Fix PKI Issuer overwrites on updates

CHANGELOG.md

@@ -4,6 +4,7 @@ BUGS:
 * Handle graceful destruction of resources when approle is deleted out-of-band ([#2142](https://github.com/hashicorp/terraform-provider-vault/pull/2142)).
 * Ensure errors are returned on read operations for `vault_ldap_secret_backend_static_role`, `vault_ldap_secret_backend_library_set`, and `vault_ldap_secret_backend_static_role` ([#2156](https://github.com/hashicorp/terraform-provider-vault/pull/2156)).
 * Ensure proper use of issuer endpoints for root sign intermediate resource: ([#2160](https://github.com/hashicorp/terraform-provider-vault/pull/2160))
+* Fix issuer data overwrites on updates: ([#2186](https://github.com/hashicorp/terraform-provider-vault/pull/2186))
 
 FEATURES:
 * Add support for PKI Secrets Engine cluster configuration with the `vault_pki_secret_backend_config_cluster` resource. Requires Vault 1.13+ ([#1949](https://github.com/hashicorp/terraform-provider-vault/pull/1949)).

vault/resource_pki_secret_backend_issuer.go

@@ -175,9 +175,16 @@ func pkiSecretBackendIssuerUpdate(ctx context.Context, d *schema.ResourceData, m
 
 	// only write to Vault if a patch is required
 	if patchRequired {
-		_, err := client.Logical().WriteWithContext(ctx, path, data)
-		if err != nil {
-			return diag.Errorf("error writing data to %q, err=%s", path, err)
+		if d.IsNewResource() {
+			_, err := client.Logical().WriteWithContext(ctx, path, data)
+			if err != nil {
+				return diag.Errorf("error writing issuer data to %q, err=%s", path, err)
+			}
+		} else {
+			_, err := client.Logical().JSONMergePatch(ctx, path, data)
+			if err != nil {
+				return diag.Errorf("error updating issuer data at %q, err=%s", path, err)
+			}
 		}
 	}
 

vault/resource_pki_secret_backend_issuer_test.go

@@ -5,6 +5,7 @@ package vault
 
 import (
 	"fmt"
+	"regexp"
 	"testing"
 
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
@@ -40,6 +41,25 @@ func TestAccPKISecretBackendIssuer_basic(t *testing.T) {
 					resource.TestCheckResourceAttrSet(resourceName, consts.FieldIssuerID),
 				),
 			},
+			{
+				Config: testAccPKISecretBackendIssuer_basic(backend,
+					fmt.Sprintf(`issuer_name = "%s"`, issuerName)),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr(resourceName, consts.FieldBackend, backend),
+					resource.TestCheckResourceAttr(resourceName, consts.FieldIssuerName, issuerName),
+					resource.TestCheckResourceAttr(resourceName, consts.FieldLeafNotAfterBehavior, "err"),
+					resource.TestCheckResourceAttrSet(resourceName, consts.FieldIssuerRef),
+					resource.TestCheckResourceAttrSet(resourceName, consts.FieldIssuerID),
+				),
+			},
+			// confirm error case when updating issuer by sending invalid option
+			{
+				Config: testAccPKISecretBackendIssuer_basic(backend,
+					fmt.Sprintf(`issuer_name = "%s"
+										leaf_not_after_behavior = "invalid"`, issuerName)),
+				ExpectError: regexp.MustCompile("error updating issuer data"),
+			},
+			// ensure JSON merge patch functions as expected. No overwrites
 			{
 				Config: testAccPKISecretBackendIssuer_basic(backend,
 					fmt.Sprintf(`issuer_name = "%s"