tls_cert_request not recreated when private_key_pem changes

CHANGELOG.md

@@ -1,3 +1,11 @@
+## 4.0.2 (unreleased)
+
+BUG FIXES:
+
+* resource/tls_cert_request: Fix regexp in attribute plan modifier to correctly match PEM ([#255](https://github.com/hashicorp/terraform-provider-tls/issues/255)).
+* resource/tls_locally_signed_cert: Fix regexp in attribute plan modifier to correctly match PEM ([#255](https://github.com/hashicorp/terraform-provider-tls/issues/255)).
+* resource/tls_self_signed_cert: Fix regexp in attribute plan modifier to correctly match PEM ([#255](https://github.com/hashicorp/terraform-provider-tls/issues/255)).
+
 ## 4.0.1 (July 25, 2022)
 
 BUG FIXES:

go.mod

@@ -9,9 +9,9 @@ require (
 	github.com/hashicorp/terraform-plugin-docs v0.13.0
 	github.com/hashicorp/terraform-plugin-framework v0.11.0
 	github.com/hashicorp/terraform-plugin-framework-validators v0.4.0
-	github.com/hashicorp/terraform-plugin-go v0.13.0
+	github.com/hashicorp/terraform-plugin-go v0.14.0
 	github.com/hashicorp/terraform-plugin-log v0.7.0
-	github.com/hashicorp/terraform-plugin-sdk/v2 v2.20.0
+	github.com/hashicorp/terraform-plugin-sdk/v2 v2.21.0
 	golang.org/x/crypto v0.0.0-20220722155217-630584e8d5aa
 	golang.org/x/net v0.0.0-20220728153142-1f511ac62c11
 )

go.sum

@@ -147,12 +147,12 @@ github.com/hashicorp/terraform-plugin-framework v0.11.0 h1:NLWMUMNp0HjCjJctNzEv3
 github.com/hashicorp/terraform-plugin-framework v0.11.0/go.mod h1:gVjHP7o0QzWpHe5dvA+GUu+mH0/vQDZeexkkq2RS/II=
 github.com/hashicorp/terraform-plugin-framework-validators v0.4.0 h1:GVX4gDFdtFZi/E4DjvPmRDf5zBLFAHi8M7Qzehgov+Q=
 github.com/hashicorp/terraform-plugin-framework-validators v0.4.0/go.mod h1:hkGjFzftzT/HRe1It0e8//tGZ3j18PedTq4hHS8NJ/Q=
-github.com/hashicorp/terraform-plugin-go v0.13.0 h1:Zm+o91HUOcTLotaEu3X2jV/6wNi6f09gkZwGg/MDvCk=
-github.com/hashicorp/terraform-plugin-go v0.13.0/go.mod h1:NYGFEM9GeRdSl52txue3RcBDFt2tufaqS22iURP8Bxs=
+github.com/hashicorp/terraform-plugin-go v0.14.0 h1:ttnSlS8bz3ZPYbMb84DpcPhY4F5DsQtcAS7cHo8uvP4=
+github.com/hashicorp/terraform-plugin-go v0.14.0/go.mod h1:2nNCBeRLaenyQEi78xrGrs9hMbulveqG/zDMQSvVJTE=
 github.com/hashicorp/terraform-plugin-log v0.7.0 h1:SDxJUyT8TwN4l5b5/VkiTIaQgY6R+Y2BQ0sRZftGKQs=
 github.com/hashicorp/terraform-plugin-log v0.7.0/go.mod h1:p4R1jWBXRTvL4odmEkFfDdhUjHf9zcs/BCoNHAc7IK4=
-github.com/hashicorp/terraform-plugin-sdk/v2 v2.20.0 h1:+KxZULPsbjpAVoP0WNj/8aVW6EqpcX5JcUcQ5wl7Da4=
-github.com/hashicorp/terraform-plugin-sdk/v2 v2.20.0/go.mod h1:DwGJG3KNxIPluVk6hexvDfYR/MS/eKGpiztJoT3Bbbw=
+github.com/hashicorp/terraform-plugin-sdk/v2 v2.21.0 h1:eIJjFlI4k6BMso6Wq/bq56U0RukXc4JbwJJ8Oze2/tg=
+github.com/hashicorp/terraform-plugin-sdk/v2 v2.21.0/go.mod h1:mYPs/uchNcBq7AclQv9QUtSf9iNcfp1Ag21jqTlDf2M=
 github.com/hashicorp/terraform-registry-address v0.0.0-20220623143253-7d51757b572c h1:D8aRO6+mTqHfLsK/BC3j5OAoogv1WLRWzY1AaTo3rBg=
 github.com/hashicorp/terraform-registry-address v0.0.0-20220623143253-7d51757b572c/go.mod h1:Wn3Na71knbXc1G8Lh+yu/dQWWJeFQEpDeJMtWMtlmNI=
 github.com/hashicorp/terraform-svchost v0.0.0-20200729002733-f050f53b9734 h1:HKLsbzeOsfXmKNpr3GiT18XAblV0BjCbzL8KQAMZGa0=

