Save dashboard sha256sum instead of full config json in tfstate

docs/index.md

@@ -33,6 +33,7 @@ provider "grafana" {
 - **retries** (Number) The amount of retries to use for Grafana API calls. May alternatively be set via the `GRAFANA_RETRIES` environment variable.
 - **sm_access_token** (String, Sensitive) A Synthetic Monitoring access token. May alternatively be set via the `GRAFANA_SM_ACCESS_TOKEN` environment variable.
 - **sm_url** (String) Synthetic monitoring backend address. May alternatively be set via the `GRAFANA_SM_URL` environment variable.
+- **store_dashboard_sha256** (Boolean) Set to true if you want to save only the sha256sum instead of complete dashboard model JSON in the tfstate.
 - **tls_cert** (String) Client TLS certificate file to use to authenticate to the Grafana server. May alternatively be set via the `GRAFANA_TLS_CERT` environment variable.
 - **tls_key** (String) Client TLS key file to use to authenticate to the Grafana server. May alternatively be set via the `GRAFANA_TLS_KEY` environment variable.
 - **url** (String) The root URL of a Grafana server. May alternatively be set via the `GRAFANA_URL` environment variable.

grafana/provider.go

@@ -22,9 +22,11 @@ import (
 )
 
 var (
-	idRegexp    = regexp.MustCompile(`^\d+$`)
-	uidRegexp   = regexp.MustCompile(`^[a-zA-Z0-9-_]+$`)
-	emailRegexp = regexp.MustCompile(`.+\@.+\..+`)
+	idRegexp             = regexp.MustCompile(`^\d+$`)
+	uidRegexp            = regexp.MustCompile(`^[a-zA-Z0-9-_]+$`)
+	emailRegexp          = regexp.MustCompile(`.+\@.+\..+`)
+	sha256Regexp         = regexp.MustCompile(`^[A-Fa-f0-9]{64}$`)
+	storeDashboardSHA256 bool
 )
 
 func init() {
@@ -124,6 +126,12 @@ func Provider(version string) func() *schema.Provider {
 					Description:  "Synthetic monitoring backend address. May alternatively be set via the `GRAFANA_SM_URL` environment variable.",
 					ValidateFunc: validation.IsURLWithHTTPorHTTPS,
 				},
+				"store_dashboard_sha256": {
+					Type:        schema.TypeBool,
+					Optional:    true,
+					DefaultFunc: schema.EnvDefaultFunc("GRAFANA_STORE_DASHBOARD_SHA256", false),
+					Description: "Set to true if you want to save only the sha256sum instead of complete dashboard model JSON in the tfstate.",
+				},
 			},
 
 			ResourcesMap: map[string]*schema.Resource{
@@ -210,6 +218,8 @@ func configure(version string, p *schema.Provider) func(context.Context, *schema
 		}
 		c.smapi = createSMClient(d)
 
+		storeDashboardSHA256 = d.Get("store_dashboard_sha256").(bool)
+
 		return c, diags
 	}
 }

grafana/resource_dashboard.go

@@ -2,6 +2,7 @@ package grafana
 
 import (
 	"context"
+	"crypto/sha256"
 	"encoding/json"
 	"fmt"
 	"net/url"
@@ -211,12 +212,15 @@ func ReadDashboard(ctx context.Context, d *schema.ResourceData, meta interface{}
 		return diag.FromErr(err)
 	}
 
+	configJSON := d.Get("config_json").(string)
+
+	// Skip if configJSON string is a sha256 hash
 	// If `uid` is not set in configuration, we need to delete it from the
 	// dashboard JSON we just read from the Grafana API. This is so it does not
 	// create a diff. We can assume the uid was randomly generated by Grafana or
 	// it was removed after dashboard creation. In any case, the user doesn't
 	// care to manage it.
-	if configJSON := d.Get("config_json").(string); configJSON != "" {
+	if configJSON != "" && !sha256Regexp.MatchString(configJSON) {
 		configuredDashJSON, err := unmarshalDashboardConfigJSON(configJSON)
 		if err != nil {
 			return diag.FromErr(err)
@@ -225,8 +229,7 @@ func ReadDashboard(ctx context.Context, d *schema.ResourceData, meta interface{}
 			delete(remoteDashJSON, "uid")
 		}
 	}
-
-	configJSON := normalizeDashboardConfigJSON(remoteDashJSON)
+	configJSON = normalizeDashboardConfigJSON(remoteDashJSON)
 	d.Set("config_json", configJSON)
 
 	return diags
@@ -340,5 +343,11 @@ func normalizeDashboardConfigJSON(config interface{}) string {
 	}
 
 	j, _ := json.Marshal(dashboardJSON)
-	return string(j)
+
+	if storeDashboardSHA256 {
+		configHash := sha256.Sum256(j)
+		return fmt.Sprintf("%x", configHash[:])
+	} else {
+		return string(j)
+	}
 }

grafana/resource_dashboard_test.go

@@ -2,6 +2,7 @@ package grafana
 
 import (
 	"fmt"
+	"os"
 	"testing"
 
 	gapi "github.com/grafana/grafana-api-golang-client"
@@ -15,58 +16,74 @@ func TestAccDashboard_basic(t *testing.T) {
 
