[compute_firewall] Deleting a destination_range in an ingress firewall rule has no effect

[ajlopezn]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request.
• Please do not leave +1 or me too comments, they generate extra noise for issue followers and do not help prioritize the request.
• If you are interested in working on this issue or have submitted a pull request, please leave a comment.
• If an issue is assigned to the modular-magician user, it is either in the process of being autogenerated, or is planned to be autogenerated soon. If an issue is assigned to a user, that user is claiming responsibility for the issue. If an issue is assigned to hashibot, a community member has claimed the issue already.

Terraform Version

Terraform v1.4.4

Affected Resource(s)

google_compute_firewall

Terraform Configuration Files

resource "google_compute_firewall" "custom-rule-allow-ingress-source-destination" {
  project     = "myproject"
  network     = "myvpc"
  name        = "allow-ingress-source-destination-ranges"
  description =  "Allow ingress using source and destination ranges"
  direction   = "INGRESS"
  source_ranges = (
    ["10.132.0.0/20", "10.138.0.0/20"]
  )
  destination_ranges = (
    ["10.128.0.0/20"]
  )
  allow {
    protocol = "all"
  }
}

Debug Output

Panic Output

Expected Behavior

When creating an ingress fw rule with a source and destination range, it is created correctly.

After that, if I delete the destination_ranges, it shall be updated

Actual Behavior

When creating an ingress fw rule with a source and destination range, it is created correctly.

After that, if I delete the destination_ranges, no change is reflected in "terraform plan"

Steps to Reproduce

1. Create the ingress rule with a destination_source !=null (see example above)
2. terraform apply
3. Delete destination_ranges from the resource

resource "google_compute_firewall" "custom-rule-allow-ingress-source-destination" {
  project     = "myproject"
  network     = "myvpc"
  name        = "allow-ingress-source-destination-ranges"
  description =  "Allow ingress using source and destination ranges"
  direction   = "INGRESS"
  source_ranges = (
    ["10.132.0.0/20", "10.138.0.0/20"]
  )
  allow {
    protocol = "all"
  }
}

4. 'terraform apply'
   output: "No changes. Your infrastructure matches the configuration."

Important Factoids

NA

References

GoogleCloudPlatform/magic-modules#6931

• #0000

b/304967665

[edwardmedia]

@ajlopezn I can repro the issue. To work around, you can provide the empty list instead.

resource "google_compute_firewall" "custom-rule-allow-ingress-source-destination" {
  network     = "myvpc"
  name        = "allow-ingress-source-destination-ranges"
  description =  "Allow ingress using source and destination ranges"
  direction   = "INGRESS"
  source_ranges = (
    ["10.132.0.0/20", "10.138.0.0/20"]
  )
  /*
  destination_ranges = (
    ["10.128.0.0/20"]
  )
  */
  destination_ranges = (
    []
  )
  allow {
    protocol = "all"
  }
}

[ajlopezn]

yes, that works