Not possible to change ddos_protection mode in fastly_service_vcl resource
bug
Hi team,
We noticed strange behaviour for resource [fastly_service_vcl](https://registry.terraform.io/providers/fastly/fastly/latest/docs/resources/service_vcl). It's not possible to change DDoS protection mode for CDN service.
Steps to reproduce are described below.
1. Create Terraform snippet in `main.tf`. It should provision new CDN service with DDoS protection in blocking mode:
```tf
terraform {
required_providers {
fastly = {
source = "fastly/fastly"
version = "8.4.0"
}
}
}
provider "fastly" {
# Configuration options
}
resource "fastly_service_vcl" "demo" {
name = "demofastly"
domain {
name = "demo.example.com"
comment = "demo"
}
backend {
address = "127.0.0.1"
name = "localhost"
port = 80
}
product_enablement {
ddos_protection {
enabled = true
mode = "block"
}
}
force_destroy = true
}
```
2. Set up API key for authentication:
```sh
export FASTLY_API_KEY=******
```
3. Run Terraform init and apply:
```sh
terraform init
terraform apply
```
Terraform plan is available below:
```sh
Terraform will perform the following actions:
# fastly_service_vcl.demo will be created
+ resource "fastly_service_vcl" "demo" {
+ activate = true
+ active_version = (known after apply)
+ cloned_version = (known after apply)
+ comment = "Managed by Terraform"
+ default_ttl = 3600
+ force_destroy = true
+ force_refresh = (known after apply)
+ http3 = false
+ id = (known after apply)
+ imported = (known after apply)
+ name = "demofastly"
+ stage = false
+ staged_version = (known after apply)
+ stale_if_error = false
+ stale_if_error_ttl = 43200
+ backend {
# At least one attribute in this block is (or was) sensitive,
# so its contents will not be displayed.
}
+ domain {
+ comment = "demo"
+ name = "demo.example.com"
}
+ product_enablement {
+ name = "products"
+ ddos_protection {
+ enabled = true
+ mode = "block"
}
}
}
Plan: 1 to add, 0 to change, 0 to destroy.
```
4. Log in to Fastly console https://manage.fastly.com/ and check CDN service `demofastly`. As you can see DDoS protection is set with expected value "Blocking" and service has version 1:
<img width="3154" height="672" alt="Image" src="https://github.com/user-attachments/assets/9eebbb2b-155b-48d6-973e-a102694befd8" />
5. Update existing Terraform snippet and set in block `ddos_protection` attribute `mode` to `"log"` value:
```tf
terraform {
required_providers {
fastly = {
source = "fastly/fastly"
version = "8.4.0"
}
}
}
provider "fastly" {
# Configuration options
}
resource "fastly_service_vcl" "demo" {
name = "demofastly"
domain {
name = "demo.example.com"
comment = "demo"
}
backend {
address = "127.0.0.1"
name = "localhost"
port = 80
}
product_enablement {
ddos_protection {
enabled = true
mode = "log"
}
}
force_destroy = true
}
```
6. Run apply again. Terraform plan now is :
```sh
# fastly_service_vcl.demo will be updated in-place
~ resource "fastly_service_vcl" "demo" {
~ active_version = 2 -> (known after apply)
~ cloned_version = 2 -> (known after apply)
id = "*****"
name = "demofastly"
# (10 unchanged attributes hidden)
- product_enablement {
- api_discovery = false -> null
- bot_management = false -> null
- brotli_compression = false -> null
- domain_inspector = false -> null
- image_optimizer = false -> null
- log_explorer_insights = false -> null
- name = "products" -> null
- origin_inspector = false -> null
- websockets = false -> null
- ddos_protection {
- enabled = true -> null
- mode = "block" -> null
}
}
+ product_enablement {
+ name = "products"
+ ddos_protection {
+ enabled = true
+ mode = "log"
}
}
# (2 unchanged blocks hidden)
}
Plan: 0 to add, 1 to change, 0 to destroy.
```
7. Check CDN service `demofastly` configuration in admin console again. Now it shows active version 2, but DDoS protection mode is still "Blocking":
<img width="3164" height="710" alt="Image" src="https://github.com/user-attachments/assets/5f4a150a-f82e-44ae-a7ef-4c051c4ba779" />
I tried to compare version 1 and 2, but there is no change at all:
<img width="1250" height="324" alt="Image" src="https://github.com/user-attachments/assets/7445988d-5863-42e9-a3d4-fb804f122567" />
Any new attempts to run Terraform plan or apply will show the same configuration drift, but in fact Terraform does not change DDoS protection mode.
Could you please investigate this case? It's relevant for latest provider (version `8.4.0`) as well.
Thank you.
3 条评论