elastic / elastic/terraform-provider-elasticstack

[Bug] elasticstack_kibana_alerting_rule creation fails because Elastic adds an unexpected tag

Open
#4,292 6 comments 0 reactions 0 assignees View on GitHub
bug needs-reproduction needs-review phase-specification triaged
Dominant language
Go
Stars
209
Forks
150
Avg merge
22h 58m
Merged PRs (30d)
172

Description

**Describe the bug**

Creating an elasticstack_kibana_alerting_rule resource fails because the rule returned by Kibana contains an additional tag that was not defined in the Terraform configuration:

> Missing Universal Api Key

The rule is created successfully in Kibana, but Terraform reports an inconsistent result because the returned tags value differs from the configured value.

**To Reproduce**

Steps to reproduce the behavior:

Create an alerting rule with explicitly defined tags:

```hcl
resource "elasticstack_kibana_alerting_rule" "alert" {
name = ""
rule_type_id = ""
consumer = ""
enabled = true

tags = [
"managed-by-terraform"
]

params = jsonencode({
# Rule parameters
})
}
```

Execute:

> terraform apply

The rule is created in Kibana, but Kibana returns an additional tag:
```hcl
{
"tags": [
"managed-by-terraform",
"Missing Universal Api Key"
]
}
```

Terraform fails because the value returned by the provider does not match the configured tags value:

> │ Error: Provider produced inconsistent result after apply
> │
> │ When applying changes to
> │ [...].module.alert.elasticstack_kibana_alerting_rule.main,
> │ provider "provider[\"registry.terraform.io/elastic/elasticstack\"]"
> │ produced an unexpected new value: .tags: actual set element
> │ cty.StringVal("Missing Universal Api Key") does not correlate with any
> │ element in plan.
> │
> │ This is a bug in the provider, which should be reported in the provider's
> │ own issue tracker.

Running terraform plan again also shows drift for the tags attribute.

**Expected behavior**
The alerting rule should be created with only the tags defined in the Terraform configuration.

If Missing Universal Api Key is server-managed metadata, the provider should handle it separately or prevent it from causing an inconsistent result for the user-managed tags attribute.

Ideally, the underlying API-key issue should also be returned as an explicit error rather than being added as a rule tag.

**Versions (please complete the following information):**
- OS: Linux
- Terraform Version 1.13.1
- Provider version 0.16.1
- Elasticsearch Version Serverless Security

**Additional context**
The additional tag appears to indicate that Kibana could not create or associate the API key required to execute the rule.

Adding the tag to the Terraform configuration is not a suitable workaround because it treats an operational error as desired configuration.

Using the following also hides legitimate tag drift:

>
> lifecycle {
> ignore_changes = [tags]
> }
>

It is unclear whether the underlying issue is:

Kibana adding operational status information to the user-managed tags field

the provider failing to create or update the rule execution API key

the provider not accounting for server-managed tags in the API response

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by reproducing the failure with the elasticstack_kibana_alerting_rule resource and inspect its tag handling and Kibana API response. Determine whether “Missing Universal Api Key” is server-managed metadata or an API-key failure; done means Terraform no longer reports inconsistent user-managed tags and the underlying failure is surfaced explicitly.

Written by the indexing model from the issue text.

Assessment

Tech stack
go, terraform
Domain
backend, tooling
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Active
Clarity
Needs clarification
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.