Ensure that mode updates are always sent when ddos_protection is enabled (#1149)

Author: philippschulte

CHANGELOG.md

@@ -11,6 +11,7 @@
 - fix(header): preserve optional bool field `ignore_if_set` during updates and add acceptance test coverage ([#1142](https://github.com/fastly/terraform-provider-fastly/pull/1142))
 - fix(image_optimizer_default_settings): preserve optional bool fields (`allow_video`, `webp`, `upscale`) during updates and add acceptance test coverage ([#1145](https://github.com/fastly/terraform-provider-fastly/pull/1145))
 - fix(logging_kafka): preserve optional bool fields (`use_tls`, `parse_log_keyvals`) during updates and add acceptance test coverage ([#1147](https://github.com/fastly/terraform-provider-fastly/pull/1147))
+- fix(product_enablement): ensure `ddos_protection` mode updates are applied ([#1149](https://github.com/fastly/terraform-provider-fastly/pull/1149))
 
 ### DEPENDENCIES:
 

fastly/block_fastly_service_product_enablement.go

@@ -607,16 +607,14 @@ func (h *ProductEnablementServiceAttributeHandler) Update(ctx context.Context, d
 					return fmt.Errorf("failed to enable ddos_protection: %w", err)
 				}
 
-				// The operation mode is set by default to "log"
 				mode := ddp[0].(map[string]any)["mode"].(string)
-				if mode != "log" {
-					log.Println("[DEBUG] ddos_protection mode will be updated")
-					_, err := ddosprotection.UpdateConfiguration(gofastly.NewContextForResourceID(ctx, d.Id()), conn, serviceID, ddosprotection.ConfigureInput{
-						Mode: mode,
-					})
-					if err != nil {
-						return fmt.Errorf("failed to set the configuration of ddos_protection: %w", err)
-					}
+				log.Printf("[DEBUG] ddos_protection mode will be set to %s", mode)
+				_, err = ddosprotection.UpdateConfiguration(
+					gofastly.NewContextForResourceID(ctx, d.Id()), conn, serviceID,
+					ddosprotection.ConfigureInput{Mode: mode},
+				)
+				if err != nil {
+					return fmt.Errorf("failed to set the configuration of ddos_protection: %w", err)
 				}
 			} else {
 				log.Println("[DEBUG] ddos_protection will be disabled")

fastly/block_fastly_service_product_enablement_test.go

@@ -105,3 +105,87 @@ func TestAccFastlyServiceVCLProductEnablement_basic(t *testing.T) {
 		},
 	})
 }
+
+func TestAccFastlyServiceVCLProductEnablement_ddosProtectionModeChange(t *testing.T) {
+	var service gofastly.ServiceDetail
+	serviceName := fmt.Sprintf("tf-test-%s", acctest.RandString(10))
+	domainName := fmt.Sprintf("fastly-test.tf-%s.com", acctest.RandString(10))
+	backendName := fmt.Sprintf("backend-tf-%s", acctest.RandString(10))
+	backendAddress := "httpbin.org"
+
+	initialConfig := fmt.Sprintf(`
+resource "fastly_service_vcl" "foo" {
+  name = "%s"
+
+  domain {
+    name    = "%s"
+    comment = "demo"
+  }
+
+  backend {
+    address = "%s"
+    name    = "%s"
+    port    = 443
+    shield  = "amsterdam-nl"
+  }
+
+  product_enablement {
+    ddos_protection {
+      enabled = true
+      mode    = "block"
+    }
+  }
+
+  force_destroy = true
+}
+`, serviceName, domainName, backendAddress, backendName)
+
+	updatedConfig := fmt.Sprintf(`
+resource "fastly_service_vcl" "foo" {
+  name = "%s"
+
+  domain {
+    name    = "%s"
+    comment = "demo"
+  }
+
+  backend {
+    address = "%s"
+    name    = "%s"
+    port    = 443
+    shield  = "amsterdam-nl"
+  }
+
+  product_enablement {
+    ddos_protection {
+      enabled = true
+      mode    = "log"
+    }
+  }
+
+  force_destroy = true
+}
+`, serviceName, domainName, backendAddress, backendName)
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:          func() { testAccPreCheck(t) },
+		ProviderFactories: testAccProviders,
+		CheckDestroy:      testAccCheckServiceVCLDestroy,
+		Steps: []resource.TestStep{
+			{
+				Config: initialConfig,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckServiceExists("fastly_service_vcl.foo", &service),
+					resource.TestCheckResourceAttr("fastly_service_vcl.foo", "product_enablement.0.ddos_protection.0.mode", "block"),
+				),
+			},
+			{
+				Config: updatedConfig,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckServiceExists("fastly_service_vcl.foo", &service),
+					resource.TestCheckResourceAttr("fastly_service_vcl.foo", "product_enablement.0.ddos_protection.0.mode", "log"),
+				),
+			},
+		},
+	})
+}