internal/provider/common.go

@@ -72,7 +72,7 @@ func requireReplaceIfStateContainsPEMString() tfsdk.AttributePlanModifier {
 		stateValue := state.(types.String).Value
 
 		// If the value is indeed a PEM, and
-		if regexp.MustCompile(`^-----BEGIN [[:alpha:]]+-----\n(.|\s)+\n-----END [[:alpha:]]+-----\n$`).MatchString(stateValue) {
+		if regexp.MustCompile(`^-----BEGIN [[:alpha:] ]+-----\n(.|\s)+\n-----END [[:alpha:] ]+-----\n?$`).MatchString(stateValue) {
 			return true, nil
 		}
 

internal/provider/resource_cert_request_test.go

@@ -2,12 +2,15 @@ package provider
 
 import (
 	"crypto/x509/pkix"
+	"fmt"
 	"net"
 	"net/url"
 	"regexp"
 	"testing"
 
 	r "github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+
 	tu "github.com/hashicorp/terraform-provider-tls/internal/provider/testutils"
 )
 
@@ -413,3 +416,81 @@ func TestResourceCertRequest_PKCS8(t *testing.T) {
 		},
 	})
 }
+
+func TestResourceCertRequest_PrivateKeyPEM(t *testing.T) {
+	var pkp1, pkp2 string
+	resourceName := "tls_cert_request.client_csr"
+
+	r.UnitTest(t, r.TestCase{
+		ProtoV5ProviderFactories: protoV5ProviderFactories(),
+		Steps: []r.TestStep{
+			{
+				Config: tlsCertRequest,
+				Check: r.ComposeAggregateTestCheckFunc(
+					testExtractResourceAttr(resourceName, "private_key_pem", &pkp1),
+				),
+			},
+			{
+				Taint:  []string{"tls_private_key.this"},
+				Config: tlsCertRequest,
+				Check: r.ComposeAggregateTestCheckFunc(
+					testExtractResourceAttr(resourceName, "private_key_pem", &pkp2),
+					testCheckAttributeValuesDiffer(&pkp1, &pkp2),
+				),
+			},
+		},
+	})
+}
+
+const tlsCertRequest = `
+resource "tls_private_key" "this" {
+  algorithm = "RSA"
+  rsa_bits  = 4096
+}
+
+resource "tls_cert_request" "client_csr" {
+  private_key_pem = tls_private_key.this.private_key_pem
+
+  subject {
+    common_name = "this"
+  }
+}
+`
+
+func testExtractResourceAttr(resourceName string, attributeName string, attributeValue *string) r.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[resourceName]
+
+		if !ok {
+			return fmt.Errorf("resource name %s not found in state", resourceName)
+		}
+
+		attrValue, ok := rs.Primary.Attributes[attributeName]
+
+		if !ok {
+			return fmt.Errorf("attribute %s not found in resource %s state", attributeName, resourceName)
+		}
+
+		*attributeValue = attrValue
+
+		return nil
+	}
+}
+
+func testCheckAttributeValuesDiffer(i *string, j *string) r.TestCheckFunc {
+	return func(s *terraform.State) error {
+		if testStringValue(i) == testStringValue(j) {
+			return fmt.Errorf("attribute values are the same")
+		}
+
+		return nil
+	}
+}
+
+func testStringValue(sPtr *string) string {
+	if sPtr == nil {
+		return ""
+	}
+
+	return *sPtr
+}