feat: more_tests (#85)

## Description

<!-- **Please link some issue here describing what you are trying to achieve.**

In case there is no issue present for your PR, please consider creating one.
At least please give us some description what you are trying to achieve and why your change is needed. -->

relates to #1234

## Checklist

- [ ] Issue was linked above
- [ ] Code format was applied: `make fmt`
- [ ] Examples were added / adjusted (see `examples/` directory)
- [x] Docs are up-to-date: `make generate-docs` (will be checked by CI)
- [ ] Unit tests got implemented or updated
- [ ] Acceptance tests got implemented or updated (see e.g. [here](f5f99d1709/stackit/internal/services/dns/dns_acc_test.go))
- [x] Unit tests are passing: `make test` (will be checked by CI)
- [x] No linter issues: `make lint` (will be checked by CI)

Co-authored-by: Marcel S. Henselin <marcel.henselin@stackit.cloud>
Reviewed-on: #85

stackit/internal/services/sqlserverflexbeta/instance/functions.go

@@ -11,6 +11,8 @@ import (
 	"github.com/hashicorp/terraform-plugin-framework/resource"
 	"github.com/hashicorp/terraform-plugin-framework/types"
 
+	"tf-provider.git.onstackit.cloud/stackit-dev-tools/terraform-provider-stackitprivatepreview/stackit/internal/utils"
+
 	"github.com/stackitcloud/stackit-sdk-go/services/sqlserverflex/v3beta1api"
 
 	sqlserverflexbetaDataGen "tf-provider.git.onstackit.cloud/stackit-dev-tools/terraform-provider-stackitprivatepreview/stackit/internal/services/sqlserverflexbeta/instance/datasources_gen"
@@ -27,7 +29,7 @@ func mapResponseToModel(
 	m.Edition = types.StringValue(string(resp.GetEdition()))
 	m.Encryption = handleEncryption(ctx, m, resp)
 	m.FlavorId = types.StringValue(resp.GetFlavorId())
-	m.Id = types.StringValue(resp.GetId())
+	m.Id = utils.BuildInternalTerraformId(m.ProjectId.ValueString(), m.Region.ValueString(), resp.GetId())
 	m.InstanceId = types.StringValue(resp.GetId())
 	m.IsDeletable = types.BoolValue(resp.GetIsDeletable())
 	m.Name = types.StringValue(resp.GetName())

stackit/internal/services/sqlserverflexbeta/instance/resource.go

@@ -10,7 +10,6 @@ import (
 
 	"github.com/hashicorp/terraform-plugin-framework/path"
 	"github.com/hashicorp/terraform-plugin-framework/resource"
-	"github.com/hashicorp/terraform-plugin-framework/resource/identityschema"
 	"github.com/hashicorp/terraform-plugin-framework/types"
 	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/stackitcloud/stackit-sdk-go/core/config"
@@ -32,7 +31,6 @@ var (
 	_ resource.ResourceWithConfigure   = &instanceResource{}
 	_ resource.ResourceWithImportState = &instanceResource{}
 	_ resource.ResourceWithModifyPlan  = &instanceResource{}
-	_ resource.ResourceWithIdentity    = &instanceResource{}
 )
 
 func NewInstanceResource() resource.Resource {
@@ -47,12 +45,6 @@ type instanceResource struct {
 // resourceModel describes the resource data model.
 type resourceModel = sqlserverflexbetaResGen.InstanceModel
 
-type InstanceResourceIdentityModel struct {
-	ProjectID  types.String `tfsdk:"project_id"`
-	Region     types.String `tfsdk:"region"`
-	InstanceID types.String `tfsdk:"instance_id"`
-}
-
 func (r *instanceResource) Metadata(
 	_ context.Context,
 	req resource.MetadataRequest,
@@ -81,26 +73,6 @@ func (r *instanceResource) Schema(ctx context.Context, _ resource.SchemaRequest,
 	resp.Schema = s
 }
 
-func (r *instanceResource) IdentitySchema(
-	_ context.Context,
-	_ resource.IdentitySchemaRequest,
-	resp *resource.IdentitySchemaResponse,
-) {
-	resp.IdentitySchema = identityschema.Schema{
-		Attributes: map[string]identityschema.Attribute{
-			"project_id": identityschema.StringAttribute{
-				RequiredForImport: true, // must be set during import by the practitioner
-			},
-			"region": identityschema.StringAttribute{
-				RequiredForImport: true, // can be defaulted by the provider configuration
-			},
-			"instance_id": identityschema.StringAttribute{
-				RequiredForImport: true, // can be defaulted by the provider configuration
-			},
-		},
-	}
-}
-
 // Configure adds the provider configured client to the resource.
 func (r *instanceResource) Configure(
 	ctx context.Context,
@@ -190,9 +162,9 @@ func (r *instanceResource) Create(ctx context.Context, req resource.CreateReques
 
 	ctx = core.InitProviderContext(ctx)
 
-	projectId := data.ProjectId.ValueString()
+	projectID := data.ProjectId.ValueString()
 	region := data.Region.ValueString()
-	ctx = tflog.SetField(ctx, "project_id", projectId)
+	ctx = tflog.SetField(ctx, "project_id", projectID)
 	ctx = tflog.SetField(ctx, "region", region)
 
 	// Generate API request body from model
@@ -210,7 +182,7 @@ func (r *instanceResource) Create(ctx context.Context, req resource.CreateReques
 	// Create new Instance
 	createResp, err := r.client.DefaultAPI.CreateInstanceRequest(
 		ctx,
-		projectId,
+		projectID,
 		region,
 	).CreateInstanceRequestPayload(*payload).Execute()
 	if err != nil {
@@ -220,24 +192,25 @@ func (r *instanceResource) Create(ctx context.Context, req resource.CreateReques
 
 	ctx = core.LogResponse(ctx)
 
-	instanceId := createResp.Id
-	data.InstanceId = types.StringValue(instanceId)
+	instanceID := createResp.Id
+	data.InstanceId = types.StringValue(instanceID)
+	data.Id = utils.BuildInternalTerraformId(projectID, region, instanceID)
 
-	identity := InstanceResourceIdentityModel{
-		ProjectID:  types.StringValue(projectId),
-		Region:     types.StringValue(region),
-		InstanceID: types.StringValue(instanceId),
-	}
-	resp.Diagnostics.Append(resp.Identity.Set(ctx, identity)...)
-	if resp.Diagnostics.HasError() {
-		return
-	}
+	// Set data returned by API in id
+	resp.Diagnostics.Append(
+		resp.State.SetAttribute(
+			ctx,
+			path.Root("id"),
+			utils.BuildInternalTerraformId(projectID, region, instanceID),
+		)...,
+	)
+	resp.Diagnostics.Append(resp.State.SetAttribute(ctx, path.Root("instance_id"), instanceID)...)
 
 	waitResp, err := wait.CreateInstanceWaitHandler(
 		ctx,
 		r.client.DefaultAPI,
-		projectId,
-		instanceId,
+		projectID,
+		instanceID,
 		region,
 	).SetSleepBeforeWait(
 		10 * time.Second,
@@ -293,15 +266,15 @@ func (r *instanceResource) Read(ctx context.Context, req resource.ReadRequest, r
 
 	ctx = core.InitProviderContext(ctx)
 
