v3 Provider Issues

[deutmeyerbrianpfg]

The update from the v2 to v3 was suspect, to say the least. Now that we are on v3.2.0, we are still seeing various things:

1. Continuous drift on services for both TCP and UDP. We didn't have aggressive aging defined, which the docs still say optional, but not having it produces the following output:

 # checkpoint_management_service_udp.this["123"] will be updated in-place
  ~ resource "checkpoint_management_service_udp" "this" {
        id                                              = "12345"
        name                                            = "udp123"
        # (13 unchanged attributes hidden)

      - aggressive_aging {
          - default_timeout     = 0 -> null
          - enable              = true -> null
          - timeout             = 15 -> null
          - use_default_timeout = true -> null
        }
    }

Even adding the block, you must choose between use_default_timeout and timeout. Which ever one you don't use, that will continually drift as well.

2. Continuous drift on access rules. Same as the service, action_settings and custom_fields are both optional, but produce a change every time terraform is run.

  # checkpoint_management_access_rule.this will be updated in-place
  ~ resource "checkpoint_management_access_rule" "this" {
        id                 = "12345"
        name               = "my special rule"
        # (19 unchanged attributes hidden)
      - action_settings {}
      - custom_fields {
            # (3 unchanged attributes hidden)
        }
        # (2 unchanged blocks hidden)
    }

3. Changing just the UPD/TCP service aggressive aging default timeout resulting in error:

  # checkpoint_management_service_tcp.this["8080"] will be updated in-place
  ~ resource "checkpoint_management_service_tcp" "this" {
        id                                              = "56789"
        # (12 unchanged attributes hidden)

      ~ aggressive_aging {
          ~ default_timeout     = 0 -> 600
            # (3 unchanged attributes hidden)
        }
    }

╷
│ Error: Failed to execute API call
│ Status: 400 Bad Request
│ Code: generic_err_invalid_parameter
│ Message: This API request must contain only one of these - "use-default-timeout = true" or "timeout = <value>"
│ 
│   with checkpoint_management_service_tcp.this["8080"],
│   on services.tf line 11, in resource "checkpoint_management_service_tcp" "this":
│   11: resource "checkpoint_management_service_tcp" "this" {
│ 
╵

[chkp-tomerassa]

Hi @deutmeyerbrianpfg,

Regarding the plan diff for aggressive_aging / action_settings / custom_fields:
This is expected behavior. The provider's state policy is to capture all schema attributes into Terraform state and keep them current, as stated in the documentation. The management API always returns these blocks, so the read records them into state even when you don't declare them in your config. That produces a diff on every plan when the block is omitted from config.

However, applying this diff does not change anything on the server. When the block isn't in your configuration, the provider doesn't send any instruction about it during the update, so the object on the management server is left exactly as-is.

Regarding the 400 Bad Request when changing the timeouts:
The API accepts only one of use-default-timeout = true or timeout = — never both. The error appears because state holds both, so the update sends them together. Set use_default_timeout explicitly and provide only its matching field.

Best regards,
Tomer