cloudflare_zero_trust_device_custom_profile_local_domain_fallback errors out on creation

[PI-Victor]

Confirmation

• This is a bug with an existing resource and is not a feature request or enhancement. Feature requests should be submitted with Cloudflare Support or your account team.
• I have searched the issue tracker and my issue isn't already found.
• I have replicated my issue using the latest version of the provider and it is still present.

Terraform and Cloudflare provider version

Terraform v1.11.3
on darwin_arm64

• provider registry.terraform.io/cloudflare/cloudflare v5.3.0
• provider registry.terraform.io/hashicorp/random v3.6.3

terraform {
  required_version = ">=1.10.0"

  required_providers {
    cloudflare = {
      source  = "cloudflare/cloudflare"
      version = "~> 5.3.0"
    }
    random = {
      source  = "hashicorp/random"
      version = "~> 3.6.2"
    }
  }
}

Affected resource(s)

cloudflare_zero_trust_device_custom_profile_local_domain_fallback

Terraform configuration files

resource "cloudflare_zero_trust_device_custom_profile" "warp_profiles" {
  account_id = local.account_id

  name       = "test-profile"
  precedence = 255
  match      = "os.name in {\"windows\" \"mac\"}"
}

resource "cloudflare_zero_trust_device_custom_profile_local_domain_fallback" "fallback_domains" {
  account_id = local.account_id

  policy_id = cloudflare_zero_trust_device_custom_profile.warp_profiles.id

  domains = [{
    suffix      = "example.com"
    description = "Example domain"
    dns_server  = ["1.1.1.1"]
  }]
}

Link to debug output

https://gist.github.com/PI-Victor/c25dec41d328e622544989001ed22e7a

Panic output

No response

Expected output

Although the resources are created, I expect the operation to not error out.

Actual output

➜  cloudflare-tf terraform apply

Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols:
  + create

Terraform will perform the following actions:

  # cloudflare_zero_trust_device_custom_profile.warp_profiles will be created
  + resource "cloudflare_zero_trust_device_custom_profile" "warp_profiles" {
      + account_id        = "redacted"
      + default           = (known after apply)
      + exclude           = (known after apply)
      + fallback_domains  = (known after apply)
      + gateway_unique_id = (known after apply)
      + id                = (known after apply)
      + include           = (known after apply)
      + match             = "os.name in {\"windows\" \"mac\"}"
      + name              = "test-profile"
      + policy_id         = (known after apply)
      + precedence        = 255
      + service_mode_v2   = (known after apply)
      + target_tests      = (known after apply)
    }

  # cloudflare_zero_trust_device_custom_profile_local_domain_fallback.fallback_domains will be created
  + resource "cloudflare_zero_trust_device_custom_profile_local_domain_fallback" "fallback_domains" {
      + account_id  = "redacted"
      + description = (known after apply)
      + dns_server  = (known after apply)
      + domains     = [
          + {
              + description = "Example domain"
              + dns_server  = [
                  + "1.1.1.1",
                ]
              + suffix      = "example.com"
            },
        ]
      + id          = (known after apply)
      + policy_id   = (known after apply)
      + suffix      = (known after apply)
    }

Plan: 2 to add, 0 to change, 0 to destroy.
╷
│ Warning: Resource Destruction Considerations
│
│   with cloudflare_zero_trust_device_custom_profile_local_domain_fallback.fallback_domains,
│   on fallback_domains.tf line 2, in resource "cloudflare_zero_trust_device_custom_profile_local_domain_fallback" "fallback_domains":
│    2: resource "cloudflare_zero_trust_device_custom_profile_local_domain_fallback" "fallback_domains" {
│
│ This resource cannot be destroyed from Terraform. If you create this resource, it will be present in the API until manually deleted.
╵

Do you want to perform these actions?
  Terraform will perform the actions described above.
  Only 'yes' will be accepted to approve.

  Enter a value: yes

cloudflare_zero_trust_device_custom_profile.warp_profiles: Creating...
cloudflare_zero_trust_device_custom_profile.warp_profiles: Creation complete after 0s [id=9704575c-12d8-48d8-a0c1-e28fcd541250]
cloudflare_zero_trust_device_custom_profile_local_domain_fallback.fallback_domains: Creating...
╷
│ Warning: Resource Destruction Considerations
│
│   with cloudflare_zero_trust_device_custom_profile_local_domain_fallback.fallback_domains,
│   on fallback_domains.tf line 2, in resource "cloudflare_zero_trust_device_custom_profile_local_domain_fallback" "fallback_domains":
│    2: resource "cloudflare_zero_trust_device_custom_profile_local_domain_fallback" "fallback_domains" {
│
│ This resource cannot be destroyed from Terraform. If you create this resource, it will be present in the API until manually deleted.
╵
╷
│ Error: Provider returned invalid result object after apply
│
│ After the apply operation, the provider still indicated an unknown value for
│ cloudflare_zero_trust_device_custom_profile_local_domain_fallback.fallback_domains.description. All values must be known after apply, so this is always a bug in
│ the provider and should be reported in the provider's own repository. Terraform will still save the other known object values in the state.
╵
╷
│ Error: Provider returned invalid result object after apply
│
│ After the apply operation, the provider still indicated an unknown value for
│ cloudflare_zero_trust_device_custom_profile_local_domain_fallback.fallback_domains.dns_server. All values must be known after apply, so this is always a bug in
│ the provider and should be reported in the provider's own repository. Terraform will still save the other known object values in the state.
╵
╷
│ Error: Provider returned invalid result object after apply
│
│ After the apply operation, the provider still indicated an unknown value for
│ cloudflare_zero_trust_device_custom_profile_local_domain_fallback.fallback_domains.suffix. All values must be known after apply, so this is always a bug in the
│ provider and should be reported in the provider's own repository. Terraform will still save the other known object values in the state.
╵

Steps to reproduce

Create a new resource with the above mentioned config.
terraform apply <- errors out.

Additional factoids

No response

References

No response

[jhutchings1]

We're opening an issue to track in our internal system.