-	projectId := data.ProjectId.ValueString()
+	projectID := data.ProjectId.ValueString()
 	region := data.Region.ValueString()
-	ctx = tflog.SetField(ctx, "project_id", projectId)
+	ctx = tflog.SetField(ctx, "project_id", projectID)
 	ctx = tflog.SetField(ctx, "region", region)
 
-	instanceId := data.InstanceId.ValueString()
-	ctx = tflog.SetField(ctx, "instance_id", instanceId)
+	instanceID := data.InstanceId.ValueString()
+	ctx = tflog.SetField(ctx, "instance_id", instanceID)
 
-	instanceResp, err := r.client.DefaultAPI.GetInstanceRequest(ctx, projectId, region, instanceId).Execute()
+	instanceResp, err := r.client.DefaultAPI.GetInstanceRequest(ctx, projectID, region, instanceID).Execute()
 	if err != nil {
 		oapiErr, ok := err.(*oapierror.GenericOpenAPIError) //nolint:errorlint //complaining that error.As should be used to catch wrapped errors, but this error should not be wrapped
 		if ok && oapiErr.StatusCode == http.StatusNotFound {
@@ -326,17 +299,6 @@ func (r *instanceResource) Read(ctx context.Context, req resource.ReadRequest, r
 		return
 	}
 
-	// Save identity into Terraform state
-	identity := InstanceResourceIdentityModel{
-		ProjectID:  types.StringValue(projectId),
-		Region:     types.StringValue(region),
-		InstanceID: types.StringValue(instanceId),
-	}
-	resp.Diagnostics.Append(resp.Identity.Set(ctx, identity)...)
-	if resp.Diagnostics.HasError() {
-		return
-	}
-
 	// Save updated data into Terraform state
 	resp.Diagnostics.Append(resp.State.Set(ctx, &data)...)
 	if resp.Diagnostics.HasError() {
@@ -357,13 +319,13 @@ func (r *instanceResource) Update(ctx context.Context, req resource.UpdateReques
 
 	ctx = core.InitProviderContext(ctx)
 
-	projectId := data.ProjectId.ValueString()
+	projectID := data.ProjectId.ValueString()
 	region := data.Region.ValueString()
-	ctx = tflog.SetField(ctx, "project_id", projectId)
+	ctx = tflog.SetField(ctx, "project_id", projectID)
 	ctx = tflog.SetField(ctx, "region", region)
 
-	instanceId := data.InstanceId.ValueString()
-	ctx = tflog.SetField(ctx, "instance_id", instanceId)
+	instanceID := data.InstanceId.ValueString()
+	ctx = tflog.SetField(ctx, "instance_id", instanceID)
 
 	// Generate API request body from model
 	payload, err := toUpdatePayload(ctx, &data, resp)
@@ -379,9 +341,9 @@ func (r *instanceResource) Update(ctx context.Context, req resource.UpdateReques
 	// Update existing instance
 	err = r.client.DefaultAPI.UpdateInstanceRequest(
 		ctx,
-		projectId,
+		projectID,
 		region,
-		instanceId,
+		instanceID,
 	).UpdateInstanceRequestPayload(*payload).Execute()
 	if err != nil {
 		core.LogAndAddError(ctx, &resp.Diagnostics, updateInstanceError, err.Error())
@@ -391,7 +353,7 @@ func (r *instanceResource) Update(ctx context.Context, req resource.UpdateReques
 	ctx = core.LogResponse(ctx)
 
 	waitResp, err := wait.
-		UpdateInstanceWaitHandler(ctx, r.client.DefaultAPI, projectId, instanceId, region).
+		UpdateInstanceWaitHandler(ctx, r.client.DefaultAPI, projectID, instanceID, region).
 		SetSleepBeforeWait(15 * time.Second).
 		SetTimeout(45 * time.Minute).
 		WaitWithContext(ctx)
@@ -417,16 +379,6 @@ func (r *instanceResource) Update(ctx context.Context, req resource.UpdateReques
 		return
 	}
 
-	identity := InstanceResourceIdentityModel{
-		ProjectID:  types.StringValue(projectId),
-		Region:     types.StringValue(region),
-		InstanceID: types.StringValue(instanceId),
-	}
-	resp.Diagnostics.Append(resp.Identity.Set(ctx, identity)...)
-	if resp.Diagnostics.HasError() {
-		return
-	}
-
 	// Save updated data into Terraform state
 	resp.Diagnostics.Append(resp.State.Set(ctx, &data)...)
 	if resp.Diagnostics.HasError() {
@@ -445,25 +397,18 @@ func (r *instanceResource) Delete(ctx context.Context, req resource.DeleteReques
 		return
 	}
 
-	// Read identity data
-	var identityData InstanceResourceIdentityModel
-	resp.Diagnostics.Append(req.Identity.Get(ctx, &identityData)...)
-	if resp.Diagnostics.HasError() {
-		return
-	}
-
 	ctx = core.InitProviderContext(ctx)
 
-	projectId := identityData.ProjectID.ValueString()
-	region := identityData.Region.ValueString()
-	ctx = tflog.SetField(ctx, "project_id", projectId)
+	projectID := data.ProjectId.ValueString()
+	region := data.Region.ValueString()
+	ctx = tflog.SetField(ctx, "project_id", projectID)
 	ctx = tflog.SetField(ctx, "region", region)
 
-	instanceId := identityData.InstanceID.ValueString()
-	ctx = tflog.SetField(ctx, "instance_id", instanceId)
+	instanceID := data.InstanceId.ValueString()
+	ctx = tflog.SetField(ctx, "instance_id", instanceID)
 
 	// Delete existing instance
-	err := r.client.DefaultAPI.DeleteInstanceRequest(ctx, projectId, region, instanceId).Execute()
+	err := r.client.DefaultAPI.DeleteInstanceRequest(ctx, projectID, region, instanceID).Execute()
 	if err != nil {
 		core.LogAndAddError(ctx, &resp.Diagnostics, "Error deleting instance", fmt.Sprintf("Calling API: %v", err))
 		return
@@ -471,7 +416,7 @@ func (r *instanceResource) Delete(ctx context.Context, req resource.DeleteReques
 
 	ctx = core.LogResponse(ctx)
 
-	delResp, err := wait.DeleteInstanceWaitHandler(ctx, r.client.DefaultAPI, projectId, instanceId, region).WaitWithContext(ctx)
+	delResp, err := wait.DeleteInstanceWaitHandler(ctx, r.client.DefaultAPI, projectID, instanceID, region).WaitWithContext(ctx)
 	if err != nil {
 		core.LogAndAddError(
 			ctx,
@@ -506,41 +451,24 @@ func (r *instanceResource) ImportState(
 ) {
 	ctx = core.InitProviderContext(ctx)
 
-	if req.ID != "" {
-		idParts := strings.Split(req.ID, core.Separator)
+	idParts := strings.Split(req.ID, core.Separator)
 
