docs: clarify security_groups field behavior for FSWAL mode

- Update documentation to clarify that users should omit the field entirely
  (null) to trigger backend auto-generation, rather than providing an empty list
- Empty list [] is rejected by schema validator (SizeAtLeast(1))
- If specified, must contain at least one security group

Addresses review comment from PR #100

Author: Gezi-lzq

docs/resources/kafka_instance.md

@@ -94,7 +94,7 @@ resource "automq_kafka_instance" "fswal_example" {
     file_system_param = {
       throughput_mibps_per_file_system = 1000
       file_system_count                = 2
-      security_groups                  = ["sg-example123"] # Optional, auto-generated if not provided. If specified, must contain at least one security group.
+      security_groups                  = ["sg-example123"] # Optional. Omit this field entirely to let backend auto-generate. If specified, must contain at least one security group.
     }
   }
 
@@ -186,7 +186,7 @@ Required:
 
 Optional:
 
-- `security_groups` (List of String) Security groups for file systems. If not provided, will be auto-generated by the backend.
+- `security_groups` (List of String) Security groups for file systems. Omit this field entirely to let backend auto-generate. If specified, must contain at least one security group.
 
 
 <a id="nestedatt--compute_specs--kubernetes_node_groups"></a>

examples/resources/automq_kafka_instance/resource.tf

@@ -74,7 +74,7 @@ resource "automq_kafka_instance" "fswal_example" {
     file_system_param = {
       throughput_mibps_per_file_system = 1000
       file_system_count                = 2
-      security_groups                  = ["sg-example123"] # Optional, auto-generated if not provided. If specified, must contain at least one security group.
+      security_groups                  = ["sg-example123"] # Optional. Omit this field entirely to let backend auto-generate. If specified, must contain at least one security group.
     }
   }
 

internal/provider/resource_instance.go

@@ -277,7 +277,7 @@ func (r *KafkaInstanceResource) Schema(ctx context.Context, req resource.SchemaR
 								ElementType: types.StringType,
 								Optional:    true,
 								Computed:    true,
-								Description: "Security groups for file systems. If not provided, will be auto-generated by the backend.",
+								Description: "Security groups for file systems. Omit this field entirely to let backend auto-generate. If specified, must contain at least one security group.",
 								PlanModifiers: []planmodifier.List{
 									listplanmodifier.RequiresReplace(),
 									listplanmodifier.UseStateForUnknown(),

internal/provider/resource_instance_validation_test.go

@@ -659,7 +659,8 @@ func TestSecurityGroupsValidator(t *testing.T) {
 
 // TestValidateKafkaInstanceConfiguration_FSWALWithEmptySecurityGroups tests that
 // FSWAL configuration with empty security_groups list is handled correctly.
-// Empty security_groups should be valid (backend will auto-generate).
+// Note: Empty list [] is rejected by schema validator (SizeAtLeast(1)).
+// Users should omit the field entirely (null) to trigger backend auto-generation.
 func TestValidateKafkaInstanceConfiguration_FSWALWithEmptySecurityGroups(t *testing.T) {
 	plan := &models.KafkaInstanceResourceModel{
 		ComputeSpecs: &models.ComputeSpecsModel{
@@ -697,7 +698,8 @@ func TestValidateKafkaInstanceConfiguration_FSWALWithEmptySecurityGroups(t *test
 }
 
 // TestValidateKafkaInstanceConfiguration_FSWALWithNullSecurityGroups tests that
-// FSWAL configuration with null security_groups is valid (backend will auto-generate).
+// FSWAL configuration with null security_groups is valid.
+// Omitting the field (null) triggers backend auto-generation of security groups.
 func TestValidateKafkaInstanceConfiguration_FSWALWithNullSecurityGroups(t *testing.T) {
 	plan := &models.KafkaInstanceResourceModel{
 		ComputeSpecs: &models.ComputeSpecsModel{