ZoneDnssec resource fails to upgrade from v5 to v6 due to invalid RFC3339 date in modified_on state

[stian3555]

Describe what happened

When upgrading the Pulumi Cloudflare provider from v5 to v6, the cloudflare:ZoneDnssec resource fails with the following error:

cloudflare:index:ZoneDnssec (dnssec):
  error: 1 error occurred:
      * AttributeName("modified_on"): Invalid RFC3339 String Value - A string value was provided that is not valid RFC3339 string format.

  Given Value: Thu, 26 Oct 2023 10:58:01 +0000
  Error: parsing time "Thu, 26 Oct 2023 10:58:01 +0000" as "2006-01-02T15:04:05Z07:00": cannot parse "Thu, 26 Oct 2023 10:58:01 +0000" as "2006"

It appears that the modified_on attribute in the state file is stored in a non-RFC3339 format (Thu, 26 Oct 2023 10:58:01 +0000), which is not accepted by the v6 provider, causing the upgrade to fail.

Sample program

Version 5

name: example-com
runtime: yaml
description: Domain example.com  managed by Pulumi
variables: {}
resources:
  cloudflare-provider:
    type: pulumi:providers:cloudflare
    defaultProvider: true
    options:
      version: 5.49.1
  zone:
    type: cloudflare:Zone
    properties:
      accountId: 0123456789abcdef0123456789abcdef
      zone: example.com
      plan: enterprise
      paused: false
      type: full
  dnssec:
    type: cloudflare:ZoneDnssec
    properties:
      zoneId: ${zone.id}

Version 6

name: example-com
runtime: yaml
description: Domain example.com managed by Pulumi
variables: {}
resources:
  cloudflare-provider:
    type: pulumi:providers:cloudflare
    defaultProvider: true
    options:
      version: 6.2.1
  zone:
    type: cloudflare:Zone
    properties:
      name: example.com
      account:
        id: 0123456789abcdef0123456789abcdef
  zonesubscription:
    type: cloudflare:ZoneSubscription
    properties:
      identifier: ${zone.id}
      ratePlan:
        id: enterprise
        scope: zone
  dnssec:
    type: cloudflare:ZoneDnssec
    properties:
      zoneId: ${zone.id}