-		if len(idParts) != 3 || idParts[0] == "" || idParts[1] == "" || idParts[2] == "" {
-			core.LogAndAddError(
-				ctx, &resp.Diagnostics,
-				"Error importing instance",
-				fmt.Sprintf(
-					"Expected import identifier with format [project_id],[region],[instance_id]  Got: %q",
-					req.ID,
-				),
-			)
-			return
-		}
-
-		resp.Diagnostics.Append(resp.State.SetAttribute(ctx, path.Root("project_id"), idParts[0])...)
-		resp.Diagnostics.Append(resp.State.SetAttribute(ctx, path.Root("region"), idParts[1])...)
-		resp.Diagnostics.Append(resp.State.SetAttribute(ctx, path.Root("instance_id"), idParts[2])...)
+	if len(idParts) != 3 || idParts[0] == "" || idParts[1] == "" || idParts[2] == "" {
+		core.LogAndAddError(
+			ctx, &resp.Diagnostics,
+			"Error importing instance",
+			fmt.Sprintf(
+				"Expected import identifier with format [project_id],[region],[instance_id]  Got: %q",
+				req.ID,
+			),
+		)
 		return
 	}
 
-	// If no ID is provided, attempt to read identity attributes from the import configuration
-	var identityData InstanceResourceIdentityModel
-	resp.Diagnostics.Append(req.Identity.Get(ctx, &identityData)...)
-	if resp.Diagnostics.HasError() {
-		return
-	}
-
-	projectId := identityData.ProjectID.ValueString()
-	region := identityData.Region.ValueString()
-	instanceId := identityData.InstanceID.ValueString()
-
-	resp.Diagnostics.Append(resp.State.SetAttribute(ctx, path.Root("project_id"), projectId)...)
-	resp.Diagnostics.Append(resp.State.SetAttribute(ctx, path.Root("region"), region)...)
-	resp.Diagnostics.Append(resp.State.SetAttribute(ctx, path.Root("instance_id"), instanceId)...)
+	resp.Diagnostics.Append(resp.State.SetAttribute(ctx, path.Root("id"), utils.BuildInternalTerraformId(idParts...).ValueString())...)
+	resp.Diagnostics.Append(resp.State.SetAttribute(ctx, path.Root("project_id"), idParts[0])...)
+	resp.Diagnostics.Append(resp.State.SetAttribute(ctx, path.Root("region"), idParts[1])...)
+	resp.Diagnostics.Append(resp.State.SetAttribute(ctx, path.Root("instance_id"), idParts[2])...)
 
 	tflog.Info(ctx, "Sqlserverflexbeta instance state imported")
 }

stackit/internal/services/sqlserverflexbeta/sqlserverflex_acc_test.go

@@ -3,13 +3,32 @@ package sqlserverflexbeta_test
 import (
 	"context"
 	_ "embed"
+	"errors"
 	"fmt"
+	"log"
+	"net/http"
 	"os"
 	"strconv"
+	"strings"
 	"testing"
+	"time"
 
+	"github.com/hashicorp/terraform-plugin-testing/compare"
 	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/knownvalue"
+	"github.com/hashicorp/terraform-plugin-testing/plancheck"
+	"github.com/hashicorp/terraform-plugin-testing/statecheck"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
+	"github.com/hashicorp/terraform-plugin-testing/tfjsonpath"
+	"github.com/stackitcloud/stackit-sdk-go/core/config"
+	"github.com/stackitcloud/stackit-sdk-go/core/oapierror"
+	"github.com/stackitcloud/stackit-sdk-go/core/utils"
+
+	"tf-provider.git.onstackit.cloud/stackit-dev-tools/terraform-provider-stackitprivatepreview/stackit/internal/core"
+	wait "tf-provider.git.onstackit.cloud/stackit-dev-tools/terraform-provider-stackitprivatepreview/stackit/internal/wait/sqlserverflexbeta"
+
+	"github.com/stackitcloud/stackit-sdk-go/services/sqlserverflex/v3beta1api"
 
 	"tf-provider.git.onstackit.cloud/stackit-dev-tools/terraform-provider-stackitprivatepreview/internal/testutils"
 	sqlserverflexbeta "tf-provider.git.onstackit.cloud/stackit-dev-tools/terraform-provider-stackitprivatepreview/stackit/internal/services/sqlserverflexbeta/instance"
@@ -20,7 +39,7 @@ import (
 	fwresource "github.com/hashicorp/terraform-plugin-framework/resource"
 )
 
-const providerPrefix = "stackitprivatepreview_sqlserverflexbeta"
+const pfx = "stackitprivatepreview_sqlserverflexbeta"
 
 func TestInstanceResourceSchema(t *testing.T) {
 	t.Parallel()
@@ -59,20 +78,20 @@ func testAccPreCheck(t *testing.T) {
 
 type resData struct {
 	ServiceAccountFilePath string
-	ProjectId              string
+	ProjectID              string
 	Region                 string
 	Name                   string
 	TfName                 string
-	FlavorId               string
+	FlavorID               string
 	BackupSchedule         string
 	UseEncryption          bool
-	KekKeyId               string
-	KekKeyRingId           string
+	KekKeyID               string
+	KekKeyRingID           string
 	KekKeyVersion          uint8
 	KekServiceAccount      string
 	PerformanceClass       string
 	Size                   uint32
-	AclString              string
+	ACLStrings             []string
 	AccessScope            string
 	RetentionDays          uint32
 	Version                string
@@ -82,37 +101,33 @@ type resData struct {
 
 type User struct {
 	Name      string
-	ProjectId string
+	ProjectID string
 	Roles     []string
 }
 
 type Database struct {
 	Name          string
-	ProjectId     string
+	ProjectID     string
 	Owner         string
 	Collation     string
 	Compatibility string
 }
 
-func resName(res, name string) string {
-	return fmt.Sprintf("%s_%s.%s", providerPrefix, res, name)
-}
-
 func getExample() resData {
 	name := acctest.RandomWithPrefix("tf-acc")
 	return resData{
 		Region:                 os.Getenv("TF_ACC_REGION"),
 		ServiceAccountFilePath: os.Getenv("TF_ACC_SERVICE_ACCOUNT_FILE"),
-		ProjectId:              os.Getenv("TF_ACC_PROJECT_ID"),
+		ProjectID:              os.Getenv("TF_ACC_PROJECT_ID"),
 		Name:                   name,
 		TfName:                 name,
-		FlavorId:               "4.16-Single",
+		FlavorID:               "4.16-Single",
 		BackupSchedule:         "0 0 * * *",
 		UseEncryption:          false,
 		RetentionDays:          33,
 		PerformanceClass:       "premium-perf2-stackit",
 		Size:                   10,
-		AclString:              "0.0.0.0/0",
+		ACLStrings:             []string{"0.0.0.0/0"},
 		AccessScope:            "PUBLIC",
 		Version:                "2022",
 	}
@@ -127,118 +142,160 @@ func TestAccInstance(t *testing.T) {
 	updSizeData := exData
 	updSizeData.Size = 25
 
