ibm_database: computed user password validation runs at plan instead of apply

[andrei-pirciu]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform CLI and Terraform IBM Provider Version

Terraform v1.12.2
on darwin_arm64

• provider registry.terraform.io/hashicorp/random v3.7.2
• provider registry.terraform.io/ibm-cloud/ibm v1.81.1

Affected Resource(s)

• ibm_database

Terraform Configuration Files

Please include all Terraform configurations required to reproduce the bug. Bug reports without a functional reproduction may be closed without investigation.

terraform {
  required_providers {
    ibm = {
      source  = "IBM-Cloud/ibm"
      version = "1.81.1"
    }
  }
}

provider "ibm" {
}

resource "random_password" "password" {
  length      = 16
  special     = false
  min_numeric = 2
  min_lower   = 2
  min_upper   = 2
}

resource "ibm_database" "test_db" {
  name              = "terraform-postgresql-db"
  service           = "databases-for-postgresql"
  plan              = "standard"
  location          = "us-south"
  adminpassword     = random_password.password.result
  service_endpoints = "private"
   users {
    name     = "db_user"
    password = random_password.password.result
  }
}

Debug Output

https://gist.github.com/andrei-pirciu/2a191830633de7e7901e5637f0f0b632

Panic Output

Expected Behavior

The provider should validate the computed user password at apply. Instead, it tries to validate it at plan, where it is still unknown, resulting in the error.

Actual Behavior

Error: ---
│ id: terraform-23dab597
│ summary: |-
│ database user (db_user) validation error:
│ password must contain at least one lower case letter
│ severity: error
│ resource: ibm_database
│ operation: CustomizeDiff
│ component:
│ name: github.com/IBM-Cloud/terraform-provider-ibm
│ version: 1.81.1
│ ---
│
│
│ with ibm_database.test_db,
│ on main.tf line 21, in resource "ibm_database" "test_db":
│ 21: resource "ibm_database" "test_db" {

Steps to Reproduce

1. terraform apply

Important Factoids

References

• #0000

[hkantare]

@lornakelly Can you take a look into this

The validation condition should not be triggered at plan stage.

[lornakelly]

@hkantare If you run terraform apply on the random_password resource so that the password is generated and ready and then add the databse config and run terraform apply again you wont have this issue

[hkantare]

@lornakelly I don't think applying Terraform in separate phases is a practical solution, especially in an automated environment.

[lornakelly]

Thank you for reporting the problem. We’ve added it to our prioritised backlog