Whitespace changed causes recreation of the ruleset rules

[Dragotic]

Confirmation

• This is a bug with an existing resource and is not a feature request or enhancement. Feature requests should be submitted with Cloudflare Support or your account team.
• I have searched the issue tracker and my issue isn't already found.
• I have replicated my issue using the latest version of the provider and it is still present.

Terraform and Cloudflare provider version

Terraform v1.6.6
on darwin_arm64
+ provider registry.terraform.io/cloudflare/cloudflare v4.48.0

Affected resource(s)

• cloudflare_ruleset

Terraform configuration files

# From cf-terraforming generate --resource-type cloudflare_ruleset
resource "cloudflare_ruleset" "ratelimit_ruleset" {
  kind    = "zone"
  name    = "default"
  phase   = "http_ratelimit"
  zone_id = local.zone_id
  rules {
    action = "block"
    action_parameters {
      response {
        content      = "{\"errors\":[{\"code\":\"too_many_requests\",\"message\":\"Too many requests. Please try again in a bit.\"}]}\"
        content_type = "application/json"
        status_code  = 429
      }
    }
    description = "Containing /prepare_verification (3req/10s)"
    enabled     = true
    expression  = "(http.request.uri.path contains \"/something\" and http.request.method in {\"POST\" \"PUT\" \"PATCH\"})"
    ratelimit {
      characteristics     = ["ip.src", "cf.colo.id"]
      mitigation_timeout  = 600
      period              = 10
      requests_per_period = 3
    }
  }
}

# After importing the resource and making the config more readable
locals {
  error_message = jsonencode({
    errors = [{ 
      message = "Too many requests. Please try again in a bit.",
      code    = "too_many_requests" 
    }]
  })
}

resource "cloudflare_ruleset" "ratelimit_ruleset" {
  kind    = "zone"
  name    = "default"
  phase   = "http_ratelimit"
  zone_id = local.zone_id
  rules {
    action = "block"
    action_parameters {
      response {
        content      = local.error_message
        content_type = "application/json"
        status_code  = 429
      }
    }
    description = "Containing /prepare_verification (3req/10s)"
    enabled     = true
    expression  = "(http.request.uri.path contains \"/something\" and http.request.method in {\"POST\" \"PUT\" \"PATCH\"})"
    ratelimit {
      characteristics     = ["ip.src", "cf.colo.id"]
      mitigation_timeout  = 600
      period              = 10
      requests_per_period = 3
    }
  }
}

Link to debug output

https://gist.github.com/Dragotic/90193d616755c15356f079fbe3431fcf

Panic output

No response

Expected output

No changes. Your infrastructure matches the configuration.

Actual output

Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols:
  ~ update in-place

Terraform will perform the following actions:

  # cloudflare_ruleset.ratelimit_ruleset will be updated in-place
  ~ resource "cloudflare_ruleset" "ratelimit_ruleset" {
        id      = "................00e"
        name    = "default"
        # (3 unchanged attributes hidden)

      ~ rules {
          ~ id          = "........4fb" -> (known after apply)
          ~ ref         = ".......4fb" -> (known after apply)
            # (4 unchanged attributes hidden)

          ~ action_parameters {
              ~ response {
                  ~ content      = jsonencode( # whitespace changes
                        {
                            errors = [
                                {
                                    code    = "too_many_requests"
                                    message = "Too many requests. Please try again in a bit."
                                },
                            ]
                        }
                    )
                    # (2 unchanged attributes hidden)
                }
            }

            # (1 unchanged block hidden)
        }
}
Plan: 0 to add, 1 to change, 0 to destroy.

After typing yes on the terraform apply the rules are recreated with new IDs

Steps to reproduce

1. import cloudflare_ruleset by using `cf-terraforming generate --email $CLOUDFLARE_EMAIL --token $CLOUDFLARE_API_TOKEN --resource-type cloudflare_ruleset --zone $CLOUDFLARE_ZONE_ID
2. Change the response message to a terraform map with jsonencode() function before passing it to the response of the cloudflare_ruleset resource
3. terraform apply
4. Changes are shown
5. apply the changes
6. rules are recreated

Additional factoids

It's not only that whitespace is recognised as change by the cloudflare API, but it also recreates the rules when applied. Effectively losing activity for last 24 hours

References

No response

[github-actions]

Terraform debug log detected ✅

[github-actions]

Community Note

Voting for Prioritization

• Please vote on this issue by adding a 👍 reaction to the original post to help the community and maintainers prioritize this request.
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request.

Volunteering to Work on This Issue

• If you are interested in working on this issue, please leave a comment.
• If this would be your first contribution, please review the contribution guide.

[jacobbednarz]

jsonencode and the string there are not equivalent so the diff here makes sense. you can confirm the difference by expecting the state or running it through terraform console. if you don't want the diff, you should adjust the value or formatting accordingly.

if you define the ref field, the analytics UI keeps track of the changes. see the release notes for the latest updates and guidance on that.

[Dragotic]

@jacobbednarz Thanks for the quick reply. I didn't catch the ref fix on the v4.48 version, thanks for pointing it out.

Do the whitespace changes cause any other side-effect on Cloudflare API apart from the look?