terraform-provider-google: Error 409 when trying to update the resource `google_compute_security_policy`

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request.
• Please do not leave +1 or me too comments, they generate extra noise for issue followers and do not help prioritize the request.
• If you are interested in working on this issue or have submitted a pull request, please leave a comment.
• If an issue is assigned to the modular-magician user, it is either in the process of being autogenerated, or is planned to be autogenerated soon. If an issue is assigned to a user, that user is claiming responsibility for the issue. If an issue is assigned to hashibot, a community member has claimed the issue already.

Terraform Version

Version: 1.5.0

Affected Resource(s)

• google_compute_security_policy

Terraform Configuration Files

After making some changes on the resource google_compute_security_policy that triggers the resource recreation, it is trying to create the resource again first before deleting it. Then, since we already have the resource with the same name, it’s crashing it.

resource "google_compute_security_policy" "backend_apis_cloud_armor" {
  name = "backend-api"
  provider = google-beta
  lifecycle {
    ignore_changes = [
      # This is being ignored because GCP is raising an issue when trying to set this value to PREMIUM tier
      # Layer 7 DDoS defense premium is currently not enabled.
      adaptive_protection_config[0].layer_7_ddos_defense_config[0].rule_visibility
    ]
  }

  rule {
	...
  }
  rule {
  	...
  }
  
  rule {
	...
  }

  rule {
	...
  }
}

Debug Output

Panic Output

Expected Behavior

I would like that GCP/Terraform was able to handle this situation and, in this case, remove the resource first before creating the new one.

Actual Behavior

Since it tries to create before remove, it will crash when trying to create a resource with the same name as the existing one.

Steps to Reproduce

Use an already existing google_compute_security_policy resource and make some changes on their terraform code. This might try to recreate the resource. However, you should have that already existing stuff.