Empty Array Treated as Nil in Firewall source_ranges property

[JakeCooper]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request.
• Please do not leave +1 or me too comments, they generate extra noise for issue followers and do not help prioritize the request.
• If you are interested in working on this issue or have submitted a pull request, please leave a comment.
• If an issue is assigned to a user, that user is claiming responsibility for the issue.
• Customers working with a Google Technical Account Manager or Customer Engineer can ask them to reach out internally to expedite investigation and resolution of this issue.

Terraform Version & Provider Version(s)

Terraform vX.X.X
on

• provider registry.terraform.io/hashicorp/google vX.X.X
• provider registry.terraform.io/hashicorp/google-beta vX.X.X

Affected Resource(s)

google_compute_firewall

Terraform Configuration

resource "google_compute_firewall" "ddos_block" {
  name          = "ddos-block"
  project       = local.project
  network       = module.railway_network.network_id
  direction     = "INGRESS"
  source_ranges = []
  priority      = 1

  deny {
    protocol = "all"
  }
}

Debug Output

No response

Expected Behavior

Based on understanding of something is provided, just empty string, the provider should likely throw an error or no-op

Actual Behavior

What happens instead is the Firewall rule is applied to everything, instead of the "source_ranges" of none

While this behavior technically makes sense (since Golang interprets the empty array as nil), it's a pretty large footgun if someone empties a list and applies it

Steps to reproduce

1. terraform apply

Important Factoids

This footgun caused an outage. https://blog.railway.com/p/incident-december-16-2024

References

No response

b/385405821

[shuyama1]

Yeah, I believe empty array is considered as nil indicating that no source_ranges are specified. We could explicitly document this case to avoid any confusion.