User names not tracked

[mmyers5]

Terraform CLI Version

1.14.3

Terraform Provider Version

2.14.0

Company Name

GameChanger

Terraform Configuration

resource "snowflake_service_user" "ops" {
  name                           = "MY NAME"
  ...
}

Category

category:resource

Object type(s)

resource:user

Expected Behavior

The login_name and display_name resource attributes are defaulted to the name if they are not explicitly declared in the resource. If I change the name, e.g. to "MY NEW NAME", the login_name and display_name should also be set to "MY NEW NAME". Otherwise, the statefile has hidden configuration.

Actual Behavior

The login_name and display_name were set to the old default ("MY NAME") after I changed the name attribute. This led me down a long rabbit hole of trying to figure out why authentication was failing despite the Terraform resource implying that the user name I was using was correct.

Steps to Reproduce

1. Create a Terraform service user with "MY NAME" and apply changes
2. Update the resource name property to "MY NEW NAME" and apply changes
3. Observe the login_name and display_name

How much impact is this issue causing?

Low

Logs

No response

Additional Information

No response

Would you like to implement a fix?

• Yeah, I'll take it 😎

[sfc-gh-jcieslak]

Hey @mmyers5 👋
I wouldn't say this is a bug, but rather following the Snowflake behavior:

create user test_user;
show users like 'test_user';
alter user test_user rename to test_user_new;
show users like 'test_user_new'; -- login_name and display_name stays as test_user

After running the above example, the defaults for login_name and display_name remain because they are set at creation time. If you want to manage and manipulate login_name and display_name fields, just make sure they are specified in the configuration. Otherwise, resources will use Snowflake defaults for missing fields.

[mmyers5]

But that behavior to me explicitly means that the provider is ignoring lifecycle changes on things that it has implictly set by default by creating the user. I think it should be opinionated about that if it's managing a user.

[sfc-gh-jcieslak]

This default value behavior is documented here: https://github.com/snowflakedb/terraform-provider-snowflake/blob/main/v1-preparations/CHANGES_BEFORE_V1.md#default-values (now that I think about it, maybe also should be moved to the Terraform Registry docs). It was prepared for V1, and I don't think we should make an exception here, because it would introduce inconsistencies with the behavior of other resources. An important note is that most of the limitations stem from the Terraform SDK and the fact that it's not easy to cover all customer use cases, especially for detecting external changes.