Skip to content

[Bug] ConditionAndBlock/ConditionOrBlock Not Allowed in Deeply Nested Policy Conditions in Terraform Provider #169

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
camschaecisco wants to merge 7 commits into
base: main
Choose a base branch
from
Open

[Bug] ConditionAndBlock/ConditionOrBlock Not Allowed in Deeply Nested Policy Conditions in Terraform Provider #169

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
81b7b57
Fix: Allow ConditionAndBlock/ConditionOrBlock at nested level 3+ in p…
camschae Nov 26, 2025
5e8cc78
feat: Extend authorization rule nesting to 7 levels and improve perfo…
camschae Dec 5, 2025
58f5999
Extend all policy types to support 7 levels of condition nesting
camschae Dec 5, 2025
c24756c
Fix device_admin policies: Change all children from Set to List
camschae Dec 6, 2025
917b5cb
Add request_timeout parameter to provider
camschae Dec 6, 2025
8c85497
chore: Remove development artifacts before merge
camschae Dec 8, 2025
1c23a3e
chore: Add request_timeout to provider template and regenerate
camschae Dec 10, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 21 additions & 2 deletions docs/data-sources/device_admin_authentication_rule.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 +33,7 @@ data "ise_device_admin_authentication_rule" "example" {

### Read-Only

- `children` (Attributes Set) List of child conditions. `condition_type` must be one of `ConditionAndBlock` or `ConditionOrBlock`. (see [below for nested schema](#nestedatt--children))
- `children` (Attributes List) List of child conditions. `condition_type` must be one of `ConditionAndBlock` or `ConditionOrBlock`. (see [below for nested schema](#nestedatt--children))
- `condition_attribute_name` (String) Dictionary attribute name
- `condition_attribute_value` (String) Attribute value for condition. Value type is specified in dictionary object.
- `condition_dictionary_name` (String) Dictionary name
Expand All @@ -57,7 +57,7 @@ Read-Only:

- `attribute_name` (String) Dictionary attribute name
- `attribute_value` (String) Attribute value for condition. Value type is specified in dictionary object.
- `children` (Attributes Set) List of child conditions. `condition_type` must be one of `ConditionAndBlock` or `ConditionOrBlock`. (see [below for nested schema](#nestedatt--children--children))
- `children` (Attributes List) List of child conditions. `condition_type` must be one of `ConditionAndBlock` or `ConditionOrBlock`. (see [below for nested schema](#nestedatt--children--children))
- `condition_type` (String) Indicates whether the record is the condition itself or a logical aggregation. Logical aggreation indicates that additional conditions are present under the children attribute.
- `dictionary_name` (String) Dictionary name
- `dictionary_value` (String) Dictionary value
Expand All @@ -72,9 +72,28 @@ Read-Only:

- `attribute_name` (String) Dictionary attribute name
- `attribute_value` (String) Attribute value for condition. Value type is specified in dictionary object.
- `children` (Attributes List) List of child conditions (recursive) (see [below for nested schema](#nestedatt--children--children--children))
- `condition_type` (String) Condition type.
- `dictionary_name` (String) Dictionary name
- `dictionary_value` (String) Dictionary value
- `id` (String) UUID for condition
- `is_negate` (Boolean) Indicates whereas this condition is in negate mode
- `operator` (String) Equality operator

<a id="nestedatt--children--children--children"></a>
### Nested Schema for `children.children.children`

Read-Only:

- `attribute_name` (String) Dictionary attribute name
- `attribute_value` (String) Attribute value for condition. Value type is specified in dictionary object.
- `children` (Attributes List) List of child conditions (level 5) (see [below for nested schema](#nestedatt--children--children--children--children))
- `condition_type` (String) Condition type.
- `dictionary_name` (String) Dictionary name
- `dictionary_value` (String) Dictionary value
- `id` (String) UUID for condition
- `is_negate` (Boolean) Indicates whereas this condition is in negate mode
- `operator` (String) Equality operator

<a id="nestedatt--children--children--children--children"></a>
### Nested Schema for `children.children.children.children`
25 changes: 22 additions & 3 deletions docs/data-sources/device_admin_authorization_exception_rule.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,8 +33,8 @@ data "ise_device_admin_authorization_exception_rule" "example" {