+	testInstanceID := testutils.ResStr(pfx, "instance", exData.TfName)
+
+	compareValuesSame := statecheck.CompareValue(compare.ValuesSame())
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck: func() {
 			testAccPreCheck(t)
-			t.Logf("  ... working on instance %s", exData.TfName)
+			t.Logf("  ... %s - %s", t.Name(), exData.TfName)
 		},
+		CheckDestroy:             testAccCheckSQLServerFlexDestroy,
 		ProtoV6ProviderFactories: testutils.TestAccProtoV6ProviderFactories,
 		Steps: []resource.TestStep{
 			// Create and verify
 			{
+				PreConfig: func() {
+					t.Logf("testing: %s - %s", t.Name(), "create and verify")
+				},
+				ExpectNonEmptyPlan: true,
 				Config: testutils.StringFromTemplateMust(
 					"testdata/instance_template.gompl",
 					exData,
 				),
-				Check: resource.ComposeAggregateTestCheckFunc(
-					resource.TestCheckResourceAttr(resName("instance", exData.TfName), "name", exData.Name),
-					resource.TestCheckResourceAttrSet(resName("instance", exData.TfName), "id"),
-					// TODO: check all fields
-				),
+				ConfigStateChecks: []statecheck.StateCheck{
+					compareValuesSame.AddStateValue(
+						testInstanceID,
+						tfjsonpath.New("id"),
+					),
+					statecheck.ExpectKnownValue(
+						testInstanceID,
+						tfjsonpath.New("is_deletable"),
+						knownvalue.Bool(true),
+					),
+				},
+				Check: defaultNoEncInstanceTestChecks(testInstanceID, exData),
 			},
 			// Update name and verify
 			{
+				PreConfig: func() {
+					t.Logf("testing: %s - %s", t.Name(), "update name and verify")
+				},
+				ExpectNonEmptyPlan: true,
 				Config: testutils.StringFromTemplateMust(
 					"testdata/instance_template.gompl",
 					updNameData,
 				),
+				ConfigPlanChecks: resource.ConfigPlanChecks{
+					PreApply: []plancheck.PlanCheck{
+						plancheck.ExpectNonEmptyPlan(),
+					},
+				},
 				Check: resource.ComposeTestCheckFunc(
-					resource.TestCheckResourceAttr(resName("instance", exData.TfName), "name", updNameData.Name),
+					defaultNoEncInstanceTestChecks(testInstanceID, updNameData),
 				),
 			},
 			// Update size and verify
 			{
+				PreConfig: func() {
+					t.Logf("testing: %s - %s", t.Name(), "update storage.size and verify")
+				},
+				ExpectNonEmptyPlan: true,
 				Config: testutils.StringFromTemplateMust(
 					"testdata/instance_template.gompl",
 					updSizeData,
 				),
 				Check: resource.ComposeTestCheckFunc(
-					resource.TestCheckResourceAttr(
-						testutils.ResStr(providerPrefix, "instance", exData.TfName),
-						"storage.size",
-						strconv.Itoa(int(updSizeData.Size)),
-					),
+					defaultNoEncInstanceTestChecks(testInstanceID, updSizeData),
 				),
 			},
+			// Import test
+			// test instance imports
 			{
-				RefreshState: true,
+				PreConfig: func() {
+					t.Logf("testing: %s - %s", t.Name(), "import instance")
+				},
+				ResourceName: testInstanceID,
+				// ImportStateIdPrefix: "",
+				// ImportStateVerifyIdentifierAttribute: "id",
+				ImportStateIdFunc: getInstanceTestID(exData.TfName),
+				ImportStateKind:   resource.ImportCommandWithID,
+				ImportState:       true,
+				ImportStateVerify: true,
 			},
-			//// Import test
-			//{
-			//	ResourceName:      resName("instance", exData.TfName),
-			//	ImportState:       true,
-			//	ImportStateVerify: true,
-			// },
 		},
 	})
 }
 
