ad_group_membership does not permit declaration of an empty group

[isometry]

Terraform Version and Provider Version

Terraform v1.3.7
on darwin_amd64
+ provider registry.terraform.io/hashicorp/ad v0.4.4
+ provider registry.terraform.io/hashicorp/local v2.2.3

Windows Version

Windows Server 2019 Datacenter

Affected Resource(s)

• ad_group_membership

Terraform Configuration Files

resource "ad_group" "test" {
  container = "OU=Groups,DC=example,DC=com"

  name             = "Test"
  sam_account_name = "Test"
}
resource "ad_group_membership" "test" {
  group_id      = ad_group.test.id
  group_members = []
}

Expected Behavior

• AD group Test should be created with explicitly no members.
• Any changes to the membership of "Test" outside of Terraform should be detected and reverted the next time Terraform runs.

Actual Behavior

• The ad_group_membership resource enforces MinItems: 1, and so will not permit explicit assignment of zero members.

Steps to Reproduce

Important Factoids

We have partially worked around this issue with for_each = { for group, members in local.group_members : group => members if length(members) > 0 } logic on our ad_group_membership resources, but have recently found that this does not consistently remove members when a given keys' members transitions to empty.

References

• Fixed by fix: permit explicitly empty group membership #166

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment