Wrongly required update in-place for sorting identities array

[jpenna]

I'm using azapi 2.0.0-beta.

It is updating the order of the identity_ids array, which I didn't change in the .tf file. Configuration:

resource "azapi_resource" "ai_service" {
  type      = "Microsoft.App/containerApps@2024-03-01"
  name      = "<NAME>"
  location  = module.consts.location
  parent_id = var.resource_group_id

  identity {
    type         = "UserAssigned"
    identity_ids = [var.acr_umi_id, azurerm_user_assigned_identity.kv_access_identity.id]
  }

  body = {
    properties = {
      environmentId = var.ca_env_id
      configuration = {
        activeRevisionsMode = "Single"

        registries = [{
          server   = var.acr_server
          identity = var.acr_umi_id
        }]
      }


      template = {
        terminationGracePeriodSeconds = 15

        scale = {
          minReplicas = 0
          maxReplicas = 1
        }

        serviceBinds = [{
          name      = "postgresql"
          serviceId = var.postgresql_app_id
        }]

        containers = [{
          name  = local.container_name
          image = "${var.acr_server}/ai_service:${var.rs_version}"
        }]
      }
    }
  }
}

Plan output

Check identify.identify_ids:

    # module.ai_service_container_app.azapi_resource.ai_service will be updated in-place
  ~ resource "azapi_resource" "ai_service" {
      ~ body                      = {
          ~ properties = {
              ~ configuration = {
                  ~ ingress             = {
                      + transport  = "tcp"
                        # (3 unchanged attributes hidden)
                    }
                    # (3 unchanged attributes hidden)
                }
                # (2 unchanged attributes hidden)
            }
        }
        id                        = "/subscriptions/<SUBS_ID>/resourceGroups/<RG>/providers/Microsoft.App/containerApps/<NAME>"
        name                      = "<NAME>"
      ~ output                    = {} -> (known after apply)
        # (6 unchanged attributes hidden)

      ~ identity {
          ~ identity_ids = [
              - "/subscriptions/<SUBS_ID>/resourceGroups/<RG>/providers/Microsoft.ManagedIdentity/userAssignedIdentities/<KV_NAME>",
                "/subscriptions/<SUBS_ID>/resourceGroups/<RG>/providers/Microsoft.ManagedIdentity/userAssignedIdentities/<ACR_NAME>",
              + "/subscriptions/<SUBS_ID>/resourceGroups/<RG>/providers/Microsoft.ManagedIdentity/userAssignedIdentities/<KV_NAME>",
            ]
          + principal_id = (known after apply)
          + tenant_id    = (known after apply)
            # (1 unchanged attribute hidden)
        }
    }

Quickfix to stop updating

resource "azapi_resource" "ai_service" {
...
  lifecycle {
    ignore_changes = [
      identity,
    ]
  }
}

[matt-FFFFFF]

Perhaps identity_ids should be a set, rather than a list

[matt-FFFFFF]

Here, this should be a set I think:

terraform-provider-azapi/internal/services/azapi_resource.go

Line 329 in 4685e2d

"identity_ids": schema.ListAttribute{