azuread_access_package_assignment_policy.approval_settings.approval_stage.primary_approver blocks sensitive to order

[tjrobinson]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritise this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritise the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform (and AzureAD Provider) Version

Terraform v1.7.3
on windows_amd64

terraform {
  required_providers {
    azuread = {
      source  = "hashicorp/azuread"
      version = "~> 2.47.0"
    }
  }

  required_version = "~> 1.7.3"
}

provider "azuread" {
  tenant_id = var.tenant_id
}

Affected Resource(s)

• azuread_access_package_assignment_policy

Terraform Configuration Files

Snippet for clarity. This sits inside the azuread_access_package_assignment_policy resource.

  approval_settings {
    approval_required                = true
    requestor_justification_required = true

    approval_stage {
      approval_timeout_in_days            = 14
      approver_justification_required     = true
      enable_alternative_approval_in_days = 0

      primary_approver {
        object_id    = data.azuread_user.user_324dffc003974e29bad573a1bbc1bfc9.object_id
        subject_type = "singleUser"
        backup       = false
      }

      primary_approver {
        object_id    = data.azuread_user.user_897bcad93e274dc29a64d6f1c9fdb1f6.object_id
        subject_type = "singleUser"
        backup       = false
      }

      primary_approver {
        object_id    = data.azuread_group.group_90194e51765a4bc79aa8c3db02c8504b.object_id
        subject_type = "groupMembers"
        backup       = false
      }

      primary_approver {
        object_id    = data.azuread_user.user_9cd981e493e647cb8cbe389ef832ee9d.object_id
        subject_type = "singleUser"
        backup       = false
      }
    }
  }

Expected Behavior

This is an existing access package and is being imported. There should be no changes to apply.

Actual Behavior

The plan wants to make updates in-place, to the ordering of the primary_approver blocks, despite there being no change in the end result and ordering is unimportant.

            ~ approval_stage {
                alternative_approval_enabled        = false
                approval_timeout_in_days            = 14
                approver_justification_required     = true
                enable_alternative_approval_in_days = 0

              ~ primary_approver {
                    backup       = false
                  ~ object_id    = "897bcad9-3e27-4dc2-9a64-d6f1c9fdb1f6" -> "324dffc0-0397-4e29-bad5-73a1bbc1bfc9"
                    subject_type = "singleUser"
                }
              ~ primary_approver {
                    backup       = false
                  ~ object_id    = "9cd981e4-93e6-47cb-8cbe-389ef832ee9d" -> "897bcad9-3e27-4dc2-9a64-d6f1c9fdb1f6"
                    subject_type = "singleUser"
                }
              ~ primary_approver {
                    backup       = false
                  ~ object_id    = "324dffc0-0397-4e29-bad5-73a1bbc1bfc9" -> "90194e51-765a-4bc7-9aa8-c3db02c8504b"
                  ~ subject_type = "singleUser" -> "groupMembers"
                }
              ~ primary_approver {
                    backup       = false
                  ~ object_id    = "90194e51-765a-4bc7-9aa8-c3db02c8504b" -> "9cd981e4-93e6-47cb-8cbe-389ef832ee9d"
                  ~ subject_type = "groupMembers" -> "singleUser"
                }
            }