Terraform-provider-vault: vault_database_secret_backend_connection always tries to update connection_url

[coryflucas]

Terraform Version

$ terraform -v
Terraform v0.11.8
+ provider.vault v1.1.4

Affected Resource(s)

• vault_database_secret_backend_connection

Terraform Configuration Files

provider "vault" {
    address = "http://localhost:8200"
    token = "test_token"
}

resource "vault_mount" "db" {
  path = "postgres"
  type = "database"
}

resource "vault_database_secret_backend_connection" "postgres" {
  backend       = "${vault_mount.db.path}"
  name          = "postgres"

  postgresql {
    connection_url = "postgres://postgres:postgres@postgres:5432/postgres?sslmode=disable"
  }
}

Debug Output

https://gist.github.com/coryflucas/7b44978253fe8ad33f2c5a119aed894b#file-tf-debug-log

Panic Output

https://gist.github.com/coryflucas/7b44978253fe8ad33f2c5a119aed894b#file-crash-log

Expected Behavior

Using minimal reproduction repo: https://github.com/coryflucas/tf-vault-issue:

• Run terraform apply --auto-approve, should create 2 resources
• Run terraform apply --auto-approve, should report nothing to do

Actual Behavior

The 2nd terraform apply reports it needs to update the connection_url from:

• "*****://*****:*****@*****:5432/*****?sslmode=disable"
  to:
• "postgres://postgres:postgres@postgres:5432/postgres?sslmode=disable"

If the apply is run, terraform crashes, and the state for the resources is lost.

Steps to Reproduce

Please list the steps required to reproduce the issue, for example:

1. terraform apply

Important Factoids

Reproducible against vault versions > 0.10.0, version 0.9.6 gives the expected behavior.

After the first apply the state file is updated the connection_url set to "*****://*****:*****@*****:5432/*****?sslmode=disable". This is what is returned from the Vault API. Seems like we should not use the Vault API response for determining the state value for this property.

References

Seems similar to https://github.com/terraform-providers/terraform-provider-vault/issues/115 but they are reporting an issue with a different attribute.

[Joseph-Irving]

We recently encountered this, coupled with https://github.com/terraform-providers/terraform-provider-vault/issues/152 it just causes chaos if you try to use vault_database_secret_backend_connection resource, we had to revert to using generic secrets as at least they don't break everything.

It would be great to see the related fix PRs merged

[jhmartin]

Any chance of getting this in a release?