 func TestAccInstanceReApply(t *testing.T) {
 	exData := getExample()
+	testInstanceID := testutils.ResStr(pfx, "instance", exData.TfName)
+	compareValuesSame := statecheck.CompareValue(compare.ValuesSame())
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck: func() {
 			testAccPreCheck(t)
-			t.Logf("  ... working on instance %s", exData.TfName)
+			t.Logf("  ... %s - %s", t.Name(), exData.TfName)
 		},
+		CheckDestroy:             testAccCheckSQLServerFlexDestroy,
 		ProtoV6ProviderFactories: testutils.TestAccProtoV6ProviderFactories,
 		Steps: []resource.TestStep{
 			// Create and verify
 			{
+				PreConfig: func() {
+					t.Logf("testing: %s - %s", t.Name(), "create and verify")
+				},
 				Config: testutils.StringFromTemplateMust(
 					"testdata/instance_template.gompl",
 					exData,
 				),
-				Check: resource.ComposeAggregateTestCheckFunc(
-					resource.TestCheckResourceAttr(resName("instance", exData.TfName), "name", exData.Name),
-					resource.TestCheckResourceAttrSet(resName("instance", exData.TfName), "id"),
-					// TODO: check all fields
-				),
+				ConfigStateChecks: []statecheck.StateCheck{
+					compareValuesSame.AddStateValue(
+						testInstanceID,
+						tfjsonpath.New("id"),
+					),
+					statecheck.ExpectKnownValue(
+						testInstanceID,
+						tfjsonpath.New("is_deletable"),
+						knownvalue.Bool(true),
+					),
+				},
+				Check: defaultNoEncInstanceTestChecks(testInstanceID, exData),
 			},
-			// Create and verify
+			// Second apply should not have changes
 			{
+				PreConfig: func() {
+					t.Logf("testing: %s - %s", t.Name(), "second apply")
+				},
+				ExpectNonEmptyPlan: false,
+				ResourceName:       testInstanceID,
 				Config: testutils.StringFromTemplateMust(
 					"testdata/instance_template.gompl",
 					exData,
 				),
-				Check: resource.ComposeAggregateTestCheckFunc(
-					resource.TestCheckResourceAttr(resName("instance", exData.TfName), "name", exData.Name),
-					resource.TestCheckResourceAttrSet(resName("instance", exData.TfName), "id"),
-					// TODO: check all fields
-				),
+				ConfigPlanChecks: resource.ConfigPlanChecks{
+					PreApply: []plancheck.PlanCheck{
+						plancheck.ExpectEmptyPlan(),
+					},
+				},
+				ConfigStateChecks: []statecheck.StateCheck{
+					compareValuesSame.AddStateValue(
+						testInstanceID,
+						tfjsonpath.New("id"),
+					),
+					statecheck.ExpectKnownValue(
+						testInstanceID,
+						tfjsonpath.New("is_deletable"),
+						knownvalue.Bool(true),
+					),
+				},
 			},
+			// Refresh state test
 			{
+				PreConfig: func() {
+					t.Logf("testing: %s - %s", t.Name(), "refresh state")
+				},
 				RefreshState: true,
 			},
-			// Create and verify
-			{
-				Config: testutils.StringFromTemplateMust(
-					"testdata/instance_template.gompl",
-					exData,
-				),
-				Check: resource.ComposeAggregateTestCheckFunc(
-					resource.TestCheckResourceAttr(resName("instance", exData.TfName), "name", exData.Name),
-					resource.TestCheckResourceAttrSet(resName("instance", exData.TfName), "id"),
-					// TODO: check all fields
-				),
-			},
-			// Import test
-			{
-				ResourceName:    resName("instance", exData.TfName),
-				ImportStateKind: resource.ImportBlockWithResourceIdentity,
-				ImportState:     true,
-				// ImportStateVerify is not supported with plannable import blocks
-				// ImportStateVerify: true,
-			},
 		},
 	})
 }
@@ -251,7 +308,7 @@ func TestAccInstanceNoEncryption(t *testing.T) {
 	data.Users = []User{
 		{
 			Name:      userName,
-			ProjectId: os.Getenv("TF_ACC_PROJECT_ID"),
+			ProjectID: os.Getenv("TF_ACC_PROJECT_ID"),
 			Roles: []string{
 				"##STACKIT_DatabaseManager##",
 				"##STACKIT_LoginManager##",
@@ -265,16 +322,19 @@ func TestAccInstanceNoEncryption(t *testing.T) {
 	data.Databases = []Database{
 		{
 			Name:      dbName,
-			ProjectId: os.Getenv("TF_ACC_PROJECT_ID"),
+			ProjectID: os.Getenv("TF_ACC_PROJECT_ID"),
 			Owner:     userName,
 		},
 	}
-
+	testInstanceID := testutils.ResStr(pfx, "instance", data.TfName)
+	testDatabaseID := testutils.ResStr(pfx, "database", dbName)
+	testUserID := testutils.ResStr(pfx, "user", userName)
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck: func() {
 			testAccPreCheck(t)
-			t.Logf("  ... working on instance %s", data.TfName)
+			t.Logf("  ... %s - %s", t.Name(), data.TfName)
 		},
+		CheckDestroy:             testAccCheckSQLServerFlexDestroy,
 		ProtoV6ProviderFactories: testutils.TestAccProtoV6ProviderFactories,
 		Steps: []resource.TestStep{
 			// Create and verify
@@ -284,62 +344,22 @@ func TestAccInstanceNoEncryption(t *testing.T) {
 					data,
 				),
 				Check: resource.ComposeAggregateTestCheckFunc(
-					// check instance values are set
-					resource.TestCheckResourceAttrSet(resName("instance", data.TfName), "id"),
-					resource.TestCheckResourceAttrSet(resName("instance", data.TfName), "backup_schedule"),
-					resource.TestCheckResourceAttrSet(resName("instance", data.TfName), "edition"),
-					resource.TestCheckResourceAttrSet(resName("instance", data.TfName), "flavor_id"),
-					resource.TestCheckResourceAttrSet(resName("instance", data.TfName), "instance_id"),
-					resource.TestCheckResourceAttrSet(resName("instance", data.TfName), "is_deletable"),
-					resource.TestCheckResourceAttrSet(resName("instance", data.TfName), "name"),
-					resource.TestCheckResourceAttrSet(resName("instance", data.TfName), "replicas"),
-					resource.TestCheckResourceAttrSet(resName("instance", data.TfName), "retention_days"),
-					resource.TestCheckResourceAttrSet(resName("instance", data.TfName), "status"),
-					resource.TestCheckResourceAttrSet(resName("instance", data.TfName), "version"),
-
-					resource.TestCheckNoResourceAttr(resName("instance", data.TfName), "encryption"),
-
-					// resource.TestCheckResourceAttrSet(resName("instance", data.TfName), "encryption"),
-					// resource.TestCheckResourceAttrSet(resName("instance", data.TfName), "encryption.kek_key_id"),
-					// resource.TestCheckResourceAttrSet(resName("instance", data.TfName), "encryption.kek_key_version"),
-					// resource.TestCheckResourceAttrSet(resName("instance", data.TfName), "encryption.kek_key_ring_id"),
-					// resource.TestCheckResourceAttrSet(resName("instance", data.TfName), "encryption.service_account"),
-
-					// resource.TestCheckResourceAttrSet(resName("instance", data.TfName), "network.access_scope"),
-					// resource.TestCheckResourceAttrSet(resName("instance", data.TfName), "network.acl"),
-
-					// resource.TestCheckResourceAttrSet(resName("instance", data.TfName), "network.instance_address"),
-					// resource.TestCheckResourceAttrSet(resName("instance", data.TfName), "network.router_address"),
-
-					// resource.TestCheckResourceAttrSet(resName("instance", data.TfName), "storage.class"),
-					// resource.TestCheckResourceAttrSet(resName("instance", data.TfName), "storage.size"),
-
-					// check instance values are correct
-					resource.TestCheckResourceAttr(resName("instance", data.TfName), "name", data.Name),
-
-					// check user values are set
-					resource.TestCheckResourceAttrSet(resName("user", userName), "id"),
-					resource.TestCheckResourceAttrSet(resName("user", userName), "username"),
-					// resource.TestCheckResourceAttrSet(resName("user", userName), "roles"),
-
-					// func(s *terraform.State) error {
-					//	return nil
-					// },
+					defaultNoEncInstanceTestChecks(testInstanceID, data),
 
 					// check user values are correct
-					resource.TestCheckResourceAttr(resName("user", userName), "username", userName),
-					resource.TestCheckResourceAttr(resName("user", userName), "roles.#", strconv.Itoa(len(data.Users[0].Roles))),
+					resource.TestCheckResourceAttr(testUserID, "username", userName),
+					resource.TestCheckResourceAttr(testUserID, "roles.#", strconv.Itoa(len(data.Users[0].Roles))),
 
 					// check database values are set
-					resource.TestCheckResourceAttrSet(resName("database", dbName), "id"),
-					resource.TestCheckResourceAttrSet(resName("database", dbName), "name"),
-					resource.TestCheckResourceAttrSet(resName("database", dbName), "owner"),
-					resource.TestCheckResourceAttrSet(resName("database", dbName), "compatibility"),
-					resource.TestCheckResourceAttrSet(resName("database", dbName), "collation"),
+					resource.TestCheckResourceAttrSet(testDatabaseID, "id"),
+					resource.TestCheckResourceAttrSet(testDatabaseID, "name"),
+					resource.TestCheckResourceAttrSet(testDatabaseID, "owner"),
+					resource.TestCheckResourceAttrSet(testDatabaseID, "compatibility"),
+					resource.TestCheckResourceAttrSet(testDatabaseID, "collation"),
 
