The Auth0 Terraform provider continuously reports state changes for action secrets because the Auth0 API masks secret values during retrieval. Adding a lifecycle block to ignore changes for the secrets attribute resolves this issue. Running the terraform plan command constantly reports state drift for auth0_action resources containing secret environment variables, even when no modifications exist.

• Auth0
• Auth0 Terraform Provider
• Auth0 Actions

The Auth0 API masks secret values for security reasons during GET requests. This behavior causes Terraform to read the secret as empty and detect a state drift between the local configuration and the remote state.

What resolves the constant state drift for action secrets?

Prevent Terraform from detecting false state changes by adding a lifecycle block that ignores the secrets attribute within the action resource configuration.

1. Open the Terraform configuration file containing the auth0_action resource.
2. Add a lifecycle block inside the resource definition.
3. Specify the secrets attribute within the ignore_changes list.
4. Save the configuration and run the terraform plan command to verify the resolution.

resource "auth0_action" "example_action" {
  name = "Example Action"
  # other configuration...

  lifecycle {
    ignore_changes = [
      secrets
    ]
  }
}