Unable to update a managed request header from true to false on cloudflare_managed_headers

[nialdaly]

Confirmation

• My issue isn't already found on the issue tracker.
• I have replicated my issue using the latest version of the provider and it is still present.

Terraform and Cloudflare provider version

Terraform v1.5.7
on darwin_arm64

• provider registry.terraform.io/cloudflare/cloudflare v4.15.0

Affected resource(s)

• cloudflare_managed_headers

Terraform configuration files

resource "cloudflare_managed_headers" "managed_headers" {
  zone_id = data.cloudflare_zone.zone.id

  managed_request_headers {
    id      = "add_client_certificate_headers"
    enabled = false
  }
}

Link to debug output

https://gist.github.com/nialdaly/a3f6924e3812791a0e6bdf4d23157ca1

Panic output

No response

Expected output

• I expected the Add TLS client auth headers request header to be marked as disabled.

Actual output

• The Add TLS client auth headers request header is marked as enabled.

Steps to reproduce

• Create a cloudflare_managed_headers resource with the following configuration:

  resource "cloudflare_managed_headers" "managed_headers" {
     zone_id = data.cloudflare_zone.zone.id
  
     managed_request_headers {
       id      = "add_client_certificate_headers"
      enabled = true
    }
  }
  

• Run terraform apply.
• Update the cloudflare_managed_headers resource to the following configuration:

  resource "cloudflare_managed_headers" "managed_headers" {
     zone_id = data.cloudflare_zone.zone.id
  
     managed_request_headers {
       id      = "add_client_certificate_headers"
      enabled = false
    }
  }
  

• Run terraform apply.
• The Add TLS client auth headers request header is marked as enabled when it should be now disabled.

Additional factoids

No response

References

No response

[github-actions]

Community Note

Voting for Prioritization

• Please vote on this issue by adding a 👍 reaction to the original post to help the community and maintainers prioritize this request.
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request.

Volunteering to Work on This Issue

• If you are interested in working on this issue, please leave a comment.
• If this would be your first contribution, please review the contribution guide.

[jacobbednarz]

this is unfortunately a known issue with swapping between zero values in Terraform SDKv2. we can mitigate it by migrating to the plugin framework however i do not have an ETA on when that will happen. in the meantime, to swap the value you will need to remove it from your state file, and reapply it with the false value set.

[nialdaly]

Hi @jacobbednarz! Thanks for the prompt response, makes sense. Cheers!

[glensc]

in the meantime, to swap the value you will need to remove it from your state file, and reapply it with the false value set.

that appears to change flag in the web, but tf plan always says it needs to make modifications:

resource "cloudflare_managed_headers" "managed_headers" {
  zone_id = cloudflare_zone.zone.id

  managed_request_headers {
    enabled = false
    id      = "add_client_certificate_headers"
  }
  managed_request_headers {
    enabled = false
    id      = "add_visitor_location_headers"
  }
  managed_request_headers {
    enabled = false
    id      = "remove_visitor_ip_headers"
  }
  managed_response_headers {
    enabled = false
    id      = "add_security_headers"
  }
}

cloudflare_managed_headers.managed_headers will be updated in-place
  ~ resource "cloudflare_managed_headers" "managed_headers" {
        id      = "94b23da3bb6dabefcb39c7f845a7d681"
        # (1 unchanged attribute hidden)

      + managed_request_headers {
          + enabled = false
          + id      = "add_client_certificate_headers"
        }
      + managed_request_headers {
          + enabled = false
          + id      = "add_visitor_location_headers"
        }
      + managed_request_headers {
          + enabled = false
          + id      = "remove_visitor_ip_headers"
        }

      - managed_response_headers {
          - enabled = true -> null
          - id      = "remove_x-powered-by_header" -> null
        }
      + managed_response_headers {
          + enabled = false
          + id      = "add_security_headers"
        }
    }