 					// check database values are correct
-					resource.TestCheckResourceAttr(resName("database", dbName), "name", dbName),
-					resource.TestCheckResourceAttr(resName("database", dbName), "owner", userName),
+					resource.TestCheckResourceAttr(testDatabaseID, "name", dbName),
+					resource.TestCheckResourceAttr(testDatabaseID, "owner", userName),
 				),
 			},
 		},
@@ -354,29 +374,34 @@ func TestAccInstanceEncryption(t *testing.T) {
 	data.Users = []User{
 		{
 			Name:      userName,
-			ProjectId: os.Getenv("TF_ACC_PROJECT_ID"),
+			ProjectID: os.Getenv("TF_ACC_PROJECT_ID"),
 			Roles:     []string{"##STACKIT_DatabaseManager##", "##STACKIT_LoginManager##"},
 		},
 	}
 	data.Databases = []Database{
 		{
 			Name:      dbName,
-			ProjectId: os.Getenv("TF_ACC_PROJECT_ID"),
+			ProjectID: os.Getenv("TF_ACC_PROJECT_ID"),
 			Owner:     userName,
 		},
 	}
 
 	data.UseEncryption = true
-	data.KekKeyId = "fe039bcf-8d7b-431a-801d-9e81371a6b7b"
-	data.KekKeyRingId = "6a2d95ab-3c4c-4963-a2bb-08d17a320e27"
+	data.KekKeyID = "fe039bcf-8d7b-431a-801d-9e81371a6b7b"
+	data.KekKeyRingID = "6a2d95ab-3c4c-4963-a2bb-08d17a320e27"
 	data.KekKeyVersion = 1
 	data.KekServiceAccount = "henselinm-u2v3ex1@sa.stackit.cloud"
 
+	testInstanceID := testutils.ResStr(pfx, "instance", data.TfName)
+	testDatabaseID := testutils.ResStr(pfx, "database", dbName)
+	testUserID := testutils.ResStr(pfx, "user", userName)
+
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck: func() {
 			testAccPreCheck(t)
-			t.Logf("  ... working on instance %s", data.TfName)
+			t.Logf("  ... %s - %s", t.Name(), data.TfName)
 		},
+		CheckDestroy:             testAccCheckSQLServerFlexDestroy,
 		ProtoV6ProviderFactories: testutils.TestAccProtoV6ProviderFactories,
 		Steps: []resource.TestStep{
 			// Create and verify
@@ -386,61 +411,296 @@ func TestAccInstanceEncryption(t *testing.T) {
 					data,
 				),
 				Check: resource.ComposeAggregateTestCheckFunc(
-					// check instance values are set
-					resource.TestCheckResourceAttrSet(resName("instance", data.TfName), "id"),
-					resource.TestCheckResourceAttrSet(resName("instance", data.TfName), "backup_schedule"),
-					resource.TestCheckResourceAttrSet(resName("instance", data.TfName), "edition"),
-					resource.TestCheckResourceAttrSet(resName("instance", data.TfName), "flavor_id"),
-					resource.TestCheckResourceAttrSet(resName("instance", data.TfName), "instance_id"),
-					resource.TestCheckResourceAttrSet(resName("instance", data.TfName), "is_deletable"),
-					resource.TestCheckResourceAttrSet(resName("instance", data.TfName), "name"),
-					resource.TestCheckResourceAttrSet(resName("instance", data.TfName), "replicas"),
-					resource.TestCheckResourceAttrSet(resName("instance", data.TfName), "retention_days"),
-					resource.TestCheckResourceAttrSet(resName("instance", data.TfName), "status"),
-					resource.TestCheckResourceAttrSet(resName("instance", data.TfName), "version"),
-
-					// resource.TestCheckResourceAttrSet(resName("instance", data.TfName), "encryption"),
-					// resource.TestCheckResourceAttrSet(resName("instance", data.TfName), "encryption.kek_key_id"),
-					// resource.TestCheckResourceAttrSet(resName("instance", data.TfName), "encryption.kek_key_version"),
-					// resource.TestCheckResourceAttrSet(resName("instance", data.TfName), "encryption.kek_key_ring_id"),
-					// resource.TestCheckResourceAttrSet(resName("instance", data.TfName), "encryption.service_account"),
-
-					// resource.TestCheckResourceAttrSet(resName("instance", data.TfName), "network.access_scope"),
-					// resource.TestCheckResourceAttrSet(resName("instance", data.TfName), "network.acl"),
-
-					// resource.TestCheckResourceAttrSet(resName("instance", data.TfName), "network.instance_address"),
-					// resource.TestCheckResourceAttrSet(resName("instance", data.TfName), "network.router_address"),
-
-					// resource.TestCheckResourceAttrSet(resName("instance", data.TfName), "storage.class"),
-					// resource.TestCheckResourceAttrSet(resName("instance", data.TfName), "storage.size"),
-
-					// check instance values are correct
-					resource.TestCheckResourceAttr(resName("instance", data.TfName), "name", data.Name),
+					defaultEncInstanceTestChecks(testInstanceID, data),
 
 					// check user values are set
-					resource.TestCheckResourceAttrSet(resName("user", userName), "id"),
-					resource.TestCheckResourceAttrSet(resName("user", userName), "username"),
+					resource.TestCheckResourceAttrSet(testUserID, "id"),
+					resource.TestCheckResourceAttrSet(testUserID, "username"),
 
 					// func(s *terraform.State) error {
 					//	return nil
 					// },
 
 					// check user values are correct
-					resource.TestCheckResourceAttr(resName("user", userName), "username", userName),
-					resource.TestCheckResourceAttr(resName("user", userName), "roles.#", "2"),
+					resource.TestCheckResourceAttr(testUserID, "username", userName),
+					resource.TestCheckResourceAttr(testUserID, "roles.#", "2"),
 
 					// check database values are set
-					resource.TestCheckResourceAttrSet(resName("database", dbName), "id"),
-					resource.TestCheckResourceAttrSet(resName("database", dbName), "name"),
-					resource.TestCheckResourceAttrSet(resName("database", dbName), "owner"),
-					resource.TestCheckResourceAttrSet(resName("database", dbName), "compatibility"),
-					resource.TestCheckResourceAttrSet(resName("database", dbName), "collation"),
+					resource.TestCheckResourceAttrSet(testDatabaseID, "id"),
+					resource.TestCheckResourceAttrSet(testDatabaseID, "name"),
+					resource.TestCheckResourceAttrSet(testDatabaseID, "owner"),
+					resource.TestCheckResourceAttrSet(testDatabaseID, "compatibility"),
+					resource.TestCheckResourceAttrSet(testDatabaseID, "collation"),
 
