Unable to create segments when segment approvals are enabled.

[ns-saggarwal]

Hi Team,

Recently we enabled segment approvals via LD UI for all our environments.
Since then we are unable to create segments via terraform. Below is the error we receive when trying to create a segment:

╷
│ Error: failed to update segment "test_segment" in project "test": 403 Forbidden: {"code":"forbidden","message":"approval is required"}
│
│   with module.segments["test_segment"].launchdarkly_segment.team-segment["non-prod"],
│   on ../modules/ld/segments/team_segment.tf line 12, in resource "launchdarkly_segment" "team-segment":
│   12: resource "launchdarkly_segment" "team-segment" {
│
╵

Below is the terraform plan output:

Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols:
  + create

Terraform will perform the following actions:

  # module.segments["test_segment"].launchdarkly_segment.team-segment["non-prod"] will be created
  + resource "launchdarkly_segment" "team-segment" {
      + creation_date          = (known after apply)
      + description            = "Onboarding test tenants"
      + env_key                = "non-prod"
      + id                     = (known after apply)
      + key                    = "test_segment"
      + name                   = "test_segment"
      + project_key            = "test"
      + tags                   = [
          + "standard-segment",
          + "terraform-managed",
        ]
      + unbounded              = false
      + unbounded_context_kind = (known after apply)
    }

AFAIU, this should be a create operation and approvals are required for update operations.

[sloloris]

Hi @ns-saggarwal,

Thank you for bringing this to our attention! This does indeed look like a bug. I will file an internal bug report and keep you updated here.

In the meantime, could you provide us with the following pieces of information to help speed up our investigation?

1. the exact version of the provider you are using
2. the create configuration that threw the error (feel free to change keys / names)
3. the base role and any segment-related role statements associated with the API key you are using, and how they were set up (i.e. inline role, custom role attached directly to service token, PAT (non-service token))

These will all make it it easier for us to test and rule things out. Thank you!

[ns-saggarwal]

Sure @sloloris ,
Please find the details below:

1. Provider version: 2.25.3
2. Create config:

resource "launchdarkly_segment" "team-segment" {
  for_each = toset(local.environments[*].key)


  project_key = var.ld_project
  env_key     = each.key
  key         = var.name
  name        = var.name
  description = var.description
  unbounded   = false
  tags = concat(
    [local.tag_managed_by_terraform, local.targeting_tags[var.targeting], local.type_tags[var.type]],
    var.migrated ? [local.tag_bulk_migration_resource] : []
  )

  dynamic "rules" {
    for_each = length(var.targeting_rule) > 0 ? [1] : []

    content {
      dynamic "clauses" {
        for_each = var.targeting_rule

        content {
          attribute    = clauses.value.context_attribute
          op           = clauses.value.operator
          values       = clauses.value.values
          negate       = false
          context_kind = clauses.value.context_kind
          value_type   = try(clauses.value.value_type, "string")
        }
      }
    }
  }

  lifecycle {
    ignore_changes = [excluded, excluded_contexts, included, included_contexts, rules]
  }
}

3. We are using a service token which has Admin base role assigned