 	var dashboard gapi.Dashboard
 
-	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testAccPreCheck(t) },
-		ProviderFactories: testAccProviderFactories,
-		CheckDestroy:      testAccDashboardCheckDestroy(&dashboard),
-		Steps: []resource.TestStep{
-			{
-				// Test resource creation.
-				Config: testAccExample(t, "resources/grafana_dashboard/_acc_basic.tf"),
-				Check: resource.ComposeTestCheckFunc(
-					testAccDashboardCheckExists("grafana_dashboard.test", &dashboard),
-					resource.TestCheckResourceAttr("grafana_dashboard.test", "id", "basic"),
-					resource.TestCheckResourceAttr("grafana_dashboard.test", "uid", "basic"),
-					resource.TestCheckResourceAttr(
-						"grafana_dashboard.test", "config_json", `{"title":"Terraform Acceptance Test","uid":"basic"}`,
-					),
-				),
-			},
-			{
-				// Updates title.
-				Config: testAccExample(t, "resources/grafana_dashboard/_acc_basic_update.tf"),
-				Check: resource.ComposeTestCheckFunc(
-					testAccDashboardCheckExists("grafana_dashboard.test", &dashboard),
-					resource.TestCheckResourceAttr("grafana_dashboard.test", "id", "basic"),
-					resource.TestCheckResourceAttr("grafana_dashboard.test", "uid", "basic"),
-					resource.TestCheckResourceAttr(
-						"grafana_dashboard.test", "config_json", `{"title":"Updated Title","uid":"basic"}`,
-					),
-				),
-			},
-			{
-				// Updates uid.
-				// uid is removed from `config_json` before writing it to state so it's
-				// important to ensure changing it triggers an update of `config_json`.
-				Config: testAccExample(t, "resources/grafana_dashboard/_acc_basic_update_uid.tf"),
-				Check: resource.ComposeTestCheckFunc(
-					testAccDashboardCheckExists("grafana_dashboard.test", &dashboard),
-					resource.TestCheckResourceAttr("grafana_dashboard.test", "id", "basic-update"),
-					resource.TestCheckResourceAttr("grafana_dashboard.test", "uid", "basic-update"),
-					resource.TestCheckResourceAttr(
-						"grafana_dashboard.test", "config_json", `{"title":"Updated Title","uid":"basic-update"}`,
-					),
-				),
-			},
-			{
-				// Importing matches the state of the previous step.
-				ResourceName:            "grafana_dashboard.test",
-				ImportState:             true,
-				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"message"},
-			},
-		},
-	})
+	for _, useSHA256 := range []bool{false, true} {
+		t.Run(fmt.Sprintf("useSHA256=%t", useSHA256), func(t *testing.T) {
+			os.Setenv("GRAFANA_STORE_DASHBOARD_SHA256", fmt.Sprintf("%t", useSHA256))
+			defer os.Unsetenv("GRAFANA_STORE_DASHBOARD_SHA256")
+
+			expectedInitialConfig := `{"title":"Terraform Acceptance Test","uid":"basic"}`
+			expectedUpdatedTitleConfig := `{"title":"Updated Title","uid":"basic"}`
+			expectedUpdatedUIDConfig := `{"title":"Updated Title","uid":"basic-update"}`
+			if useSHA256 {
+				expectedInitialConfig = "fadbc115a19bfd7962d8f8d749d22c20d0a44043d390048bf94b698776d9f7f1"
+				expectedUpdatedTitleConfig = "4669abda43a4a6d6ae9ecaa19f8508faf4095682b679da0b5ce4176aa9171ab2"
+				expectedUpdatedUIDConfig = "2934e80938a672bd09d8e56385159a1bf8176e2a2ef549437f200d82ff398bfb"
+			}
+
+			resource.Test(t, resource.TestCase{
+				PreCheck:          func() { testAccPreCheck(t) },
+				ProviderFactories: testAccProviderFactories,
+				CheckDestroy:      testAccDashboardCheckDestroy(&dashboard),
+				Steps: []resource.TestStep{
+					{
+						// Test resource creation.
+						Config: testAccExample(t, "resources/grafana_dashboard/_acc_basic.tf"),
+						Check: resource.ComposeTestCheckFunc(
+							testAccDashboardCheckExists("grafana_dashboard.test", &dashboard),
+							resource.TestCheckResourceAttr("grafana_dashboard.test", "id", "basic"),
+							resource.TestCheckResourceAttr("grafana_dashboard.test", "uid", "basic"),
+							resource.TestCheckResourceAttr(
+								"grafana_dashboard.test", "config_json", expectedInitialConfig,
+							),
+						),
+					},
+					{
+						// Updates title.
+						Config: testAccExample(t, "resources/grafana_dashboard/_acc_basic_update.tf"),
+						Check: resource.ComposeTestCheckFunc(
+							testAccDashboardCheckExists("grafana_dashboard.test", &dashboard),
+							resource.TestCheckResourceAttr("grafana_dashboard.test", "id", "basic"),
+							resource.TestCheckResourceAttr("grafana_dashboard.test", "uid", "basic"),
+							resource.TestCheckResourceAttr(
+								"grafana_dashboard.test", "config_json", expectedUpdatedTitleConfig,
+							),
+						),
+					},
+					{
+						// Updates uid.
+						// uid is removed from `config_json` before writing it to state so it's
+						// important to ensure changing it triggers an update of `config_json`.
+						Config: testAccExample(t, "resources/grafana_dashboard/_acc_basic_update_uid.tf"),
+						Check: resource.ComposeTestCheckFunc(
+							testAccDashboardCheckExists("grafana_dashboard.test", &dashboard),
+							resource.TestCheckResourceAttr("grafana_dashboard.test", "id", "basic-update"),
+							resource.TestCheckResourceAttr("grafana_dashboard.test", "uid", "basic-update"),
+							resource.TestCheckResourceAttr(
+								"grafana_dashboard.test", "config_json", expectedUpdatedUIDConfig,
+							),
+						),
+					},
+					{
+						// Importing matches the state of the previous step.
+						ResourceName:            "grafana_dashboard.test",
+						ImportState:             true,
+						ImportStateVerify:       true,
+						ImportStateVerifyIgnore: []string{"message"},
+					},
+				},
+			})
+		})
+	}
 }
 
 func TestAccDashboard_uid_unset(t *testing.T) {