Skip to content

Fix detector_rules diff suppression for order mismatches (#2509) - #2511

Open
sakazuki wants to merge 1 commit into
oracle:masterfrom
sakazuki:2509-fixes
Open

Fix detector_rules diff suppression for order mismatches (#2509)#2511
sakazuki wants to merge 1 commit into
oracle:masterfrom
sakazuki:2509-fixes

Conversation

@sakazuki

Copy link
Copy Markdown

Summary

Fixes an issue where changes to the detector_rules block in Cloud Guard Detector Recipe resources would trigger spurious diffs whenever the API response order differs from the HCL configuration block order.

Problem

  • The OCI Cloud Guard API returns all detector rules (including default rules copied from the source recipe) in an unpredictable order
  • When the order of API response differs from the order of blocks defined in HCL, Terraform would report a diff even though no actual changes were made
  • This caused unnecessary plan failures and confusion for users

Solution

  1. Filtered rule set: Modified SetData() to only include rules that were explicitly defined in the HCL configuration, preventing spurious diffs caused by API-injected default rules
  2. Deterministic ordering: All rules are now sorted alphabetically by detector_rule_id for consistent state
  3. Smart diff suppression: Added a DiffSuppressFunc that intelligently compares rules by detector_rule_id rather than list index, preventing false positives when HCL blocks are reordered
  4. Helper functions: Added utility functions to:
    • Extract configured rule IDs from HCL
    • Filter rules by ID set
    • Sort rules consistently

Files Changed

Testing

  • The fix leverages Terraform's schema validation and diff suppression mechanisms
  • No behavioral changes to the API or resource output
  • All detector rules (including defaults) remain available via the effective_detector_rules attribute for reference

Related Issue

Fixes #2509

…der may differ

fix: oracle#2509

Signed-off-by: sakazuki <sakazuki@gmail.com>
@oracle-contributor-agreement oracle-contributor-agreement Bot added the OCA Verified All contributors have signed the Oracle Contributor Agreement. label Feb 15, 2026
@tf-oci-pub tf-oci-pub added the Pending Test Pending Test label for PRs label Feb 15, 2026
@tf-oci-pub

Copy link
Copy Markdown
Member

Thank you for your valuable contribution. We greatly appreciate your efforts in submitting this pull request. However, I regret to inform you that we are unable to merge it directly on GitHub at this time.

Our internal policy requires that all pull requests undergo thorough local testing and review before they can be merged into the main codebase. This process ensures the quality and stability of Terraform-Provider-OCI.

We understand that this may cause some inconvenience, but please rest assured that your contribution is highly valued. Our team will carefully review and test your changes locally to ensure they meet our standards.

We appreciate your understanding and patience in this matter. If you have any questions or need further assistance, please don't hesitate to reach out. Thank you once again for your contribution.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

OCA Verified All contributors have signed the Oracle Contributor Agreement. Pending Test Pending Test label for PRs

Projects

None yet

Development

Successfully merging this pull request may close these issues.

oci_cloud_guard_detector_recipe Fails When Detector Rule Order Changes

2 participants