 					// check database values are correct
-					resource.TestCheckResourceAttr(resName("database", dbName), "name", dbName),
-					resource.TestCheckResourceAttr(resName("database", dbName), "owner", userName),
+					resource.TestCheckResourceAttr(testDatabaseID, "name", dbName),
+					resource.TestCheckResourceAttr(testDatabaseID, "owner", userName),
 				),
 			},
 		},
 	})
 }
+
+func defaultNoEncInstanceTestChecks(testItemID string, data resData) resource.TestCheckFunc {
+	return resource.ComposeAggregateTestCheckFunc(
+		defaultInstanceTestChecks(testItemID, data),
+
+		// check absent attr
+		resource.TestCheckNoResourceAttr(testItemID, "encryption"),
+		resource.TestCheckNoResourceAttr(testItemID, "encryption.kek_key_id"),
+		resource.TestCheckNoResourceAttr(testItemID, "encryption.kek_key_ring_id"),
+		resource.TestCheckNoResourceAttr(testItemID, "encryption.kek_key_version"),
+		resource.TestCheckNoResourceAttr(testItemID, "encryption.service_account"),
+	)
+}
+
+func defaultEncInstanceTestChecks(testItemID string, data resData) resource.TestCheckFunc {
+	return resource.ComposeAggregateTestCheckFunc(
+		defaultInstanceTestChecks(testItemID, data),
+
+		// check absent attr
+		resource.TestCheckResourceAttr(testItemID, "encryption.%", "4"),
+		resource.TestCheckResourceAttrSet(testItemID, "encryption.kek_key_id"),
+		resource.TestCheckResourceAttr(testItemID, "encryption.kek_key_id", data.KekKeyID),
+		resource.TestCheckResourceAttrSet(testItemID, "encryption.kek_key_ring_id"),
+		resource.TestCheckResourceAttr(testItemID, "encryption.kek_key_ring_id", data.KekKeyRingID),
+		resource.TestCheckResourceAttrSet(testItemID, "encryption.kek_key_version"),
+		resource.TestCheckResourceAttr(testItemID, "encryption.kek_key_version", strconv.Itoa(int(data.KekKeyVersion))),
+		resource.TestCheckResourceAttrSet(testItemID, "encryption.service_account"),
+		resource.TestCheckResourceAttr(testItemID, "encryption.service_account", data.KekServiceAccount),
+	)
+}
+
+func defaultInstanceTestChecks(testItemID string, data resData) resource.TestCheckFunc {
+	// if AccessScope == SNA these are set
+	if data.AccessScope == "SNA" {
+		return resource.ComposeAggregateTestCheckFunc(
+			basicInstanceTestChecks(testItemID, data),
+			resource.TestCheckResourceAttrSet(testItemID, "network.instance_address"),
+			resource.TestCheckResourceAttrSet(testItemID, "network.router_address"),
+		)
+	}
+
+	// if AccessScope == PUBLIC these are empty - but they are set
+	return resource.ComposeAggregateTestCheckFunc(
+		basicInstanceTestChecks(testItemID, data),
+		resource.TestCheckResourceAttr(testItemID, "network.instance_address", ""),
+		resource.TestCheckResourceAttr(testItemID, "network.router_address", ""),
+	)
+}
+
+func basicInstanceTestChecks(testItemID string, data resData) resource.TestCheckFunc {
+	return resource.ComposeAggregateTestCheckFunc(
+		resource.TestCheckResourceAttrSet(testItemID, "backup_schedule"),
+		resource.TestCheckResourceAttr(testItemID, "backup_schedule", data.BackupSchedule),
+
+		resource.TestCheckResourceAttrSet(testItemID, "flavor_id"),
+		resource.TestCheckResourceAttr(testItemID, "flavor_id", data.FlavorID),
+
+		resource.TestCheckResourceAttrSet(testItemID, "id"),
+		resource.TestCheckResourceAttrSet(testItemID, "instance_id"),
+
+		resource.TestCheckResourceAttrSet(testItemID, "edition"),
+
+		resource.TestCheckResourceAttrSet(testItemID, "is_deletable"),
+		resource.TestCheckResourceAttr(testItemID, "is_deletable", "true"),
+
+		resource.TestCheckResourceAttrSet(testItemID, "name"),
+		resource.TestCheckResourceAttr(testItemID, "name", data.Name),
+
+		// network params check
+		resource.TestCheckResourceAttr(testItemID, "network.%", "4"),
+		resource.TestCheckResourceAttrSet(testItemID, "network.access_scope"),
+		resource.TestCheckResourceAttr(testItemID, "network.access_scope", data.AccessScope),
+		// resource.TestCheckResourceAttrSet(testItemID, "network.acl"),
+		resource.TestCheckResourceAttr(testItemID, "network.acl.#", strconv.Itoa(len(data.ACLStrings))),
+		// instance_address and router_address are only checked in enc
+
+		resource.TestCheckResourceAttrSet(testItemID, "project_id"),
+		resource.TestCheckResourceAttr(testItemID, "project_id", data.ProjectID),
+
+		resource.TestCheckResourceAttrSet(testItemID, "region"),
+		resource.TestCheckResourceAttr(testItemID, "region", data.Region),
+
+		resource.TestCheckResourceAttrSet(testItemID, "retention_days"),
+		resource.TestCheckResourceAttr(testItemID, "retention_days", strconv.Itoa(int(data.RetentionDays))),
+
+		resource.TestCheckResourceAttrSet(testItemID, "status"),
+		resource.TestCheckResourceAttr(testItemID, "status", "READY"),
+
+		// storage params check
+		resource.TestCheckResourceAttr(testItemID, "storage.%", "2"),
+		resource.TestCheckResourceAttrSet(testItemID, "storage.class"),
+		resource.TestCheckResourceAttr(testItemID, "storage.class", data.PerformanceClass),
+		resource.TestCheckResourceAttrSet(testItemID, "storage.size"),
+		resource.TestCheckResourceAttr(testItemID, "storage.size", strconv.Itoa(int(data.Size))),
+
+		resource.TestCheckResourceAttrSet(testItemID, "version"),
+		resource.TestCheckResourceAttr(testItemID, "version", data.Version),
+	)
+}
+
+func getInstanceTestID(name string) func(s *terraform.State) (string, error) {
+	return func(s *terraform.State) (string, error) {
+		r, ok := s.RootModule().Resources[testutils.ResStr(pfx, "instance", name)]
+		if !ok {
+			return "", fmt.Errorf("couldn't find resource stackitprivatepreview_postgresflexalpha_instance.%s", name)
+		}
+		projectID, ok := r.Primary.Attributes["project_id"]
+		if !ok {
+			return "", fmt.Errorf("couldn't find attribute project_id")
+		}
+		region, ok := r.Primary.Attributes["region"]
+		if !ok {
+			return "", fmt.Errorf("couldn't find attribute region")
+		}
+		instanceID, ok := r.Primary.Attributes["instance_id"]
+		if !ok {
+			return "", fmt.Errorf("couldn't find attribute instance_id")
+		}
+		return fmt.Sprintf("%s,%s,%s", projectID, region, instanceID), nil
+	}
+}
+
+/*
+	func getDatabaseTestID(name string) func(s *terraform.State) (string, error) {
+		return func(s *terraform.State) (string, error) {
+			r, ok := s.RootModule().Resources[testutils.ResStr(pfx, "database", name)]
+			if !ok {
+				return "", fmt.Errorf("couldn't find resource stackitprivatepreview_postgresflexalpha_instance.%s", name)
+			}
+			projectID, ok := r.Primary.Attributes["project_id"]
+			if !ok {
+				return "", fmt.Errorf("couldn't find attribute project_id")
+			}
+			region, ok := r.Primary.Attributes["region"]
+			if !ok {
+				return "", fmt.Errorf("couldn't find attribute region")
+			}
+			instanceID, ok := r.Primary.Attributes["instance_id"]
+			if !ok {
+				return "", fmt.Errorf("couldn't find attribute instance_id")
+			}
+			databaseID, ok := r.Primary.Attributes["database_id"]
+			if !ok {
+				return "", fmt.Errorf("couldn't find attribute database_id")
+			}
+			return fmt.Sprintf("%s,%s,%s,%s", projectID, region, instanceID, databaseID), nil
+		}
+	}
+
+	func getUserTestID(name string) func(s *terraform.State) (string, error) {
+		return func(s *terraform.State) (string, error) {
+			r, ok := s.RootModule().Resources[testutils.ResStr(pfx, "user", name)]
+			if !ok {
+				return "", fmt.Errorf("couldn't find resource stackitprivatepreview_postgresflexalpha_instance.%s", name)
+			}
+			projectID, ok := r.Primary.Attributes["project_id"]
+			if !ok {
+				return "", fmt.Errorf("couldn't find attribute project_id")
+			}
+			region, ok := r.Primary.Attributes["region"]
+			if !ok {
+				return "", fmt.Errorf("couldn't find attribute region")
+			}
+			instanceID, ok := r.Primary.Attributes["instance_id"]
+			if !ok {
+				return "", fmt.Errorf("couldn't find attribute instance_id")
+			}
+			userID, ok := r.Primary.Attributes["user_id"]
+			if !ok {
+				return "", fmt.Errorf("couldn't find attribute user_id")
+			}
+			return fmt.Sprintf("%s,%s,%s,%s", projectID, region, instanceID, userID), nil
+		}
+	}
+*/
+func testAccCheckSQLServerFlexDestroy(s *terraform.State) error {
+	testutils.Setup()
+
+	pID, ok := os.LookupEnv("TF_ACC_PROJECT_ID")
+	if !ok {
+		log.Fatalln("unable to read TF_ACC_PROJECT_ID")
+	}
+
+	ctx := context.Background()
+	var client *v3beta1api.APIClient
+	var err error
+
+	var region, projectID string
+	region = testutils.Region
+	if region == "" {
+		region = "eu01"
+	}
+
+	projectID = pID
+	if projectID == "" {
+		return fmt.Errorf("projectID could not be determined in destroy function")
+	}
+
+	apiClientConfigOptions := []config.ConfigurationOption{
+		config.WithServiceAccountKeyPath(os.Getenv("TF_ACC_SERVICE_ACCOUNT_FILE")),
+		config.WithRegion(region),
+	}
+	if testutils.PostgresFlexCustomEndpoint != "" {
+		apiClientConfigOptions = append(
+			apiClientConfigOptions,
+			config.WithEndpoint(testutils.PostgresFlexCustomEndpoint),
+		)
+	}
+	client, err = v3beta1api.NewAPIClient(apiClientConfigOptions...)
+	if err != nil {
+		log.Fatalln(err)
+	}
+
+	instancesToDestroy := []string{}
+	for _, rs := range s.RootModule().Resources {
+		if rs.Type != "stackitprivatepreview_postgresflexalpha_instance" &&
+			rs.Type != "stackitprivatepreview_postgresflexbeta_instance" {
+			continue
+		}
+
+		// instance terraform ID: = "[project_id],[region],[instance_id]"
+		instanceID := strings.Split(rs.Primary.ID, core.Separator)[2]
+		instancesToDestroy = append(instancesToDestroy, instanceID)
+	}
+
+	instancesResp, err := client.DefaultAPI.ListInstancesRequest(ctx, projectID, region).
+		Size(100).
+		Execute()
+	if err != nil {
+		return fmt.Errorf("getting instancesResp: %w", err)
+	}
+
+	items := instancesResp.GetInstances()
+	for i := range items {
+		if items[i].Id == "" {
+			continue
+		}
+		if utils.Contains(instancesToDestroy, items[i].Id) {
+			err := client.DefaultAPI.DeleteInstanceRequest(ctx, projectID, region, items[i].Id).Execute()
+			if err != nil {
+				return fmt.Errorf("deleting instance %s during CheckDestroy: %w", items[i].Id, err)
+			}
+			w := wait.DeleteInstanceWaitHandler(
+				ctx,
+				client.DefaultAPI,
+				testutils.ProjectId,
+				testutils.Region,
+				items[i].Id,
+			)
+			_, waitErr := w.SetTimeout(90 * time.Second).WaitWithContext(context.Background())
+			if waitErr != nil {
+				var oapiErr *oapierror.GenericOpenAPIError
+				isOapiErr := errors.As(waitErr, &oapiErr)
+				if !isOapiErr {
+					return fmt.Errorf("could not convert error to oapierror.GenericOpenAPIError")
+				}
+				if oapiErr.StatusCode != http.StatusNotFound {
+					return waitErr
+				}
+			}
+		}
+	}
+	return nil
+}

