[Bug]: Allow from anywhere in project IP Access List is not managed correctly

[gabrimonfa]

Is there an existing issue for this?

• I have searched the existing issues

Provider Version

2.6.0

Terraform Version

1.3.5

Terraform Edition

Terraform Open Source (OSS)

Current Behavior

I've create via terraform an advanced cluster.
I've also created an mongodbatlas_project_ip_access_list resource to add a cidr for ip access list.
The resource has been correctly added, but the "allow anywhere" 0.0.0.0/0 has not been deleted.
This may lead to think that access is properly restricted when it is not.

Moreover if I create a new terraform plan, no drift is detected, as if the allow anywhere rule were not present, but it is.

Finally If manually add new rules via the portal, the plan seems to refresh the state only of my added rule and to ignore other rules.
It is unconvenient to delete manually the allow anywhere rule and if someone add new rules I have no way to fix the drift via terraform if it is not detected correctly.

Am I doing something wrong? Is this intended? In any case it seems a surprising behaviour.

Terraform configuration to reproduce the issue

terraform {
  required_version = "~> 1.3.5"

  required_providers {
    mongodbatlas = {
      source  = "mongodb/mongodbatlas"
      version = ">=2.6.0, <3.0.0"
    }
    # other providers
  }
}

resource "mongodbatlas_advanced_cluster" "cluster" {
  project_id = var.project_id
  # other configurations
}

resource "mongodbatlas_project_ip_access_list" "ip" {
  for_each   = var.ip_access_list
  project_id = var.project_id
  cidr_block = each.value.cidr_block
  comment    = each.value.comment
}

Steps To Reproduce

1. create a cluster with a mongodbatlas_project_ip_access_list resource
2. manually create new rules through the portal
3. run terraform apply again
4. the added rules are not deleted, no drift is detected.

Logs

Code of Conduct

• I agree to follow this project's Code of Conduct

[github-actions]

Thanks for opening this issue! Please make sure you've followed our guidelines when opening the issue. In short, to help us reproduce the issue we need:

• Terraform configuration file used to reproduce the issue
• Terraform log files from the run where the issue occurred
• Terraform Atlas provider version used to reproduce the issue
• Terraform version used to reproduce the issue
• Confirmation if Terraform OSS, Terraform Cloud, or Terraform Enterprise deployment

The ticket CLOUDP-379434 was created for internal tracking.

[lantoli]

Thanks @gabrimonfa for opening the issue.

mongodbatlas_project_ip_access_list resource refers to a single entry, not the full list. When you use for_each you're creating multiple resources (multiple IP entries), but any existing entry in Atlas that is not backed by a Terraform resource won't be deleted or detected as drift. This is standard Terraform behavior as Terraform only manages resources defined in your configuration.

To manage all IP entries with Terraform, you need to import the existing entries first. After importing, you can modify or delete them through Terraform as usual.

If it helps, you can use the plural data source to list all existing entries in a project and identify what needs to be imported.

We have plans to improve the experience with IP access list entries but can't share a timeline at this moment.

If you have any other questions, please don't hesitate to ask.