SQL Server User Resource Triggers Modify Without Configuration Changes

sven.schmidt commented

2026-02-16 07:15:24 +00:00

Description

When managing a SQL Server user via the STACKIT Terraform provider, running terraform apply without any configuration changes still results in a modify operation on the resource.

The SQL Server user resource is not behaving idempotently. Even though no attributes were changed in the Terraform configuration, the provider detects a difference and triggers an update.

This leads to unnecessary modifications and may cause state inconsistencies or follow-up errors.

Steps to reproduce

resource "stackitprivatepreview_sqlserverflexbeta_user" "testUser" {
  project_id  = var.tcc_project_id
  instance_id = data.terraform_remote_state.infra_db.outputs.sqlserver_instance_id
  username    = "testuser"
  roles = ["##STACKIT_DatabaseManager##",
    "##STACKIT_LoginManager##",
    "##STACKIT_ProcessManager##",
    "##STACKIT_ServerManager##",
    "##STACKIT_SQLAgentManager##",
    "##STACKIT_SQLAgentUser##",
  ]
}

Run terraform ...

Actual behavior

Please describe the current behavior of the STACKIT Terraform provider. Don't forget to add detailed information like error messages.

stackitprivatepreview_postgresflexalpha_database.testDB: Creation complete after 16s [name=testdb]
╷
│ Error: Error updating user
│ 
│   with stackitprivatepreview_sqlserverflexbeta_user.testUser,
│   on 03-create-user-db-sql.tf line 7, in resource "stackitprivatepreview_sqlserverflexbeta_user" "testUser":
│    7: resource "stackitprivatepreview_sqlserverflexbeta_user" "testUser" {
│ 
│ User can't be updated
╵
::error::Terraform exited with code 1.




  # stackitprivatepreview_sqlserverflexbeta_user.testUser will be updated in-place
  ~ resource "stackitprivatepreview_sqlserverflexbeta_user" "testUser" {
      + default_database = (known after apply)
      ~ host             = "e5c5af15-d2c9-41bd-8523-77e0b96990f1.sqlserver.***.onstackit.cloud" -> (known after apply)
        id               = 274
      ~ port             = 1433 -> (known after apply)
      ~ roles            = [
          - "##STACKIT_SQLAgentManager##",
          - "##STACKIT_SQLAgentUser##",
            "##STACKIT_DatabaseManager##",
            # (2 unchanged elements hidden)
            "##STACKIT_ServerManager##",
          + "##STACKIT_SQLAgentManager##",
          + "##STACKIT_SQLAgentUser##",
        ]
        # (8 unchanged attributes hidden)
    }
Plan: 2 to add, 1 to change, 0 to destroy.

Expected behavior

Please describe the behavior which you would expect from the STACKIT Terraform provider in that case.

Terraform detects a change in the SQL Server user resource and attempts to modify it, even though no configuration changes were made.

## Description When managing a SQL Server user via the STACKIT Terraform provider, running terraform apply without any configuration changes still results in a modify operation on the resource. The SQL Server user resource is not behaving idempotently. Even though no attributes were changed in the Terraform configuration, the provider detects a difference and triggers an update. This leads to unnecessary modifications and may cause state inconsistencies or follow-up errors. ## Steps to reproduce ```terraform resource "stackitprivatepreview_sqlserverflexbeta_user" "testUser" { project_id = var.tcc_project_id instance_id = data.terraform_remote_state.infra_db.outputs.sqlserver_instance_id username = "testuser" roles = ["##STACKIT_DatabaseManager##", "##STACKIT_LoginManager##", "##STACKIT_ProcessManager##", "##STACKIT_ServerManager##", "##STACKIT_SQLAgentManager##", "##STACKIT_SQLAgentUser##", ] } ```  1. Run `terraform ...` ## Actual behavior *Please describe the current behavior of the STACKIT Terraform provider. Don't forget to add detailed information like error messages.* ```terraform stackitprivatepreview_postgresflexalpha_database.testDB: Creation complete after 16s [name=testdb] ╷ │ Error: Error updating user │ │ with stackitprivatepreview_sqlserverflexbeta_user.testUser, │ on 03-create-user-db-sql.tf line 7, in resource "stackitprivatepreview_sqlserverflexbeta_user" "testUser": │ 7: resource "stackitprivatepreview_sqlserverflexbeta_user" "testUser" { │ │ User can't be updated ╵ ::error::Terraform exited with code 1. # stackitprivatepreview_sqlserverflexbeta_user.testUser will be updated in-place ~ resource "stackitprivatepreview_sqlserverflexbeta_user" "testUser" { + default_database = (known after apply) ~ host = "e5c5af15-d2c9-41bd-8523-77e0b96990f1.sqlserver.***.onstackit.cloud" -> (known after apply) id = 274 ~ port = 1433 -> (known after apply) ~ roles = [ - "##STACKIT_SQLAgentManager##", - "##STACKIT_SQLAgentUser##", "##STACKIT_DatabaseManager##", # (2 unchanged elements hidden) "##STACKIT_ServerManager##", + "##STACKIT_SQLAgentManager##", + "##STACKIT_SQLAgentUser##", ] # (8 unchanged attributes hidden) } Plan: 2 to add, 1 to change, 0 to destroy. ``` ## Expected behavior *Please describe the behavior which you would expect from the STACKIT Terraform provider in that case.* Terraform detects a change in the SQL Server user resource and attempts to modify it, even though no configuration changes were made.

