Row access policy always marked as changed when using heredoc style SQLs

[fredriv]

Provider Version

0.70.1

Terraform Version

1.5.4

Describe the bug

When configuring the row access expression of a snowflake_row_access_policy using heredoc instead of a regular string, the resource is always marked as changed by terraform plan/apply.

Expected behavior

I expect the resource to not be marked as changed after applying it.

Code samples and commands

Example config to trigger the issue:

resource "snowflake_row_access_policy" "example_row_access_policy" {
  name     = "EXAMPLE_ROW_ACCESS_POLICY"
  database = "EXAMPLE_DB"
  schema   = "EXAMPLE_SCHEMA"
  signature = {
    A = "VARCHAR",
    B = "VARCHAR"
  }
  row_access_expression = <<-EOT
    case
      when current_role() in ('ANALYST') then true
      else false
    end
EOT
}

Additional context

I suspect this is a similar issue as in #534?

[fredriv]

Or perhaps related to #1422 / #1097?

[fredriv]

Verified that it's an issue with trailing newline in the heredoc style row access expression, similar to #1422 / #1097.

I moved the expression to a local variable and changed the row access policy resource to use row_access_expression = trim(local.expression, "\n") and the issue disappeared.

[sfc-gh-jmichalak]

Hi @fredriv 👋
Sorry for a late response from our side. We are currently reworking row access policies. The issues you mentioned are related to other resources, but #1151 is related to row access policies as well. To be sure, could you paste terraform apply output?

[sfc-gh-jmichalak]

Hi, we've released v0.96.0, which includes adjusting and fixing row access policies. Please upgrade with the migration guide.