_network_policy_attachment-usage-with-snowflake_user.

I will clarify the docs.

[RobbertDM]

Indeed @sfc-gh-asawicki , this works after applying twice: one to remove the snowflake_network_policy_attachment, and then once more so that the snowflake_legacy_service_user sees that it should be updated. Thank you!