marcel.henselin commented

2026-02-16 07:17:15 +00:00

Owner

implement a sorting og roles:

when writing state
reading a resource and returning state

implement a sorting og roles: * when writing state * reading a resource and returning state

marcel.henselin self-assigned this 2026-02-16 07:37:33 +00:00

marcel.henselin referenced this issue from a pull request that will close it,

2026-02-16 09:03:16 +00:00

fix: #63 sort user roles to prevent state change #65

marcel.henselin referenced this issue from a commit

2026-02-16 09:04:18 +00:00

fix: #63 sort user roles to prevent state change (#65)

marcel.henselin closed this issue

2026-02-16 09:04:18 +00:00

sven.schmidt commented

2026-02-16 11:17:47 +00:00

Author

Not fixed - same behaviour occurs with tf alpha provider version 0.0.17-alpha

terraform apply
data.terraform_remote_state.infra_db: Reading...
data.terraform_remote_state.infra_db: Read complete after 0s
stackitprivatepreview_sqlserverflexbeta_user.testUser: Refreshing state...
stackitprivatepreview_sqlserverflexbeta_database.testDB: Refreshing state... [name=testdb]

Terraform used the selected providers to generate the following execution plan. Resource actions are
indicated with the following symbols:
  ~ update in-place

Terraform will perform the following actions:

  # stackitprivatepreview_sqlserverflexbeta_user.testUser will be updated in-place
  ~ resource "stackitprivatepreview_sqlserverflexbeta_user" "testUser" {
      + default_database = (known after apply)
      ~ host             = "b9b63364-966a-474f-bc34-23b5e571210e.sqlserver.eu01.onstackit.cloud" -> (known after apply)
        id               = 267
      ~ port             = 1433 -> (known after apply)
      ~ roles            = [
            # (2 unchanged elements hidden)
            "##STACKIT_ProcessManager##",
          + "##STACKIT_ServerManager##",
            "##STACKIT_SQLAgentManager##",
            "##STACKIT_SQLAgentUser##",
          - "##STACKIT_ServerManager##",
        ]
        # (8 unchanged attributes hidden)
    }

Plan: 0 to add, 1 to change, 0 to destroy.

Do you want to perform these actions?
  Terraform will perform the actions described above.
  Only 'yes' will be accepted to approve.

  Enter a value: ^[^C

Interrupt received.
Please wait for Terraform to exit or data loss may occur.
Gracefully shutting down...

╷
│ Error: error asking for approval: interrupted
│ 
│ 
╵

Not fixed - same behaviour occurs with tf alpha provider version 0.0.17-alpha ```terraform terraform apply data.terraform_remote_state.infra_db: Reading... data.terraform_remote_state.infra_db: Read complete after 0s stackitprivatepreview_sqlserverflexbeta_user.testUser: Refreshing state... stackitprivatepreview_sqlserverflexbeta_database.testDB: Refreshing state... [name=testdb] Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols: ~ update in-place Terraform will perform the following actions: # stackitprivatepreview_sqlserverflexbeta_user.testUser will be updated in-place ~ resource "stackitprivatepreview_sqlserverflexbeta_user" "testUser" { + default_database = (known after apply) ~ host = "b9b63364-966a-474f-bc34-23b5e571210e.sqlserver.eu01.onstackit.cloud" -> (known after apply) id = 267 ~ port = 1433 -> (known after apply) ~ roles = [ # (2 unchanged elements hidden) "##STACKIT_ProcessManager##", + "##STACKIT_ServerManager##", "##STACKIT_SQLAgentManager##", "##STACKIT_SQLAgentUser##", - "##STACKIT_ServerManager##", ] # (8 unchanged attributes hidden) } Plan: 0 to add, 1 to change, 0 to destroy. Do you want to perform these actions? Terraform will perform the actions described above. Only 'yes' will be accepted to approve. Enter a value: ^[^C Interrupt received. Please wait for Terraform to exit or data loss may occur. Gracefully shutting down... ╷ │ Error: error asking for approval: interrupted │ │ ╵ ```

sven.schmidt reopened this issue