Provider produced inconsistent result after apply error

[ChIhuoma]

Confirmation

• My issue isn't already found on the issue tracker.
• I have replicated my issue using the latest version of the provider and it is still present.

Terraform and Cloudflare provider version

Terraform v1.4.0
on windows_amd64
+ provider registry.terraform.io/cloudflare/cloudflare v4.17.0
+ provider registry.terraform.io/hashicorp/vault v3.17.0

Affected resource(s)

cloudflare_ruleset

Terraform configuration files

module "rule_definitions" {
  source  = "custom cloudflare module"
  version = "0.0.1"
  ruleset_level = "account"
  # zone_name = "zone.com"
ruleset_name        = "Managed ruleset deploy"
  ruleset_description = "Managed ruleset deploy"
  waf_rules = {
    dp_rule_1 = {
      waf_type               = "exception"
      managed_ruleset        = "cloudflare"
      waf_exception_type     = "rules_list"
      waf_exception_rule_ids = ["id"]
      expression = "(http.host eq \"zone.com\") and (cf.zone.plan eq \"ENT\")"
    } 
  }
}

Link to debug output

https://gist.github.com/ChIhuoma/0acffda58424a0d44b99275b826592cf

Panic output

No response

Expected output

I expected it to delete an existing exception and create another one in its place.

Plan output:

Terraform will perform the following actions:

  # module.rule_exceptions.cloudflare_ruleset.dp_rule_1 will be updated in-place
  ~ resource "cloudflare_ruleset" "dp_rule_1" {
        id          = "string"
        name        = "Managed ruleset deploy"
        # (4 unchanged attributes hidden)

      ~ rules {
          ~ id           = "string" -> (known after apply)
          ~ last_updated = "2023-11-03 03:43:42.121785 +0000 UTC" -> (known after apply)
          ~ ref          = "string" -> (known after apply)
          ~ version      = "1" -> (known after apply)
            # (4 unchanged attributes hidden)

          ~ action_parameters {
                id      = "string"
              ~ version = "latest" -> (known after apply)

                # (1 unchanged block hidden)
            }
        }
      ~ rules {
          ~ id           = "string" -> (known after apply)
          ~ last_updated = "2023-11-03 03:43:42.121785 +0000 UTC" -> (known after apply)
          ~ ref          = "string" -> (known after apply)
          ~ version      = "1" -> (known after apply)
            # (4 unchanged attributes hidden)

          ~ action_parameters {
                id      = "string"
              ~ version = "latest" -> (known after apply)

                # (1 unchanged block hidden)
            }
        }
      ~ rules {
          ~ id           = "string" -> (known after apply)
          ~ last_updated = "2023-11-03 03:43:42.121785 +0000 UTC" -> (known after apply)
          ~ ref          = "string" -> (known after apply)
          ~ version      = "1" -> (known after apply)
            # (4 unchanged attributes hidden)

          ~ action_parameters {
              + version = (known after apply)
                # (1 unchanged attribute hidden)
            }

          - logging {
              - enabled = true -> null
            }
        }
      ~ rules {
          ~ id           = "string" -> (known after apply)
          ~ last_updated = "2023-11-03 03:43:42.121785 +0000 UTC" -> (known after apply)
          ~ ref          = "string" -> (known after apply)
          ~ version      = "1" -> (known after apply)
            # (4 unchanged attributes hidden)

          ~ action_parameters {
              + version = (known after apply)
                # (1 unchanged attribute hidden)
            }

          - logging {
              - enabled = true -> null
            }
        }
      ~ rules {
          ~ id           = "string" -> (known after apply)
          ~ last_updated = "2023-11-03 03:43:42.121785 +0000 UTC" -> (known after apply)
          ~ ref          = "string" -> (known after apply)
          ~ version      = "1" -> (known after apply)
            # (4 unchanged attributes hidden)

          ~ action_parameters {
                id      = "string"
              ~ version = "latest" -> (known after apply)

                # (1 unchanged block hidden)
            }
        }
    }

Plan: 0 to add, 1 to change, 0 to destroy.

Actual output

Error: Provider produced inconsistent result after apply
│
│ When applying changes to module.rule_exceptions.cloudflare_ruleset.dp_rule_1,
│ provider "provider["registry.terraform.io/cloudflare/cloudflare"]"
│ produced an unexpected new value: .rules[2].logging: block count changed
│ from 0 to 1.
│
│ This is a bug in the provider, which should be reported in the provider's
│ own issue tracker.
╵
╷
│ Error: Provider produced inconsistent result after apply
│
│ When applying changes to module.rule_exceptions.cloudflare_ruleset.dp_rule_1,
│ provider "provider["registry.terraform.io/cloudflare/cloudflare"]"
│ produced an unexpected new value: .rules[3].logging: block count changed
│ from 0 to 1.
│
│ This is a bug in the provider, which should be reported in the provider's
│ own issue tracker.
╵
Operation failed: failed running terraform apply (exit 1)

Steps to reproduce

The plan output and code snippet has the needed information.

Additional factoids

No response

References

No response

[github-actions]

Community Note

Voting for Prioritization

• Please vote on this issue by adding a 👍 reaction to the original post to help the community and maintainers prioritize this request.
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request.

Volunteering to Work on This Issue

• If you are interested in working on this issue, please leave a comment.
• If this would be your first contribution, please review the contribution guide.

[github-actions]

Thank you for opening this issue and sorry to hear you're hitting issues. Unfortunately, the reproduction case provided contains HCL dynamic expressions. Examples of these are:

• Conditionals
• For loops
• Dynamic blocks
• Modules and module references

Maintainers don't accept these as reproduction cases since using these constructs and expressions can hold their own logic bugs which are outside of the provider and not able to be diagnosed.

For maintainers to triage this issue, we recommend providing a minimal reproduction test case that is only contains the impacted resources and can be easily reproduced in an isolated environment. Without providing this, maintainers are limited in what support they can provide.

[github-actions]

Marking this issue as stale due to 30 days of inactivity. This helps our maintainers find and focus on the active issues. If this issue receives no comments in the next 7 days it will automatically be closed. Maintainers can also remove the lifecycle/stale label.
If this issue was automatically closed and you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thank you!

[github-actions]

This issue was closed because it has been stalled for 7 days with no activity.