Support safe handling of shared project IP access list entries in Terraform (prevent deletes when the same IP is used by multiple services).

[kandula229-rgb]

Is there an existing issue for this?

• I have searched the existing issues

Provider Version

1.40.0

Terraform Version

1.8.5

Terraform Edition

Terraform Open Source (OSS)

Current Behavior

Description:
We are facing an issue managing project-level IP access lists in MongoDB Atlas when multiple services/profiles share the same IP address.

Scenario:

One Atlas Project.

Service is deployed with different cluster profiles (e.g., integration, testing).

Each profile’s Terraform stack provisions:

An Atlas cluster (mongodbatlasadvancedcluster)

A backup schedule (mongodbatlascloudbackup_schedule)

A project IP access list entry (mongodbatlasprojectipaccesslist) using the same IP address.

Behavior Observed:

Integration profile deployment:

Creates cluster, backup, and adds Gateway IP to the project access list.

Testing profile deployment (same service, different profile):

Creates a second cluster and backup.

Attempts to add the same Gateway IP.

Atlas API accepts it (idempotent) → no duplicate error, but no new entry is created either.

Terraform state for the testing profile still assumes ownership of that IP entry.

Delete testing profile:

Destroys cluster and backup.

Also deletes the Gateway IP from the Atlas project (because state thinks it owns it).

Result: the integration profile’s cluster loses access, since the shared IP entry is gone.

Problem:

mongodbatlasprojectipaccesslist does not support safe handling of shared IPs across multiple Terraform states.

Unlike AWS Security Group rules (which have unique IDs per rule, making deletes safe), Atlas identifies IPs only by the IP address string.

This creates a state ownership conflict: one stack can remove IPs required by another.

Terraform configuration to reproduce the issue

resource "mongodbatlas_project_ip_access_list" "this" {
  for_each = toset(local.GatewayIPs)
  project_id = "projectID"
  ip_address = each.value
  comment    = "Allow connection to cluster"

}

Steps To Reproduce

Try to create same project_ip_access_list IP with 2 terraform states, only one resource will be created.
Both will point to same Ip entry in atlas
delete one, so it deletes the entry. for other service we will get connection issue

Logs

Code of Conduct

• I agree to follow this project's Code of Conduct

[github-actions]

Thanks for opening this issue! Please make sure you've followed our guidelines when opening the issue. In short, to help us reproduce the issue we need:

• Terraform configuration file used to reproduce the issue
• Terraform log files from the run where the issue occurred
• Terraform Atlas provider version used to reproduce the issue
• Terraform version used to reproduce the issue
• Confirmation if Terraform OSS, Terraform Cloud, or Terraform Enterprise deployment

The ticket CLOUDP-345057 was created for internal tracking.

[bodegus]

@kandula229-rgb - thanks for the input and acknowledging the request. We are limited by the API behavior in Terraform and have pushed this up to the team to review.

[github-actions]

This issue has gone 7 days without any activity and meets the project’s definition of "stale". This will be auto-closed if there is no new activity over the next 7 days. If the issue is still relevant and active, you can simply comment with a "bump" to keep it open, or add the label "not_stale". Thanks for keeping our repository healthy!

[kandula229-rgb]

@bodegus
I wanted to follow up on this issue and check if there’s any update or timeline for resolution.
This feature is quite critical for terraform workflows, and we’d appreciate if it could be prioritized.
Please let us know if there’s anything I can do to help move it forward.
Thanks in advance!

[github-actions]

This issue has gone 7 days without any activity and meets the project’s definition of "stale". This will be auto-closed if there is no new activity over the next 7 days. If the issue is still relevant and active, you can simply comment with a "bump" to keep it open, or add the label "not_stale". Thanks for keeping our repository healthy!

[bodegus]

Hi @kandula229-rgb. The request makes complete sense but we don't have a quick solve. We need to make significant changes to support duplicate IPs in our networking capability before we can bring this into Terraform.

If you need to maintain the IPs in multiple deployments in the short term - you could use the IP whitelist datasource to get the current IPs and use Terraform variable manipulation to deduplicate your input IPs from this data source

data "mongodbatlas_project_ip_access_list"

in your IP whitelist resource
for_each: contains(data.ip_list, ip) ? 0 : 1