### Read-Only

- `children` (Attributes Set) List of child conditions. `condition_type` must be one of `ConditionAndBlock` or `ConditionOrBlock`. (see [below for nested schema](#nestedatt--children))
- `command_sets` (Set of String) Command sets enforce the specified list of commands that can be executed by a device administrator
- `children` (Attributes List) List of child conditions. `condition_type` must be one of `ConditionAndBlock` or `ConditionOrBlock`. (see [below for nested schema](#nestedatt--children))
- `command_sets` (List of String) Command sets enforce the specified list of commands that can be executed by a device administrator
- `condition_attribute_name` (String) Dictionary attribute name
- `condition_attribute_value` (String) Attribute value for condition. Value type is specified in dictionary object.
- `condition_dictionary_name` (String) Dictionary name
Expand All @@ -55,7 +55,7 @@ Read-Only:

- `attribute_name` (String) Dictionary attribute name
- `attribute_value` (String) Attribute value for condition. Value type is specified in dictionary object.
- `children` (Attributes Set) List of child conditions. `condition_type` must be one of `ConditionAndBlock` or `ConditionOrBlock`. (see [below for nested schema](#nestedatt--children--children))
- `children` (Attributes List) List of child conditions. `condition_type` must be one of `ConditionAndBlock` or `ConditionOrBlock`. (see [below for nested schema](#nestedatt--children--children))
- `condition_type` (String) Indicates whether the record is the condition itself or a logical aggregation. Logical aggreation indicates that additional conditions are present under the children attribute.
- `dictionary_name` (String) Dictionary name
- `dictionary_value` (String) Dictionary value
Expand All @@ -70,9 +70,28 @@ Read-Only:

- `attribute_name` (String) Dictionary attribute name
- `attribute_value` (String) Attribute value for condition. Value type is specified in dictionary object.
- `children` (Attributes List) List of child conditions (recursive) (see [below for nested schema](#nestedatt--children--children--children))
- `condition_type` (String) Condition type.
- `dictionary_name` (String) Dictionary name
- `dictionary_value` (String) Dictionary value
- `id` (String) UUID for condition
- `is_negate` (Boolean) Indicates whereas this condition is in negate mode
- `operator` (String) Equality operator

<a id="nestedatt--children--children--children"></a>
### Nested Schema for `children.children.children`

Read-Only:

- `attribute_name` (String) Dictionary attribute name
- `attribute_value` (String) Attribute value for condition. Value type is specified in dictionary object.
- `children` (Attributes List) List of child conditions (level 5) (see [below for nested schema](#nestedatt--children--children--children--children))
- `condition_type` (String) Condition type.
- `dictionary_name` (String) Dictionary name
- `dictionary_value` (String) Dictionary value
- `id` (String) UUID for condition
- `is_negate` (Boolean) Indicates whereas this condition is in negate mode
- `operator` (String) Equality operator

<a id="nestedatt--children--children--children--children"></a>
### Nested Schema for `children.children.children.children`
25 changes: 22 additions & 3 deletions docs/data-sources/device_admin_authorization_global_exception_rule.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,8 +28,8 @@ data "ise_device_admin_authorization_global_exception_rule" "example" {

### Read-Only

- `children` (Attributes Set) List of child conditions. `condition_type` must be one of `ConditionAndBlock` or `ConditionOrBlock`. (see [below for nested schema](#nestedatt--children))
- `command_sets` (Set of String) Command sets enforce the specified list of commands that can be executed by a device administrator
- `children` (Attributes List) List of child conditions. `condition_type` must be one of `ConditionAndBlock` or `ConditionOrBlock`. (see [below for nested schema](#nestedatt--children))
- `command_sets` (List of String) Command sets enforce the specified list of commands that can be executed by a device administrator
- `condition_attribute_name` (String) Dictionary attribute name
- `condition_attribute_value` (String) Attribute value for condition. Value type is specified in dictionary object.
- `condition_dictionary_name` (String) Dictionary name
Expand All @@ -49,7 +49,7 @@ Read-Only:

- `attribute_name` (String) Dictionary attribute name
- `attribute_value` (String) Attribute value for condition. Value type is specified in dictionary object.
- `children` (Attributes Set) List of child conditions. `condition_type` must be one of `ConditionAndBlock` or `ConditionOrBlock`. (see [below for nested schema](#nestedatt--children--children))
- `children` (Attributes List) List of child conditions. `condition_type` must be one of `ConditionAndBlock` or `ConditionOrBlock`. (see [below for nested schema](#nestedatt--children--children))
- `condition_type` (String) Indicates whether the record is the condition itself or a logical aggregation. Logical aggreation indicates that additional conditions are present under the children attribute.
- `dictionary_name` (String) Dictionary name
- `dictionary_value` (String) Dictionary value
Expand All @@ -64,9 +64,28 @@ Read-Only:

- `attribute_name` (String) Dictionary attribute name
- `attribute_value` (String) Attribute value for condition. Value type is specified in dictionary object.
- `children` (Attributes List) List of child conditions (recursive) (see [below for nested schema](#nestedatt--children--children--children))
- `condition_type` (String) Condition type.
- `dictionary_name` (String) Dictionary name
- `dictionary_value` (String) Dictionary value
- `id` (String) UUID for condition
- `is_negate` (Boolean) Indicates whereas this condition is in negate mode
- `operator` (String) Equality operator

<a id="nestedatt--children--children--children"></a>
### Nested Schema for `children.children.children`

Read-Only:

- `attribute_name` (String) Dictionary attribute name
- `attribute_value` (String) Attribute value for condition
- `children` (Attributes List) List of child conditions (level 5) (see [below for nested schema](#nestedatt--children--children--children--children))
- `condition_type` (String) Condition type.
- `dictionary_name` (String) Dictionary name
- `dictionary_value` (String) Dictionary value
- `id` (String) UUID for condition
- `is_negate` (Boolean) Indicates whereas this condition is in negate mode
- `operator` (String) Equality operator

<a id="nestedatt--children--children--children--children"></a>
### Nested Schema for `children.children.children.children`
23 changes: 21 additions & 2 deletions docs/data-sources/device_admin_authorization_rule.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 +33,7 @@ data "ise_device_admin_authorization_rule" "example" {

### Read-Only

- `children` (Attributes Set) List of child conditions. `condition_type` must be one of `ConditionAndBlock` or `ConditionOrBlock`. (see [below for nested schema](#nestedatt--children))
- `children` (Attributes List) List of child conditions. `condition_type` must be one of `ConditionAndBlock` or `ConditionOrBlock`. (see [below for nested schema](#nestedatt--children))
- `command_sets` (Set of String) Command sets enforce the specified list of commands that can be executed by a device administrator
- `condition_attribute_name` (String) Dictionary attribute name
- `condition_attribute_value` (String) Attribute value for condition. Value type is specified in dictionary object.
Expand All @@ -55,7 +55,7 @@ Read-Only:

- `attribute_name` (String) Dictionary attribute name
- `attribute_value` (String) Attribute value for condition. Value type is specified in dictionary object.
- `children` (Attributes Set) List of child conditions. `condition_type` must be one of `ConditionAndBlock` or `ConditionOrBlock`. (see [below for nested schema](#nestedatt--children--children))
- `children` (Attributes List) List of child conditions. `condition_type` must be one of `ConditionAndBlock` or `ConditionOrBlock`. (see [below for nested schema](#nestedatt--children--children))
- `condition_type` (String) Indicates whether the record is the condition itself or a logical aggregation. Logical aggreation indicates that additional conditions are present under the children attribute.
- `dictionary_name` (String) Dictionary name
- `dictionary_value` (String) Dictionary value
Expand All @@ -70,9 +70,28 @@ Read-Only:

- `attribute_name` (String) Dictionary attribute name
- `attribute_value` (String) Attribute value for condition. Value type is specified in dictionary object.
- `children` (Attributes List) List of child conditions (recursive) (see [below for nested schema](#nestedatt--children--children--children))
- `condition_type` (String) Condition type.
- `dictionary_name` (String) Dictionary name
- `dictionary_value` (String) Dictionary value
- `id` (String) UUID for condition
- `is_negate` (Boolean) Indicates whereas this condition is in negate mode
- `operator` (String) Equality operator

