Enabling Adaptive Protection on an existing security policy does nothing

[ericnorris]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request.
• Please do not leave +1 or me too comments, they generate extra noise for issue followers and do not help prioritize the request.
• If you are interested in working on this issue or have submitted a pull request, please leave a comment.
• If an issue is assigned to the modular-magician user, it is either in the process of being autogenerated, or is planned to be autogenerated soon. If an issue is assigned to a user, that user is claiming responsibility for the issue. If an issue is assigned to hashibot, a community member has claimed the issue already.

Terraform Version

Terraform v1.1.9
on darwin_arm64
+ provider registry.terraform.io/hashicorp/google v4.19.0
+ provider registry.terraform.io/hashicorp/google-beta v4.19.0

Affected Resource(s)

• google_compute_security_policy

Terraform Configuration Files

resource "google_compute_security_policy" "REDACTED" {
  name    = "REDACTED"
  project = "REDACTED"
  type    = "CLOUD_ARMOR"

  # adaptive_protection_config {
  #   layer_7_ddos_defense_config {
  #     enable = true
  #   }
  # }

  rule {
    action   = "allow"
    priority = "2147483647"
    preview  = false

    description = "Default rule, allows all traffic."

    match {
      versioned_expr = "SRC_IPS_V1"

      config {
        src_ip_ranges = ["*"]
      }
    }
  }

  provider = google-beta
}

Apply, the above, and then uncomment the adaptive_protection_config block.

Debug Output

plan-log.txt
apply-log.txt

Panic Output

N/A

Expected Behavior

Adaptive Protection should have been enabled.

Actual Behavior

Nothing happened, and a subsequent plan indicates that it still needs to enable Adaptive Protection.

Steps to Reproduce

1. terraform apply the config above
2. Uncomment the adaptive_protection_config block
3. terraform apply again

Important Factoids

N/A

References

• Adaptive_Protection to be enabled via TF, says complete but does not enable. #11120 - duplicate issue, but without detailed logs

[ericnorris]

Follow-up note, I believe this is because while resourceComputeSecurityPolicyCreate includes the adaptive_protection_config settings (https://github.com/hashicorp/terraform-provider-google-beta/blob/1a65ad3ce99847b741b8e2309179d9d89f795dc5/google-beta/resource_compute_security_policy.go#L388-L390), resourceComputeSecurityPolicyUpdate does not (https://github.com/hashicorp/terraform-provider-google-beta/blob/1a65ad3ce99847b741b8e2309179d9d89f795dc5/google-beta/resource_compute_security_policy.go#L465-L574).

[Charles546]

If the adaptive protection is enabled through other means, the state will have a permanent drift as if it was not enabled.

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.