Stack export

        "resources": [
            {
                "urn": "urn:pulumi:prod::example-com::pulumi:pulumi:Stack::example-com-prod",
                "custom": false,
                "type": "pulumi:pulumi:Stack",
                "created": "2023-10-23T11:47:57.136303105Z",
                "modified": "2023-10-23T11:47:57.136303105Z"
            },
            {
                "urn": "urn:pulumi:prod::example-com::pulumi:providers:cloudflare::cloudflare-provider",
                "custom": true,
                "id": "61247d96-a21b-4a28-b6b6-8f7fce9efd96",
                "type": "pulumi:providers:cloudflare",
                "inputs": {
                    "__internal": {},
                    "apiClientLogging": "false",
                    "maxBackoff": "30",
                    "minBackoff": "1",
                    "retries": "3",
                    "rps": "4",
                    "version": "5.49.1"
                },
                "outputs": {
                    "apiClientLogging": "false",
                    "maxBackoff": "30",
                    "minBackoff": "1",
                    "retries": "3",
                    "rps": "4",
                    "version": "5.49.1"
                },
                "parent": "urn:pulumi:prod::example-com::pulumi:pulumi:Stack::example-com-prod",
                "additionalSecretOutputs": [
                    "apiKey",
                    "apiToken",
                    "apiUserServiceKey"
                ],
                "created": "2025-04-24T07:41:21.25289834Z",
                "modified": "2025-04-24T07:41:21.25289834Z"
            },
            {
                "urn": "urn:pulumi:prod::example-com::cloudflare:index/zone:Zone::zone",
                "custom": true,
                "id": "00112233445566778899aabbccddeeff",
                "type": "cloudflare:index/zone:Zone",
                "inputs": {
                    "__defaults": [],
                    "accountId": "0123456789abcdef0123456789abcdef",
                    "paused": false,
                    "plan": "enterprise",
                    "type": "full",
                    "zone": "example.com"
                },
                "outputs": {
                    "accountId": "0123456789abcdef0123456789abcdef",
                    "id": "00112233445566778899aabbccddeeff",
                    "meta": {
                        "phishing_detected": false,
                        "wildcard_proxiable": false
                    },
                    "nameServers": [
                        "alice.ns.cloudflare.com",
                        "bob.ns.cloudflare.com"
                    ],
                    "paused": false,
                    "plan": "enterprise",
                    "status": "active",
                    "type": "full",
                    "vanityNameServers": [],
                    "verificationKey": "",
                    "zone": "example.com"
                },
                "parent": "urn:pulumi:prod::example-com::pulumi:pulumi:Stack::example-com-prod",
                "protect": true,
                "provider": "urn:pulumi:prod::example-com::pulumi:providers:cloudflare::cloudflare-provider::61247d96-a21b-4a28-b6b6-8f7fce9efd96",
                "propertyDependencies": {
                    "accountId": [],
                    "paused": [],
                    "plan": [],
                    "type": [],
                    "zone": []
                },
                "created": "2023-10-23T11:48:00.469494513Z",
                "modified": "2023-12-07T08:54:44.904408056Z"
            },
            {
                "urn": "urn:pulumi:prod::example-com::cloudflare:index/zoneDnssec:ZoneDnssec::dnssec",
                "custom": true,
                "id": "00112233445566778899aabbccddeeff",
                "type": "cloudflare:index/zoneDnssec:ZoneDnssec",
                "inputs": {
                    "__defaults": [],
                    "zoneId": "00112233445566778899aabbccddeeff"
                },
                "outputs": {
                    "algorithm": "13",
                    "digest": "C411CB28F632646A42CA7D94DB21EB39DC413B6B6021B2381E8B1CA4270FC25B",
                    "digestAlgorithm": "SHA256",
                    "digestType": "2",
                    "ds": "example.com. 3600 IN DS 2371 13 2 C411CB28F632646A42CA7D94DB21EB39DC413B6B6021B2381E8B1CA4270FC25B",
                    "flags": 257,
                    "id": "00112233445566778899aabbccddeeff",
                    "keyTag": 2371,
                    "keyType": "ECDSAP256SHA256",
                    "modifiedOn": "Thu, 26 Oct 2023 10:58:01 +0000",
                    "publicKey": "mdsswUyr3DPW132mOi8V9xESWE8jTo0dxCjjnopKl+GqJxpVXckHAeF+KkxLbxILfDLUT0rAK9iUzy1L53eKGQ==",
                    "status": "pending",
                    "zoneId": "00112233445566778899aabbccddeeff"
                },
                "parent": "urn:pulumi:prod::example-com::pulumi:pulumi:Stack::example-com-prod",
                "dependencies": [
                    "urn:pulumi:prod::example-com::cloudflare:index/zone:Zone::zone"
                ],
                "provider": "urn:pulumi:prod::example-com::pulumi:providers:cloudflare::cloudflare-provider::61247d96-a21b-4a28-b6b6-8f7fce9efd96",
                "propertyDependencies": {
                    "zoneId": [
                        "urn:pulumi:prod::example-com::cloudflare:index/zone:Zone::zone"
                    ]
                },
                "created": "2023-10-26T10:58:03.522490129Z",
                "modified": "2023-10-26T10:58:03.522490129Z"
            }
        ]

Log output

No response

Affected Resource(s)

• cloudflare:ZoneDnssec

Output of pulumi about

CLI          
Version      3.173.0
Go Version   go1.24.3
Go Compiler  gc

Plugins
KIND      NAME        VERSION
resource  cloudflare  6.2.1
language  yaml        1.19.1

Host     
OS       darwin
Version  15.5
Arch     arm64

This project is written in yaml

Current Stack: exampleorg/example-com/prod

TYPE                                                        URN
pulumi:pulumi:Stack                                         urn:pulumi:prod::example-com::pulumi:pulumi:Stack::example-com-prod
pulumi:providers:cloudflare                                 urn:pulumi:prod::example-com::pulumi:providers:cloudflare::cloudflare-provider
cloudflare:index/zone:Zone                                  urn:pulumi:prod::example-com::cloudflare:index/zone:Zone::zone
cloudflare:index/zoneDnssec:ZoneDnssec                      urn:pulumi:prod::example-com::cloudflare:index/zoneDnssec:ZoneDnssec::dnssec


Found no pending operations associated with prod

Dependencies:
NAME        VERSION
cloudflare  6.2.1

Additional context

No response

Contributing

Vote on this issue by adding a 👍 reaction.
To contribute a fix for this issue, leave a comment (and link to your pull request, if you've opened one already).

[t0yv0]

@stian3555 thanks for reporting and sorry this is affecting you. You can work around this problem by editing the state for the moment. To fix this we would need to introduce a state migration that aligns the format to the one expected.

[stian3555]

Thanks for looking into this, this seems to be a reproducible error.
We have a lot of domains, and i would prefer to not have to modify state myself.
But i can confirm modifying or deleting the resource from state resolves the problem

[stian3555]

Hi @t0yv0,
Just checking in to see if there are any updates regarding this issue. Is a fix planned, or should we start exploring a workaround automating editing the state?
Thanks in advance!

[t0yv0]

Forwarding to @mjeffryes as I have moved teams recently, thank you for your patience!

[stian3555]

Any updates @mjeffryes ? 😊