stackit/internal/services/sqlserverflexbeta/testdata/instance_template.gompl

@@ -4,35 +4,37 @@ provider "stackitprivatepreview" {
 }
 
 resource "stackitprivatepreview_sqlserverflexbeta_instance" "{{ .TfName }}" {
-  project_id      = "{{ .ProjectId }}"
+  project_id      = "{{ .ProjectID }}"
   name            = "{{ .Name }}"
   backup_schedule = "{{ .BackupSchedule }}"
   retention_days  = {{ .RetentionDays }}
-  flavor_id       = "{{ .FlavorId }}"
+  flavor_id       = "{{ .FlavorID }}"
   storage = {
     class = "{{ .PerformanceClass }}"
     size              = {{ .Size }}
   }
 {{ if .UseEncryption }}
   encryption = {
-    kek_key_id      = "{{ .KekKeyId }}"
-    kek_key_ring_id = "{{ .KekKeyRingId }}"
+    kek_key_id      = "{{ .KekKeyID }}"
+    kek_key_ring_id = "{{ .KekKeyRingID }}"
     kek_key_version = {{ .KekKeyVersion }}
     service_account = "{{ .KekServiceAccount }}"
   }
 {{ end }}
   network = {
-    acl          = ["{{ .AclString }}"]
+    acl          = [{{ range $i, $v := .ACLStrings }}{{if $i}},{{end}}"{{$v}}"{{end}}]
     access_scope = "{{ .AccessScope }}"
   }
+{{ if .Version }}
   version = "{{ .Version }}"
+{{ end }}
 }
 
 {{ if .Users }}
 {{ $tfName := .TfName }}
 {{ range $user := .Users }}
 resource "stackitprivatepreview_sqlserverflexbeta_user" "{{ $user.Name }}" {
-  project_id  = "{{ $user.ProjectId }}"
+  project_id  = "{{ $user.ProjectID }}"
   instance_id = stackitprivatepreview_sqlserverflexbeta_instance.{{ $tfName }}.instance_id
   username    = "{{ $user.Name }}"
   roles       = [{{ range $i, $v := $user.Roles }}{{if $i}},{{end}}"{{$v}}"{{end}}]
@@ -45,7 +47,7 @@ resource "stackitprivatepreview_sqlserverflexbeta_user" "{{ $user.Name }}" {
 {{ range $db := .Databases }}
 resource "stackitprivatepreview_sqlserverflexbeta_database" "{{ $db.Name }}" {
   depends_on = [stackitprivatepreview_sqlserverflexbeta_user.{{ $db.Owner }}]
-  project_id    = "{{ $db.ProjectId }}"
+  project_id    = "{{ $db.ProjectID }}"
   instance_id   = stackitprivatepreview_sqlserverflexbeta_instance.{{ $tfName }}.instance_id
   name          = "{{ $db.Name }}"
   owner         = "{{ $db.Owner }}"