Terraform CLI Version and Provider Version

Oct 13, 2025 by pinkandtrash.com 141 views

[Bug]: Terraform Plan Indicates That Allowed_Network_Rule_List/Blocked_Network_Rule_List Will Be Updated In-Place, Without Any Changes In The Code

Terraform is a popular infrastructure-as-code tool used for managing and provisioning cloud and on-premises infrastructure. However, users have reported a bug where Terraform plan indicates that allowed_network_rule_list/blocked_network_rule_list will be updated in-place, without any changes in the code. This issue is particularly concerning for users who rely on Terraform for managing their infrastructure, as it can lead to unexpected changes and potential security risks.

Terraform CLI Version and Provider Version

The Terraform CLI version used in this scenario is 0.92.0, and the Terraform provider version is also 0.92.0.

Company Name and Terraform Configuration

Unfortunately, the company name is not provided, and the Terraform configuration is as follows:

locals {
  database = "DB_DATA_GOVERNANCE_HUB"
  schema   = "NETWORK_RULES"
}

network_policy_list = {
  netpol_ipv4_all_test = {
    allowed_network_rule_list = ["NETRULE_IPV4_ALL_TEST"]
    blocked_ip_list           = []
  },
  netpol_monte_carlo_test = {
    allowed_network_rule_list = ["NETRULE_IPV4_ALL_TEST"]
    blocked_ip_list           = ["NETRULE_IPV4_ALL_TEST"]
  }
}

resource "snowflake_network_policy" "netpol_test" {
  for_each                  = var.network_policy_list
  provider                  = snowflake.accountadmin
  name                      = upper(each.key) #upper(join("_", [var.environment, "FIVETRAN"]))
  allowed_network_rule_list = [for rule in each.value.allowed_network_rule_list : upper(join(".", [local.database, local.schema, rule]))]
  blocked_network_rule_list = [for rule in each.value.blocked_ip_list : upper(join(".", [local.database, local.schema, rule]))]
  comment                   = "any"
}

Category and Object Type(s)

The category for this issue is resource, and the object type(s) affected are network_policy.

Expected Behavior

When you first terraform plan and apply network policy, it should be created. If you plan the same code without changes again, it should show no changes/updated.

Actual Behavior

After deploying network policies, when you run terraform plan again without any code changes, it shows the following output:

  # snowflake_network_policy.netpol_test["netpol_ipv4_all_test"] will be updated in-place
  ~ resource "snowflake_network_policy" "netpol_vtest" {
      ~ allowed_network_rule_list = [
          - "\"DB_DATA_GOVERNANCE_HUB\".\"NETWORK_RULES\".\"NETRULE_IPV4_ALL_TEST\"",
          + "DB_DATA_GOVERNANCE_HUB.NETWORK_RULES.NETRULE_IPV4_ALL_TEST",
        ]
        id                        = "NETPOL_IPV4_ALL_TEST"
        name                      = "NETPOL_IPV4_ALL_TEST"
        # (1 unchanged attribute hidden)
    }

For every plan, it is showing changes in the plan.

Steps to Reproduce

To reproduce this issue, follow these steps:

Create an env.tfvars file with the following content:

Network_rules_list = {
  netrule_ipv4_all_test1 = {
    type       = "IPV4"
    value_list = ["0.0.0.0/0"]
    mode       = "INGRESS"
  }
}

network_policy_list = {
  netpol_ipv4_all_test = {
    allowed_network_rule_list = ["NETRULE_IPV4_ALL_TEST"]
    blocked_ip_list           = []
  },
  netpol_carlo_test = {
    allowed_network_rule_list = ["NETRULE_IPV4_ALL_TEST"]
    blocked_ip_list           = ["NETRULE_IPV4_ALL_TEST"]
  }
}

Create a variable.tf file with the following content:

variable "Network_rules_list" {
  type = map(object({
    type       = string
    value_list = list(string)
    mode       = string
  }))
}

variable "network_policy_list" {
  type = map(object({
    allowed_network_rule_list = list(string)
    blocked_ip_list           = list(string)
  }))
}

Create a locals.tf file with the following content:

locals {
  database = "DB_DATA_GOVERNANCE_HUB"
  schema   = "NETWORK_RULES"
}

Create a network_rules.tf file with the following content:

resource "snowflake_network_rule" "netrule_vertex" {
  for_each   = var.Network_rules_list
  provider   = snowflake.accountadmin
  name       = upper(each.key)
  database   = local.database
  schema     = local.schema
  comment    = "Restricts access for Vertex IPS only. To be included in allowed lists for network policies."
  type       = each.value.type
  mode       = each.value.mode
  value_list = each.value.value_list
}

Create a network policy from the above network rule:

resource "snowflake_network_policy" "netpol_vertex" {
  for_each                  = var.network_policy_list
  provider                  = snowflake.accountadmin
  name                      = upper(each.key) #upper(join("_", [var.environment, "FIVETRAN"]))
  allowed_network_rule_list = [for rule in each.value.allowed_network_rule_list : upper(join(".", [local.database, local.schema, rule]))]
  blocked_network_rule_list = [for rule in each.value.blocked_ip_list : upper(join(".", [local.database, local.schema, rule]))]
  comment                   = "Allows access through the private endpoint for generic users, further restricting traffic to VERTEX IPS"
}

Run terraform plan and terraform apply.
Run terraform plan again after the first successful deployment.

