State is updated with new password, even when password change failed.

[jamesw4]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritise this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritise the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform (and AzureAD Provider) Version

Terraform v1.7.3
on windows_amd64

• provider registry.terraform.io/hashicorp/azuread v2.47.0
• provider registry.terraform.io/hashicorp/random v3.6.0

Affected Resource(s)

• azuread_user

Terraform Configuration Files

resource "random_password" "test" {
  length = 16
}

resource "azuread_user" "example" {
  user_principal_name = "test@test.com"
  display_name = "test"
  password            = random_password.test.result
}

terraform {
  required_providers {
    azuread = {
       version = "=2.47.0"
    }
  }
}

Debug Output

https://gist.github.com/jamesw4/ab2f287eb5519d329e0245ddae398763

Panic Output

Expected Behavior

On password update failure, state should not be updated with the attempted password.

Actual Behavior

Even though password update failed, and the API threw an error, state is updated with the attempted password.

Steps to Reproduce

1. terraform apply the above example to create test user.
2. Stage a failure by setting length of random_password resource to 1.
3. terraform apply again and observe error thrown.
4. Examine state file and observe state has the password as the 1 char password that failed to be applied.

Important Factoids

References

• #0000

[manicminer]

Thanks for reporting @jamesw4, sorry for the delay. I'm able to reproduce this and with a little digging I found a workaround that avoids this.