[Bug]: 2024_07 BCR breaks snowflake_user.foo.default_secondary_roles when unset

[jrobison-sb]

Terraform CLI Version

1.9.1

Terraform Provider Version

0.92.0

Terraform Configuration

resource "snowflake_user" "dev3229" {
  name         = "DEV3229"
  login_name   = "DEV3229"
  comment      = "A user of snowflake."
  disabled     = false
  must_change_password = false

  default_secondary_roles = null
}

Category

category:resource

Object type(s)

snowflake_user

Expected Behavior

default_secondary_roles should be null, and prior to the 2024_07 behavior change, this worked as expected. Additionally, after applying the above infrastructure, a subsequent terraform plan should plan cleanly with no diffs reported, which also worked as expected prior to the behavior change.

Actual Behavior

It's no longer possible to set this at null, or set it to an empty list, without plan diffs.

Steps to Reproduce

0. Apply the 2024_07 behavior change.
1. Apply the above HCL which uses default_secondary_roles = null (or which doesn't specify default_secondary_roles at all). This will apply cleanly.
2. Run a terraform plan and you'll see diffs like this:

  # module.sandbox3_application.snowflake_user.dev3229 will be updated in-place
  ~ resource "snowflake_user" "dev3229" {
      ~ default_secondary_roles = [
          - "ALL",
        ]
        id                      = "DEV3229"
        name                    = (sensitive value)
        # (12 unchanged attributes hidden)
    }

Plan: 0 to add, 1 to change, 0 to destroy.

3. Hmm, that's weird, try applying again maybe?
4. Now it gets even weirder because now the diff looks like this on every subsequent plan:

  # module.sandbox3_application.snowflake_user.dev3229 will be updated in-place
  ~ resource "snowflake_user" "dev3229" {
      ~ default_secondary_roles = [
          - jsonencode([]),
        ]
        id                      = "DEV3229"
        name                    = (sensitive value)
        # (12 unchanged attributes hidden)
    }

Plan: 0 to add, 1 to change, 0 to destroy.

5. Try setting it to an empty list instead of null. Apply again.
6. All subsequent diffs still look like this:

  # module.sandbox3_application.snowflake_user.dev3229 will be updated in-place
  ~ resource "snowflake_user" "dev3229" {
      ~ default_secondary_roles = [
          - jsonencode([]),
        ]
        id                      = "DEV3229"
        name                    = (sensitive value)
        # (12 unchanged attributes hidden)
    }

Plan: 0 to add, 1 to change, 0 to destroy.

How much impact is this issue causing?

Low

Logs

No response

Additional Information

No response

Would you like to implement a fix?

• Yeah, I'll take it 😎

[sfc-gh-asawicki]

Hey @jrobison-sb. Thanks for reaching out to us.

We release v0.95 with user resource changes today. I'll check if it needs adjustments to work correctly with this bundle.

[sfc-gh-asawicki]

Hey @jrobison-sb. We have just released v0.95.0 of the provider.

default_secondary_roles were replaced with default_secondary_roles_option. Please consult the migration guide.