fix: idempotent lifecycle ops

stackit/internal/services/authorization/customrole/resource.go

@@ -212,7 +212,14 @@ func (r *customRoleResource) Read(ctx context.Context, req resource.ReadRequest,
 
 	ctx = r.annotateLogger(ctx, &model)
 
-	roleResp, err := r.client.GetRoleExecute(ctx, r.resourceType, model.ResourceId.ValueString(), model.RoleId.ValueString())
+	roleId := model.RoleId.ValueString()
+	if roleId == "" {
+		// Resource not yet created; ID is unknown.
+		resp.State.RemoveResource(ctx)
+		return
+	}
+
+	roleResp, err := r.client.GetRoleExecute(ctx, r.resourceType, model.ResourceId.ValueString(), roleId)
 	if err != nil {
 		var oapiErr *oapierror.GenericOpenAPIError
 

stackit/internal/services/cdn/distribution/resource.go

@@ -479,6 +479,11 @@ func (r *distributionResource) Read(ctx context.Context, req resource.ReadReques
 
 	projectId := model.ProjectId.ValueString()
 	distributionId := model.DistributionId.ValueString()
+	if distributionId == "" {
+		// Resource not yet created; ID is unknown.
+		resp.State.RemoveResource(ctx)
+		return
+	}
 	ctx = tflog.SetField(ctx, "project_id", projectId)
 	ctx = tflog.SetField(ctx, "distribution_id", distributionId)
 

stackit/internal/services/dns/recordset/resource.go

@@ -3,6 +3,7 @@ package dns
 import (
 	"context"
 	"fmt"
+	"net/http"
 	"strings"
 
 	"github.com/hashicorp/terraform-plugin-framework-validators/int64validator"
@@ -16,6 +17,7 @@ import (
 	"github.com/hashicorp/terraform-plugin-framework/schema/validator"
 	"github.com/hashicorp/terraform-plugin-framework/types"
 	"github.com/hashicorp/terraform-plugin-log/tflog"
+	"github.com/stackitcloud/stackit-sdk-go/core/oapierror"
 	"github.com/stackitcloud/stackit-sdk-go/services/dns"
 	"github.com/stackitcloud/stackit-sdk-go/services/dns/wait"
 	"github.com/stackitcloud/terraform-provider-stackit/stackit/internal/conversion"
@@ -267,6 +269,11 @@ func (r *recordSetResource) Read(ctx context.Context, req resource.ReadRequest,
 	projectId := model.ProjectId.ValueString()
 	zoneId := model.ZoneId.ValueString()
 	recordSetId := model.RecordSetId.ValueString()
+	if recordSetId == "" {
+		// Resource not yet created; ID is unknown.
+		resp.State.RemoveResource(ctx)
+		return
+	}
 	ctx = tflog.SetField(ctx, "project_id", projectId)
 	ctx = tflog.SetField(ctx, "zone_id", zoneId)
 	ctx = tflog.SetField(ctx, "record_set_id", recordSetId)
@@ -374,7 +381,12 @@ func (r *recordSetResource) Delete(ctx context.Context, req resource.DeleteReque
 	// Delete existing record set
 	_, err := r.client.DeleteRecordSet(ctx, projectId, zoneId, recordSetId).Execute()
 	if err != nil {
+		oapiErr, ok := err.(*oapierror.GenericOpenAPIError) //nolint:errorlint //complaining that error.As should be used to catch wrapped errors, but this error should not be wrapped
+		if ok && oapiErr.StatusCode == http.StatusNotFound {
+			return
+		}
 		core.LogAndAddError(ctx, &resp.Diagnostics, "Error deleting record set", fmt.Sprintf("Calling API: %v", err))
+		return
 	}
 
 	ctx = core.LogResponse(ctx)

stackit/internal/services/dns/zone/resource.go

@@ -355,6 +355,11 @@ func (r *zoneResource) Read(ctx context.Context, req resource.ReadRequest, resp
 
 	projectId := model.ProjectId.ValueString()
 	zoneId := model.ZoneId.ValueString()
+	if zoneId == "" {
+		// Resource not yet created; ID is unknown.
+		resp.State.RemoveResource(ctx)
+		return
+	}
 	ctx = tflog.SetField(ctx, "project_id", projectId)
 	ctx = tflog.SetField(ctx, "zone_id", zoneId)
 

stackit/internal/services/edgecloud/instance/resource.go

@@ -321,6 +321,11 @@ func (i *instanceResource) Read(ctx context.Context, req resource.ReadRequest, r
 	projectId := model.ProjectId.ValueString()
 	region := i.providerData.GetRegionWithOverride(model.Region)
 	instanceId := model.InstanceId.ValueString()
+	if instanceId == "" {
+		// Resource not yet created; ID is unknown.
+		resp.State.RemoveResource(ctx)
+		return
+	}
 	ctx = tflog.SetField(ctx, "project_id", projectId)
 	ctx = tflog.SetField(ctx, "instance_id", instanceId)
 	ctx = tflog.SetField(ctx, "region", region)

stackit/internal/services/git/instance/resource.go

@@ -270,6 +270,11 @@ func (g *gitResource) Read(ctx context.Context, req resource.ReadRequest, resp *
 	// Extract the project ID and instance id of the model
 	projectId := model.ProjectId.ValueString()
 	instanceId := model.InstanceId.ValueString()
+	if instanceId == "" {
+		// Resource not yet created; ID is unknown.
+		resp.State.RemoveResource(ctx)
+		return
+	}
 
