google_sql_database_instance.authorized_networks order is randomized so diff is too broad

[jschaf]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request.
• Please do not leave +1 or me too comments, they generate extra noise for issue followers and do not help prioritize the request.
• If you are interested in working on this issue or have submitted a pull request, please leave a comment.
• If an issue is assigned to the modular-magician user, it is either in the process of being autogenerated, or is planned to be autogenerated soon. If an issue is assigned to a user, that user is claiming responsibility for the issue. If an issue is assigned to hashibot, a community member has claimed the issue already.

Terraform Version

Terraform v1.5.2
on darwin_arm64

Affected Resource(s)

• google_sql_database_instance

Terraform Configuration Files

# Copy-paste your Terraform configurations here.
#
# For large Terraform configs, please use a service like Dropbox and share a link to the ZIP file.
# For security, you can also encrypt the files using our GPG public key:
#    https://www.hashicorp.com/security
#
# If reproducing the bug involves modifying the config file (e.g., apply a config,
# change a value, apply the config again, see the bug), then please include both:
# * the version of the config before the change, and
# * the version of the config after the change.

resource "google_sql_database_instance" "simc-p-sql-uswe4-erp-pg14-b" {
  name = "simc-p-sql-uswe4-erp-pg14-b"
  database_version = "POSTGRES_14"
  region = "us-west4"

  settings {
    tier = "db-custom-16-16384"
    disk_size = "100"
    disk_type = "PD_SSD"
    availability_type = "ZONAL"
    ip_configuration {
      ipv4_enabled = true
      private_network = google_compute_network.simc-p-vpc-main.id
      authorized_networks {
        name = "network a"
        value = "1.2.3.4"
      }
      authorized_networks {
        name = "network b"
        value = "5.6.7.8"
      }
      authorized_networks {
        name = "network c"
        value = "7.8.9.10"
      }
    }

    location_preference {
      zone = "us-west4-c"
    }
    maintenance_window {
      day = 1  # Monday: 1-7, where 1 is Monday
      hour = 6 # 06:00 UTC, which is 22:00 the previous day in PT
      update_track = "stable"
    }
  }
}

Debug Output

Panic Output

Expected Behavior

When changing or adding a new authorized_network, Terraform should only show a diff for a single authorized_network.

Actual Behavior

Terraform appears to use a random sort order to do the diff, meaning the diff will almost always show many authorized_networks as changed.

Steps to Reproduce

1. Change any IP address in authorized_networks.value
2. terraform plan
3. Observe that the diff shows changes for every authorized network.

Important Factoids

Since the order is random, the values look like they're stored in a map via schema.HashResource. In Go, map iteration order is randomized.

https://github.com/hashicorp/terraform-provider-google/blob/main/google/services/sql/resource_sql_database_instance.go#L2201
https://pkg.go.dev/github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema#HashResource
https://github.com/hashicorp/terraform-plugin-sdk/blob/v2.28.0/helper/schema/set.go#L57

References

• #0000

b/298669850