After importing newrelic_notification_destination of type SLACK it tries to delete auth_token

[alisson276]

Terraform Version

Terraform v1.3.0
on linux_arm64

Affected Resource(s)

Please list the resources as a list, for example:

• newrelic_notification_destination

Terraform Configuration

Please include your provider configuration (sensitive details redacted) as well as the configuration of the resources and/or data sources related to the bug report.

terraform {
  required_providers {
    newrelic = {
      source  = "newrelic/newrelic"
      version = "~> 3.3"
    }
  }
}

provider "newrelic" {
  account_id = **********
  api_key = **********
  region = "US"
}

resource "newrelic_notification_destination" "slack" {
  name = "*********"
  type = "SLACK"

  auth_token {
    prefix = "Bearer"
  }

  property {
        key   = "scope"
        label = "Permissions"
        value = "app_mentions:read,channels:join,channels:read,chat:write,chat:write.public,commands,groups:read,links:read,links:write,team:read,users:read"
    }
    property {
        key   = "teamName"
        label = "Team Name"
        value = "******"
    }
}

Actual Behavior

I've imported the slack newrelic_notification_destination like described in the documentation. Then I did a terraform state show newrelic_notification_destination.slack and I've made the required changes in my main.tf. The final resource is like the mentioned before (including the auth_token block).

After this, I did a plan and it shows me an error saying:

 Error: Missing required argument
│ 
│   on main.tf line 10, in resource "newrelic_notification_destination" "slack":
│   10:   auth_token {
│ 
│ The argument "token" is required, but no definition was found.

If I remove the block auth_token then it says me it will be removed (what I think it shouldn't be)

Expected Behavior

The auth_token.token should be optional in the resource when the type is slack or shouldn't be imported.

[NSSPKrishna]

Hi @alisson276, thanks for raising the issue. We will prioritise it.

[yuto727]

@NSSPKrishna Has this issue already been resolved?

[lzaga-newrelic]

Hi @alisson276 , Thank you for your feedback and we'll address this issue. In the meanwhile, you can add the following code to your imported Slack destination resource:

  lifecycle {
    ignore_changes = [auth_token]
  }

For example:

resource "newrelic_notification_destination" "slack" {
  lifecycle {
    ignore_changes = [auth_token]
  }

  name = "*********"
  type = "SLACK"

  auth_token {
    prefix = "Bearer"
  }

  property {
        key   = "scope"
        label = "Permissions"
        value = "app_mentions:read,channels:join,channels:read,chat:write,chat:write.public,commands,groups:read,links:read,links:write,team:read,users:read"
    }
    property {
        key   = "teamName"
        label = "Team Name"
        value = "******"
    }
}

[JBallin]

Instructions suggest not to copy state (as OP did)?

Instead, leave the resource empty - but the validation fails on required attributes...?

[JBallin]

For now, here's my workaround:

resource "newrelic_notification_destination" "slack" {
  lifecycle {
    # attributes are only being set to pass validation (not actually used)
    # https://github.com/newrelic/terraform-provider-newrelic/issues/2025
    ignore_changes  = all
    # destination requires manual import & therefore should not be destroyed
    prevent_destroy = true
  }

  type = "SLACK"
  name = ""
  property {
    key   = ""
    value = ""
  }
}

Docs: lifecycle

[lzaga-newrelic]

Hi everyone, The token in auth_token attribute doesn't return from our API, because it’s sensitive data. After deeper investigation, ignore_changes is the only way to avoid this issue (as mentioned below). We'll add this information to the docs.

  lifecycle {
    ignore_changes = [auth_token]
  }

For example:

resource "newrelic_notification_destination" "slack" {
  lifecycle {
    ignore_changes = [auth_token]
  }

  name = "*********"
  type = "SLACK"

  auth_token {
    prefix = "Bearer"
  }

  property {
        key   = "scope"
        label = "Permissions"
        value = "app_mentions:read,channels:join,channels:read,chat:write,chat:write.public,commands,groups:read,links:read,links:write,team:read,users:read"
    }
    property {
        key   = "teamName"
        label = "Team Name"
        value = "******"
    }
}

[zeffron]

After deeper investigation, ignore_changes is the only way to avoid this issue (as mentioned below).

Disagree. The provider can be taught to automatically ignore changes for the relevant fields when the type is SLACK so that users do not have to add a lifecycle block.

[JBallin]

Agree with @zeffron that this is just an edge case in your validation not taking slack destinations into account - meaning that the validation itself needs to be fixed, not the resource configuration.

I like @zeffron's idea of allowing empty when type === "SLACK" and updating docs to recommend this:

resource "newrelic_notification_destination" "slack" {
  type = "SLACK"
}

---

Extra credit: If there was a way to automatically prevent destroy, that may be useful? Although I guess this would already be the case if it was in use by a workflow...?

[zeffron]

Extra credit: If there was a way to automatically prevent destroy, that may be useful? Although I guess this would already be the case if it was in use by a workflow...?

I think this is doable, but I don't know if it really fits well with the Terraform paradigm. Terraform can't distinguish between a resource that was made manually and then imported explicitly for this configuration (in which case destroy might be correct behavior) and one where it's being imported for reuse, or where it will be needed again post destroy. Having the user explicitly set the lifecycle to prevent destruction does seem appropriate to me because knowing if destruction is desired or not does require extra information from the user. Might be possible to default to not destroying and require setting prevent_destroy to false (if that's even possible?), but that seems very esoteric.

[JBallin]

Right it wouldn't be explicit, which is confusing. Maybe a note in the docs is enough.

[TheQueenIsDead]

Throwing 2c in here, would being able to reference the destination as data instead of resource be better? Seems like it would fit better with the ethos of referencing something created outside of the modules control.

[JBallin]

Tried data:

│ Error: Invalid data source
│ 
│   on main.tf line 1, in data "newrelic_notification_destination" "slack":
│    1: data "newrelic_notification_destination" "slack" {
│ 
│ The provider newrelic/newrelic does not support data source
│ "newrelic_notification_destination".
│ 
│ Did you intend to use the managed resource type
│ "newrelic_notification_destination"? If so, declare this using a "resource"
│ block instead of a "data" block.

[lzaga-newrelic]

Hi everyone, We are working on creating destinations as data sources as well.

[MAN98]

@lzaga-newrelic - do we have a date when destinations as data source will go live? Thanks!

[lzaga-newrelic]

Hi @MAN98 , We are working on that right now. Hopefully, next week you'll see it in the next version of the provider. I'll update here as well.

[MAN98]

Thanks for the prompt response @lzaga-newrelic ^_^