Breaking change of null keeper values between 3.3.2 and 3.4.0

[danielvoros-form3]

Terraform CLI and Provider Versions

Terraform v1.1.6
on linux_amd64

• provider registry.terraform.io/hashicorp/random v3.4.0

Terraform Configuration

terraform {
  required_providers {
    random = {
      source = "hashicorp/random"
      version = "3.4.0"
    }
  }
}

provider "random" {
  # Configuration options
}

resource "random_integer" "rnd" {
    min = 1
    max = 100
    keepers = {
        "key" = null
    }
}

Expected Behavior

Changing the provider version from 3.3.2 to 3.4.0 shouldn't force a replacement.

Actual Behavior

Running a plan of the terraform code above with the provider version set to 3.3.2 and then with 3.4.0 forces a replacement. Apparently null keys have started to appear in the state with 3.4.0 while they weren't added to the state before.

Steps to Reproduce

1. set provider version to 3.3.2
2. terraform init + terraform apply
3. set provider version to 3.4.0
4. terraform init -upgrade
5. terraform plan

Plan should be empty but it wants to recreate the resource instead:

Terraform will perform the following actions:                                                                                                                                                                                     
                                                                                                                                                                                                                                  
  # random_integer.rnd must be replaced                                                                                                                                                                                           
-/+ resource "random_integer" "rnd" {                                                                                                                                                                                             
      ~ id      = "21" -> (known after apply)                                                                                                                                                                                     
      + keepers = {                                                                                                                                                                                                               
          + "key" = null                                                                                                                                                                                                          
        } # forces replacement                                                                                                                                                                                                    
      ~ result  = 21 -> (known after apply)                                                                                                                                                                                       
        # (2 unchanged attributes hidden)                                                                                                                                                                                         
    }                                                                                                                                                                                                                             
                                                                                                                                                                                                                                  
Plan: 1 to add, 0 to change, 1 to destroy.

How much impact is this issue causing?

High

Logs

No response

Additional Information

No response

Code of Conduct

• I agree to follow this project's Code of Conduct

[anGie44]

Hey all 👋 I'm also seeing this when upgrading from version 3.3.2 to 3.4.1

my configuration:

terraform {
  required_providers{
    random = {
      version = "3.4.1"
    }
  }
}

resource "random_password" "datadog" {
  length           = 48
  override_special = "_-"

  keepers = {
    password_change_serial = var.example_null
  }
}

variable "example_null" {
  type        = string
  default     = null
}

After applying with 3.3.2 and subsequently upgrading to the latest provider version i get the following during plan:

$ terraform plan
random_password.datadog: Refreshing state... [id=none]

Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols:
-/+ destroy and then create replacement

Terraform will perform the following actions:

  # random_password.datadog must be replaced
-/+ resource "random_password" "datadog" {
      ~ bcrypt_hash      = (sensitive value)
      ~ id               = "none" -> (known after apply)
      + keepers          = {
          + "password_change_serial" = null
        } # forces replacement
      ~ result           = (sensitive value)
        # (11 unchanged attributes hidden)
    }

Plan: 1 to add, 0 to change, 1 to destroy.

────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────

Note: You didn't use the -out option to save this plan, so Terraform can't guarantee to take exactly these actions if you run "terraform apply" now.

full debug logs available at: https://gist.github.com/anGie44/75fef54e198d1828c97dce3faf6831ee

The line that maybe is suspect though not familiar enough to be sure:

2022-08-31T21:01:26.038-0400 [WARN]  provider.terraform-provider-random_v3.4.1_x5: Discarding incompatible resource private state data: @caller=github.com/hashicorp/terraform-plugin-framework@v0.11.1/internal/privatestate/data.go:127 error="illegal base64 data at input byte 0" tf_provider_addr=registry.terraform.io/hashicorp/random tf_req_id=8a62815b-ac83-3b51-f217-77bb911e8c99 @module=sdk.framework tf_resource_type=random_password tf_rpc=ReadResource timestamp=2022-08-31T21:01:26.038-0400

Oh nvm i see was intentional (hashicorp/terraform-plugin-framework#452) 😅