No error thrown for unexpected attributes inside nested attributes

[maastha]

Module version

github.com/hashicorp/terraform-plugin-framework v1.15.1

Relevant provider source code

...

Terraform Configuration Files

terraform {
  required_providers {
    mongodbatlas = {
      source  = "mongodb/mongodbatlas"
      version = "1.39.0"
    }
  }
  required_version = ">= 1.0"
}

resource "mongodbatlas_project" "test" {
  name   = "tf-sharded-repro-project-sdkv2"
  org_id = "...."
}

resource "mongodbatlas_stream_instance" "example" {
  project_id     = mongodbatlas_project.test.id
  instance_name = "InstanceName"
  data_process_region = {
    region         = "VIRGINIA_USA"
    cloud_provider = "AWS"
  }
}


resource "mongodbatlas_stream_connection" "example-kafka-plaintext" {
  project_id     = mongodbatlas_project.test.id
  instance_name   = mongodbatlas_stream_instance.example.instance_name
  connection_name = "KafkaPlaintextConnection"
  type            = "Kafka"
  authentication = {
    mechanism = "PLAIN"
    username  = "kafka_username1"
    password  = "kafka_password"
  }
  bootstrap_servers = "localhost:9092,localhost:9092"
  config = {
    "auto.offset.reset" : "earliest"
  }
  security = {
    protocol = "SASL_PLAINTEXT"
  }
  networking = {
    access = {
      type = "PUBLIC"
      xxx = "does not exist"   # this attribute does not exist in the schema
    }
  }
}

Debug Output

Expected Behavior

terraform plan should have thrown an error like "An argument named "xxx" is not expected here." for mongodbatlas_stream_connection resource.

Actual Behavior

terraform plan succeeds & ignores any changes to xxx attribute. If such an attribute is added at the root level of the resource, then Terraform does throw this error but not if the unexpected attribute is inside a nested attribute.

Steps to Reproduce

1. terraform init
2. terraform apply -> succeeds
3. add an unexpected attribute at root level in any resource implemented with Terraform plugin framework such as:

resource "mongodbatlas_project" "test" {
  name   = "tf-sharded-repro-project-sdkv2"
  org_id = "....."
  xxx    = "does not exist"  
}

4. terraform apply -> throws error "An argument named "xxx" is not expected here."

References

[austinvalle]

Hey there @maastha 👋🏻 , this is a duplicate of #1121 and #805 (comment) which have some more details, but I'll put a general note here as well.

Terraform doesn't actually send extra attributes to providers in the protocol, so there's nothing we can do in terraform-plugin-framework to raise an error as the xxx attribute is filtered out well before we receive it.

The Terraform core issue to track is: hashicorp/terraform#33570 , although the actual change to support something like this would likely be at the HCL/type system level since it's a design choice and not necessarily a bug, so I'm not sure there is much traction to adjust that behavior ATM.