ImportResourceState Errantly Includes timeouts in State

[bflad]

SDK version

2.24.0 / Terraform 1.3.8 specifically

Relevant provider source code

&schema.Resource{
	// ...
	Importer: &schema.ResourceImporter{
		StateContext: schema.ImportStatePassthroughContext,
	},
}

Or potentially any resource with:

• A non-refreshable attribute (e.g. "virtual" or "Terraform only" attribute)
• Import support
• No special import handling for that attribute

Terraform Configuration Files

terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "4.54.0"
    }
  }
  required_version = "1.3.8"
}

provider "aws" {
  region = "us-west-2"
}

resource "aws_security_group" "test" {
  name = "tf-acc-test-6316391654197628380-0"

  tags = {
    Name = "tf-acc-test-6316391654197628380"
  }
}

Expected Behavior

After importing a resource, Terraform plans should never contain anything relating to the SDK-defined timeouts block.

Actual Behavior

$ terraform plan -refresh=false                                                                  

Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols:
  ~ update in-place

Terraform will perform the following actions:

  # aws_security_group.test will be updated in-place
  ~ resource "aws_security_group" "test" {
        id                     = "sg-0329f3c7cf561ad15"
        name                   = "tf-acc-test-6316391654197628380-0"
      + revoke_rules_on_delete = false
        tags                   = {
            "Name" = "tf-acc-test-6316391654197628380"
        }
        # (7 unchanged attributes hidden)

      - timeouts {}
    }

Plan: 0 to add, 1 to change, 0 to destroy.

The imported state contains a timeouts single nested block with create and delete set to null.

$ ❯ terraform show -json | jq '.values.root_module.resources[] | select(.address == "aws_security_group.test") | .values'
{
  "arn": "arn:aws:ec2:us-west-2:--OMITTED--:security-group/sg-0329f3c7cf561ad15",
  "description": "Managed by Terraform",
  "egress": [],
  "id": "sg-0329f3c7cf561ad15",
  "ingress": [],
  "name": "tf-acc-test-6316391654197628380-0",
  "name_prefix": "",
  "owner_id": "--OMITTED--",
  "revoke_rules_on_delete": null,
  "tags": {
    "Name": "tf-acc-test-6316391654197628380"
  },
  "tags_all": {
    "Name": "tf-acc-test-6316391654197628380"
  },
  "timeouts": {
    "create": null,
    "delete": null
  },
  "vpc_id": "vpc-0c4883cac90b9bab6"
}

Steps to Reproduce

For aws_security_group:

• An AWS environment with an EC2 Security Group accessible for import
• terraform import aws_security_group.test sg-0329f3c7cf561ad15
• terraform plan or terraform plan -refresh=false

References

• Import/plan inconsistency introduced by 1.3.8 terraform#32661

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.