`okta_app_signon_policy` fails on 404 during Read when authentication policy was deleted outside Terraform

[maronnjapan]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request.
• Please do not leave +1 or me too comments, they generate extra noise for issue followers and do not help prioritize the request.
• If you are interested in working on this issue or have submitted a pull request, please leave a comment.
  Before submitting a bug report, we ask that you first search existing issues and pull requests to see if someone else may have experienced the same issue or may have already submitted a fix for it. This helps to keep all relevant information in one place, including any potential workarounds.

A Note on Terraform Core Issues

We also ask that you consider whether your issue may be related to Terraform Core. If you are running into one of the following scenarios, we recommend opening an issue in the Terraform Core repository instead:

• Configuration Language or resource ordering issues
• State and State Backend issues
• Provisioner issues
• Registry issues
• Issues that span resources across multiple providers

Terraform Version & Okta Provider Version(s)

erraform v1.14.1
+ provider registry.terraform.io/providers/okta/okta/ v6.12.x   (source = "okta/okta", version = "~> 6.12.0")

Affected Resource(s)

• okta_app_signon_policy

Can this be done in the Admin UI?

Yes

Can this be done in the actual API call?

No

Customer Information

Organization Name: integrator-9180109
Paid Customer: no

Terraform Configuration

terraform {
  required_version = ">= 1.6.0"

  required_providers {
    okta = {
      source  = "okta/okta"
      version = "~> 6.12.0"
    }
  }
}

variable "okta_org_name" {
  description = "Okta org subdomain. For https://dev-123456.okta.com, use dev-123456."
  type        = string
  nullable    = false
}

variable "okta_base_url" {
  description = "Okta org domain suffix, for example okta.com, oktapreview.com, or okta-emea.com."
  type        = string
  default     = "okta.com"
  nullable    = false
}

variable "okta_api_token" {
  description = "Okta API token. Set this for API token auth; leave null when using OAuth service app auth."
  type        = string
  default     = null
  sensitive   = false
}

provider "okta" {
  org_name = var.okta_org_name
  base_url = var.okta_base_url
  api_token = var.okta_api_token
}

resource "okta_app_signon_policy" "example" { 
    name = "example-authentication-policy" 
    description = "managed by terraform"
}

Debug Output

https://gist.github.com/maronnjapan/963f8eaa4a769ea0966859298fc2024e

Expected Behavior

When an okta_app_signon_policy tracked in Terraform state no longer exists remotely, for example because it was deleted outside of Terraform, running terraform plan or terraform apply should not abort during the refresh / Read phase.

The provider should handle the "resource no longer exists" case gracefully so Terraform can continue and produce a plan or diff.

This is the behavior described in the Terraform Plugin Framework documentation for Read:

Ignore returning errors that signify the resource is no longer existent, call the response state RemoveResource() method, and return early.

• https://developer.hashicorp.com/terraform/plugin/framework/resources/read

A 404 returned for an already-deleted authentication policy should therefore be treated as a not-found condition and handled according to the above guidance, rather than surfaced as a hard error that stops the run before Terraform can show a diff.

The exact remediation is left to the maintainers' discretion, but the current behavior appears inconsistent with the expected handling of remotely deleted resources.

Actual Behavior

When the policy no longer exists in the Okta org, GetPolicy returns HTTP 404 during the refresh / Read phase.

The provider surfaces this directly as an error and aborts the run before any diff is displayed:

│ Error: failed to read access policy
│
│   with okta_app_signon_policy.example,
│   on policy.tf line 17, in resource "okta_app_signon_policy" "example":
│   17: resource "okta_app_signon_policy" "example" {
│
│ 404 Not Found

Because this happens during refresh, the user cannot reach the plan / diff stage at all. This blocks Terraform from converging even though the remote object is already gone and the provider should be able to treat that response as a not-found condition.

The Read implementation appears to add the 404 as a hard error instead of handling the "resource no longer exists" case described in the Framework docs:

https://github.com/okta/terraform-provider-okta/blob/master/okta/services/idaas/resource_okta_app_signon_policy.go#L190-L197

The Delete path appears to have the same issue and may also return an error if the policy is already gone:

https://github.com/okta/terraform-provider-okta/blob/master/okta/services/idaas/resource_okta_app_signon_policy.go#L263-L270

Steps to reproduce

1. Create an okta_app_signon_policy via Terraform and apply it.
2. Delete that authentication policy outside of Terraform, for example in the Okta Admin UI with the Super Admin role.
3. Run terraform plan or terraform apply.

Result:

│ Error: failed to read access policy
│
│   with okta_app_signon_policy.example,
│   on policy.tf line 17, in resource "okta_app_signon_policy" "example":
│   17: resource "okta_app_signon_policy" "example" {
│
│ 404 Not Found

Terraform fails during refresh before any diff is shown.

Important Factoids

No response

References

• Terraform Plugin Framework — Read, handling a remote object that no longer exists: https://developer.hashicorp.com/terraform/plugin/framework/resources/read

• okta/services/idaas/resource_okta_app_signon_policy.go — Read: L190-L197, Delete: L263-L270