After importing random_string, special flag is changed

[cveld]

Terraform CLI and Provider Versions

terraform 1.7.5
hashicorp/random 3.6.0

Terraform Configuration

resource "random_password" "signing_key" {
  length  = 32
  special = false
  #lifecycle {
  #  ignore_changes = [
  #    special,
  #  ]
  #}
}

Expected Behavior

After having imported "kjMQAJ5HjUXTQph9gxh4MsiQu5RSkgX9" terraform plan reports zero changes.

Actual Behavior

After having imported "kjMQAJ5HjUXTQph9gxh4MsiQu5RSkgX9" terraform plan reports:

random_password.killswitch_signing_key must be replaced

-/+ resource "random_password" "signing_key" {
~ bcrypt_hash = (sensitive value)
~ id = "none" -> (known after apply)
~ result = (sensitive value)
~ special = true -> false # forces replacement
# (9 unchanged attributes hidden)
}

Steps to Reproduce

1. terraform import
2. terraform plan

How much impact is this issue causing?

Low

Logs

No response

Additional Information

No response

Code of Conduct

• I agree to follow this project's Code of Conduct

[bendbennett]

Hi @cveld 👋

Sorry you ran into trouble here.

The issue you describe is analogous to that documented in Import string always forces replacement. This is a consequence of the implementation of the ImportState() method on the random_string resource, which explicitly sets the special attribute to true during the import:

func (r *stringResource) ImportState(ctx context.Context, req resource.ImportStateRequest, resp *resource.ImportStateResponse) {
	id := req.ID

	state := stringModelV3{
		ID:              types.StringValue(id),
		Result:          types.StringValue(id),
		Length:          types.Int64Value(int64(len(id))),
		Special:         types.BoolValue(true),
		/* ... */

Unfortunately, at this time, with the configuration you have supplied, the only options are those laid out in https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/string#avoiding-replacement.

In order to better handle situations such as the one you have encountered we need to implement Import with Configuration. Please feel free to up-vote this issue to signal your interest.

As there is nothing further that can currently be done for the issue that you raised I am going to close this issue.

References:

• Import string always forces replacement #106
• feat: string and password import with settings #135
• Import via Configuration terraform-providers-devex#2

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.