[Bug]: State is updated with User's Login Time

[tturkenitz]

Terraform CLI Version

0.97.0

Terraform Provider Version

1.8.0

Company Name

No response

Terraform Configuration

resource "snowflake_user" "user" {
  name         = "sweet"
  disabled     = false
  display_name = "summer child"
  email        = "[email protected]"
  must_change_password = true
}

Category

category:resource

Object type(s)

resource:user

Expected Behavior

The resource's show_output should only be visible in Plan/Apply on initial creation or if called in outputs.tf

Actual Behavior

The user's show_output is shown when a user logs in and the last_success_login value changes.

Sample output:

  # module.snowflake_users["DUMMY"].snowflake_user.user has changed
! resource "snowflake_user" "user" {
        id                                             = "DUMMY"
        name                                           = "DUMMY"
!       show_output                                    = [
!           {
!               last_success_login      = "2024-11-08 16:40:56.122 +0000 UTC" -> "2024-11-08 17:11:24.291 +0000 UTC"
                name                    = "DUMMY"
                # (26 unchanged attributes hidden)
            },
        ]
        # (77 unchanged attributes hidden)
    }

When you have many users configured this can make reading Plans quite annoying.

Steps to Reproduce

1. Create a TF module that creates users with a single snowflake_user resource
2. Use the module to create several users
3. Initial Apply/Plan will show full output of show_output - that's ok
4. Log-in with several users that were created by the module
5. Execute terraform plan
6. All logged in users will now show in the plan due to an attribute change (last login)

How much impact is this issue causing?

Low

Logs

No response

Additional Information

No response

Would you like to implement a fix?

• Yeah, I'll take it 😎

[sfc-gh-asawicki]

Hey @tturkenitz. Thanks for reaching out to us.

I would say, that this is the expected terraform behavior.

The output you show is probably the output of terraform plan --refresh-only which correctly lists this attribute as changed. However, this is a computed field, so if you run terraform plan, you should see that there were no No changes. Your infrastructure matches the configuration..
You can also run terraform refresh which in this case will update this computed field and both terraform plan --refresh-only and terraform plan will result in empty "plans".

Also, please read this topic: hashicorp/terraform#28803 (comment).