Updating existing `tfe_variable` generates error with Terraform version < 1.12

[jakevictor]

Terraform Enterprise version

Terraform Enterprise 1.0.3

Terraform version

Terraform v1.11.4
on darwin_arm64
+ provider registry.terraform.io/hashicorp/tfe v0.74.0

Your version of Terraform is out of date! The latest version
is 1.14.5. You can update by downloading from https://developer.hashicorp.com/terraform/install

Terraform Configuration Files

terraform {
  required_providers {
    tfe = {
      source  = "hashicorp/tfe"
      version = "0.74.0"
    }
  }
}

resource "tfe_workspace" "test" {
  name              = "tfe_var_test"
  terraform_version = "1.11.4"
}

resource "tfe_variable" "test" {
  workspace_id = tfe_workspace.test.id
  category     = "terraform"
  key          = "test"
  value        = timestamp()
}

TFE_HOSTNAME, TFE_ORGANIZATION, and TFE_TOKEN are set as environment variables.

Debug Output

I can provide this separately if needed. I'd need to check whether anything needs to be redacted.

Expected Behavior

The first terraform apply should create the variable successfully.

The second terraform apply should update the variable successfully.

Actual Behavior

The first terraform apply creates the variable successfully.

The second terraform apply fails with the following error:

tfe_variable.test: Modifying... [id=var-reWQkJw3ZcQnxTK7]
╷
│ Error: Missing Resource Identity After Update
│ 
│   with tfe_variable.test,
│   on main.tf line 15, in resource "tfe_variable" "test":
│   15: resource "tfe_variable" "test" {
│ 
│ The Terraform Provider unexpectedly returned no resource identity data after having no errors in the resource update. This is always an
│ issue in the Terraform Provider and should be reported to the provider developers.

Additional Context

The error doesn't seem to occur with version 0.73.0 of the provider, or with Terraform version 1.12.0 or later.

[chrisc96]

We are also facing this issue on v1.5.0 after upgrading to v0.0.74 over the weekend.

After inspecting the state changes, it does appear that the tfe_variable values are being updated, and successive re-runs work fine.

[sebasslash]

Hi! Thanks for reporting this bug, looking into this 👍

[sebasslash]

👋 I've identified a fix for this issue and it should be available in either v0.74.1 or v0.75.0 :)

[jakevictor]

Thanks for taking a look, @sebasslash!
I took a peek at your PR and just want to clarify that I don't think I ever used -refresh=false in my scenario.

[sebasslash]

It wasn't immediately evident why the error was occurring, as Terraform <1.12 should ignore null resource identities. You get null resource identities when you are using Terraform <1.12 (which don't support resource identities) against provider versions that have an identity schema defined for a particular resource. I did some digging and it turned out someone using the AWS Terraform provider also ran into this exact error and I was able to reproduce it from their issue description.

It essentially boils down to: An Update() to a resource occurred before a Read(), and Create() was called using a provider version that doesn't support identities. The Plugin Framework documentation only specifies to write identities during Create() and Read(), which isn't the full picture. The quickest way to replicate that is to run terraform apply -refresh=false after upgrading from v0.73.0 -> v0.74.0.

I tested my changes successfully with v1.11, so you should be able to resume business as usual. Although we very much recommend upgrading to the latest v1.x if possible 😄 (see our 1.0 compatibility guarantee).