How Much Impact Is This Issue Causing?

This issue is causing a low impact.

Logs

No logs are provided.

Additional Information

No additional information is provided.

Would You Like to Implement a Fix?

Yes, a fix should be implemented to resolve this issue.
Q&A: [Bug]: Terraform Plan Indicates That Allowed_Network_Rule_List/Blocked_Network_Rule_List Will Be Updated In-Place, Without Any Changes In The Code

Q: What is the issue with Terraform plan indicating that allowed_network_rule_list/blocked_network_rule_list will be updated in-place, without any changes in the code?

A: The issue is that Terraform plan is indicating that allowed_network_rule_list/blocked_network_rule_list will be updated in-place, without any changes in the code. This is causing unexpected changes and potential security risks.

Q: What are the Terraform CLI version and provider version used in this scenario?

A: The Terraform CLI version used in this scenario is 0.92.0, and the Terraform provider version is also 0.92.0.

Q: What is the Terraform configuration used in this scenario?

A: The Terraform configuration used in this scenario is as follows:

locals {
  database = "DB_DATA_GOVERNANCE_HUB"
  schema   = "NETWORK_RULES"
}

network_policy_list = {
  netpol_ipv4_all_test = {
    allowed_network_rule_list = ["NETRULE_IPV4_ALL_TEST"]
    blocked_ip_list           = []
  },
  netpol_monte_carlo_test = {
    allowed_network_rule_list = ["NETRULE_IPV4_ALL_TEST"]
    blocked_ip_list           = ["NETRULE_IPV4_ALL_TEST"]
  }
}

resource "snowflake_network_policy" "netpol_test" {
  for_each                  = var.network_policy_list
  provider                  = snowflake.accountadmin
  name                      = upper(each.key) #upper(join("_", [var.environment, "FIVETRAN"]))
  allowed_network_rule_list = [for rule in each.value.allowed_network_rule_list : upper(join(".", [local.database, local.schema, rule]))]
  blocked_network_rule_list = [for rule in each.value.blocked_ip_list : upper(join(".", [local.database, local.schema, rule]))]
  comment                   = "any"
}

Q: What are the steps to reproduce this issue?

A: To reproduce this issue, follow these steps:

Create an env.tfvars file with the following content:

Network_rules_list = {
  netrule_ipv4_all_test1 = {
    type       = "IPV4"
    value_list = ["0.0.0.0/0"]
    mode       = "INGRESS"
  }
}

network_policy_list = {
  netpol_ipv4_all_test = {
    allowed_network_rule_list = ["NETRULE_IPV4_ALL_TEST"]
    blocked_ip_list           = []
  },
  netpol_carlo_test = {
    allowed_network_rule_list = ["NETRULE_IPV4_ALL_TEST"]
    blocked_ip_list           = ["NETRULE_IPV4_ALL_TEST"]
  }
}

Create a variable.tf file with the following content:

variable "Network_rules_list" {
  type = map(object({
    type       = string
    value_list = list(string)
    mode       = string
  }))
}

variable "network_policy_list" {
  type = map(object({
    allowed_network_rule_list = list(string)
    blocked_ip_list           = list(string)
  }))
}

Create a locals.tf file with the following content:

locals {
  database = "DB_DATA_GOVERNANCE_HUB"
  schema   = "NETWORK_RULES"
}

Create a network_rules.tf file with the following content:

resource "snowflake_network_rule" "netrule_vertex" {
  for_each   = var.Network_rules_list
  provider   = snowflake.accountadmin
  name       = upper(each.key)
  database   = local.database
  schema     = local.schema
  comment    = "Restricts access for Vertex IPS only. To be included in allowed lists for network policies."
  type       = each.value.type
  mode       = each.value.mode
  value_list = each.value.value_list
}

Create a network policy from the above network rule:

resource "snowflake_network_policy" "netpol_vertex" {
  for_each                  = var.network_policy_list
  provider                  = snowflake.accountadmin
  name                      = upper(each.key) #upper(join("_", [var.environment, "FIVETRAN"]))
  allowed_network_rule_list = [for rule in each.value.allowed_network_rule_list : upper(join(".", [local.database, local.schema, rule]))]
  blocked_network_rule_list = [for rule in each.value.blocked_ip_list : upper(join(".", [local.database, local.schema, rule]))]
  comment                   = "Allows access through the private endpoint for generic users, further restricting traffic to VERTEX IPS"
}

Run terraform plan and terraform apply.
Run terraform plan again after the first successful deployment.

Q: How much impact is this issue causing?

A: This issue is causing a low impact.

Q: What are the logs for this issue?

A: No logs are provided.

Q: Is there any additional information about this issue?

A: No additional information is provided.

Q: Would you like to implement a fix for this issue?

A: Yes, a fix should be implemented to resolve this issue.