prismacloud_account_group and prismacloud_account interfere

[davemac30]

Describe the bug

We're using prisma_cloudaccount to add AWS accounts to Prisma in a terraform-managed account group. On a subsequent run of the config with the prismacloud_account_group resource, the accounts are removed from the account group even though we are not specifying account_ids on the prismacloud_account_group.

Expected behavior

If account_ids in the prismacloud_account_group resource is not specified, then the value should be computed.

Current behavior

Not specifying account_ids in the prismacloud_account_group causes all accounts to be removed from the group.

Possible solution

Should be a fairly easy fix - just set Computed: true in the schema for account_ids in resource_account_group.go. I'll test and PR.

[welcome-to-palo-alto-networks]

🎉 Thanks for opening your first issue here! Welcome to the community!

[gilles-o]

Hello there,

We've been hitting the same since quite some time...

Just sharing the below workaround that uses a lifecycle statement:

resource "prismacloud_account_group" "these" {
  lifecycle {
    ignore_changes = [
      account_ids
    ]
  }

  for_each    = { for group in var.my_llist : group.name => group }
  name        = each.value.name
  description = "${each.value.description} - Terraformed"
}

Maybe this can be added to the documentation?
Or best is to implement @davemac30 's solution, since it's mandatory to provide group-ids for a cloud-account resource.