<a id="nestedatt--children--children--children"></a>
### Nested Schema for `children.children.children`

Read-Only:

- `attribute_name` (String) Dictionary attribute name
- `attribute_value` (String) Attribute value for condition
- `children` (Attributes List) List of child conditions (level 5) (see [below for nested schema](#nestedatt--children--children--children--children))
- `condition_type` (String) Condition type.
- `dictionary_name` (String) Dictionary name
- `dictionary_value` (String) Dictionary value
- `id` (String) UUID for condition
- `is_negate` (Boolean) Indicates whereas this condition is in negate mode
- `operator` (String) Equality operator

<a id="nestedatt--children--children--children--children"></a>
### Nested Schema for `children.children.children.children`
19 changes: 19 additions & 0 deletions docs/data-sources/device_admin_condition.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -62,6 +62,7 @@ Read-Only:

- `attribute_name` (String) Dictionary attribute name
- `attribute_value` (String) Attribute value for condition. Value type is specified in dictionary object.
- `children` (Attributes Set) List of child conditions (recursive) (see [below for nested schema](#nestedatt--children--children--children))
- `condition_type` (String) Condition type.
- `description` (String) Condition description
- `dictionary_name` (String) Dictionary name
Expand All @@ -70,3 +71,21 @@ Read-Only:
- `is_negate` (Boolean) Indicates whereas this condition is in negate mode
- `name` (String) Condition name
- `operator` (String) Equality operator

<a id="nestedatt--children--children--children"></a>
### Nested Schema for `children.children.children`

Read-Only:

- `attribute_name` (String) Dictionary attribute name
- `attribute_value` (String) Attribute value for condition
- `children` (Attributes Set) List of child conditions (level 5) (see [below for nested schema](#nestedatt--children--children--children--children))
- `condition_type` (String) Condition type.
- `dictionary_name` (String) Dictionary name
- `dictionary_value` (String) Dictionary value
- `id` (String) UUID for condition
- `is_negate` (Boolean) Indicates whereas this condition is in negate mode
- `operator` (String) Equality operator

<a id="nestedatt--children--children--children--children"></a>
### Nested Schema for `children.children.children.children`
23 changes: 21 additions & 2 deletions docs/data-sources/device_admin_policy_set.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,7 @@ data "ise_device_admin_policy_set" "example" {

### Read-Only

- `children` (Attributes Set) List of child conditions. `condition_type` must be one of `ConditionAndBlock` or `ConditionOrBlock`. (see [below for nested schema](#nestedatt--children))
- `children` (Attributes List) List of child conditions. `condition_type` must be one of `ConditionAndBlock` or `ConditionOrBlock`. (see [below for nested schema](#nestedatt--children))
- `condition_attribute_name` (String) Dictionary attribute name
- `condition_attribute_value` (String) Attribute value for condition. Value type is specified in dictionary object.
- `condition_dictionary_name` (String) Dictionary name
Expand All @@ -51,7 +51,7 @@ Read-Only:

- `attribute_name` (String) Dictionary attribute name
- `attribute_value` (String) Attribute value for condition. Value type is specified in dictionary object.
- `children` (Attributes Set) List of child conditions. `condition_type` must be one of `ConditionAndBlock` or `ConditionOrBlock`. (see [below for nested schema](#nestedatt--children--children))
- `children` (Attributes List) List of child conditions. `condition_type` must be one of `ConditionAndBlock` or `ConditionOrBlock`. (see [below for nested schema](#nestedatt--children--children))
- `condition_type` (String) Indicates whether the record is the condition itself or a logical aggregation. Logical aggreation indicates that additional conditions are present under the children attribute.
- `dictionary_name` (String) Dictionary name
- `dictionary_value` (String) Dictionary value
Expand All @@ -66,9 +66,28 @@ Read-Only:

- `attribute_name` (String) Dictionary attribute name
- `attribute_value` (String) Attribute value for condition. Value type is specified in dictionary object.
- `children` (Attributes List) List of child conditions (recursive) (see [below for nested schema](#nestedatt--children--children--children))
- `condition_type` (String) Condition type.
- `dictionary_name` (String) Dictionary name
- `dictionary_value` (String) Dictionary value
- `id` (String) UUID for condition
- `is_negate` (Boolean) Indicates whereas this condition is in negate mode
- `operator` (String) Equality operator

<a id="nestedatt--children--children--children"></a>
### Nested Schema for `children.children.children`

Read-Only:

- `attribute_name` (String) Dictionary attribute name
- `attribute_value` (String) Attribute value for condition
- `children` (Attributes List) List of child conditions (level 5) (see [below for nested schema](#nestedatt--children--children--children--children))
- `condition_type` (String) Condition type.
- `dictionary_name` (String) Dictionary name
- `dictionary_value` (String) Dictionary value
- `id` (String) UUID for condition
- `is_negate` (Boolean) Indicates whereas this condition is in negate mode
- `operator` (String) Equality operator

<a id="nestedatt--children--children--children--children"></a>
### Nested Schema for `children.children.children.children`
23 changes: 21 additions & 2 deletions docs/data-sources/network_access_authentication_rule.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 +33,7 @@ data "ise_network_access_authentication_rule" "example" {

### Read-Only

- `children` (Attributes Set) List of child conditions. `condition_type` must be one of `ConditionAndBlock` or `ConditionOrBlock`. (see [below for nested schema](#nestedatt--children))
- `children` (Attributes List) List of child conditions. `condition_type` must be one of `ConditionAndBlock` or `ConditionOrBlock`. (see [below for nested schema](#nestedatt--children))
- `condition_attribute_name` (String) Dictionary attribute name
- `condition_attribute_value` (String) Attribute value for condition. Value type is specified in dictionary object.
- `condition_dictionary_name` (String) Dictionary name
Expand All @@ -57,7 +57,7 @@ Read-Only:

- `attribute_name` (String) Dictionary attribute name
- `attribute_value` (String) Attribute value for condition. Value type is specified in dictionary object.
- `children` (Attributes Set) List of child conditions. `condition_type` must be one of `ConditionAndBlock` or `ConditionOrBlock`. (see [below for nested schema](#nestedatt--children--children))
- `children` (Attributes List) List of child conditions. `condition_type` must be one of `ConditionAndBlock` or `ConditionOrBlock`. (see [below for nested schema](#nestedatt--children--children))
- `condition_type` (String) Indicates whether the record is the condition itself or a logical aggregation. Logical aggreation indicates that additional conditions are present under the children attribute.
- `dictionary_name` (String) Dictionary name
- `dictionary_value` (String) Dictionary value
Expand All @@ -72,9 +72,28 @@ Read-Only:

- `attribute_name` (String) Dictionary attribute name
- `attribute_value` (String) Attribute value for condition. Value type is specified in dictionary object.
- `children` (Attributes List) List of child conditions (recursive) (see [below for nested schema](#nestedatt--children--children--children))
- `condition_type` (String) Condition type.
- `dictionary_name` (String) Dictionary name
- `dictionary_value` (String) Dictionary value
- `id` (String) UUID for condition
- `is_negate` (Boolean) Indicates whereas this condition is in negate mode
- `operator` (String) Equality operator

<a id="nestedatt--children--children--children"></a>
### Nested Schema for `children.children.children`

Read-Only:

- `attribute_name` (String) Dictionary attribute name
- `attribute_value` (String) Attribute value for condition. Value type is specified in dictionary object.
- `children` (Attributes List) List of child conditions (level 5) (see [below for nested schema](#nestedatt--children--children--children--children))
- `condition_type` (String) Condition type.
- `dictionary_name` (String) Dictionary name
- `dictionary_value` (String) Dictionary value
- `id` (String) UUID for condition
- `is_negate` (Boolean) Indicates whereas this condition is in negate mode
- `operator` (String) Equality operator

<a id="nestedatt--children--children--children--children"></a>
### Nested Schema for `children.children.children.children`
Loading