 	// Read the current git instance via id
 	gitInstanceResp, err := g.client.GetInstance(ctx, projectId, instanceId).Execute()

stackit/internal/services/iaas/affinitygroup/resource.go

@@ -245,6 +245,11 @@ func (r *affinityGroupResource) Read(ctx context.Context, req resource.ReadReque
 	projectId := model.ProjectId.ValueString()
 	region := r.providerData.GetRegionWithOverride(model.Region)
 	affinityGroupId := model.AffinityGroupId.ValueString()
+	if affinityGroupId == "" {
+		// Resource not yet created; ID is unknown.
+		resp.State.RemoveResource(ctx)
+		return
+	}
 
 	ctx = core.InitProviderContext(ctx)
 

stackit/internal/services/iaas/image/resource.go

@@ -509,6 +509,11 @@ func (r *imageResource) Read(ctx context.Context, req resource.ReadRequest, resp
 	projectId := model.ProjectId.ValueString()
 	region := r.providerData.GetRegionWithOverride(model.Region)
 	imageId := model.ImageId.ValueString()
+	if imageId == "" {
+		// Resource not yet created; ID is unknown.
+		resp.State.RemoveResource(ctx)
+		return
+	}
 
 	ctx = core.InitProviderContext(ctx)
 

stackit/internal/services/iaas/network/resource.go

@@ -455,6 +455,11 @@ func (r *networkResource) Read(ctx context.Context, req resource.ReadRequest, re
 
 	projectId := model.ProjectId.ValueString()
 	networkId := model.NetworkId.ValueString()
+	if networkId == "" {
+		// Resource not yet created; ID is unknown.
+		resp.State.RemoveResource(ctx)
+		return
+	}
 	region := r.providerData.GetRegionWithOverride(model.Region)
 	ctx = tflog.SetField(ctx, "project_id", projectId)
 	ctx = tflog.SetField(ctx, "network_id", networkId)

stackit/internal/services/iaas/networkarea/resource.go

@@ -443,6 +443,11 @@ func (r *networkAreaResource) Read(ctx context.Context, req resource.ReadRequest
 
 	organizationId := model.OrganizationId.ValueString()
 	networkAreaId := model.NetworkAreaId.ValueString()
+	if networkAreaId == "" {
+		// Resource not yet created; ID is unknown.
+		resp.State.RemoveResource(ctx)
+		return
+	}
 
 	ctx = core.InitProviderContext(ctx)
 

stackit/internal/services/iaas/networkarearegion/resource.go

@@ -454,6 +454,10 @@ func (r *networkAreaRegionResource) Delete(ctx context.Context, req resource.Del
 	// Delete network area region configuration
 	err = r.client.DeleteNetworkAreaRegion(ctx, organizationId, networkAreaId, region).Execute()
 	if err != nil {
+		oapiErr, ok := err.(*oapierror.GenericOpenAPIError) //nolint:errorlint //complaining that error.As should be used to catch wrapped errors, but this error should not be wrapped
+		if ok && oapiErr.StatusCode == http.StatusNotFound {
+			return
+		}
 		core.LogAndAddError(ctx, &resp.Diagnostics, "Error deleting network area region", fmt.Sprintf("Calling API: %v", err))
 		return
 	}

stackit/internal/services/iaas/networkarearoute/resource.go

@@ -406,6 +406,11 @@ func (r *networkAreaRouteResource) Read(ctx context.Context, req resource.ReadRe
 	networkAreaId := model.NetworkAreaId.ValueString()
 	region := r.providerData.GetRegionWithOverride(model.Region)
 	networkAreaRouteId := model.NetworkAreaRouteId.ValueString()
+	if networkAreaRouteId == "" {
+		// Resource not yet created; ID is unknown.
+		resp.State.RemoveResource(ctx)
+		return
+	}
 
 	ctx = core.InitProviderContext(ctx)
 
@@ -467,6 +472,10 @@ func (r *networkAreaRouteResource) Delete(ctx context.Context, req resource.Dele
 	// Delete existing network
 	err := r.client.DeleteNetworkAreaRoute(ctx, organizationId, networkAreaId, region, networkAreaRouteId).Execute()
 	if err != nil {
+		oapiErr, ok := err.(*oapierror.GenericOpenAPIError) //nolint:errorlint //complaining that error.As should be used to catch wrapped errors, but this error should not be wrapped
+		if ok && oapiErr.StatusCode == http.StatusNotFound {
+			return
+		}
 		core.LogAndAddError(ctx, &resp.Diagnostics, "Error deleting network area route", fmt.Sprintf("Calling API: %v", err))
 		return
 	}

stackit/internal/services/iaas/networkinterface/resource.go

@@ -336,6 +336,11 @@ func (r *networkInterfaceResource) Read(ctx context.Context, req resource.ReadRe
 	region := r.providerData.GetRegionWithOverride(model.Region)
 	networkId := model.NetworkId.ValueString()
 	networkInterfaceId := model.NetworkInterfaceId.ValueString()
+	if networkInterfaceId == "" {
+		// Resource not yet created; ID is unknown.
+		resp.State.RemoveResource(ctx)
+		return
+	}
 
 	ctx = core.InitProviderContext(ctx)
 
@@ -454,6 +459,10 @@ func (r *networkInterfaceResource) Delete(ctx context.Context, req resource.Dele
 	// Delete existing network interface
 	err := r.client.DeleteNic(ctx, projectId, region, networkId, networkInterfaceId).Execute()
 	if err != nil {
+		oapiErr, ok := err.(*oapierror.GenericOpenAPIError) //nolint:errorlint //complaining that error.As should be used to catch wrapped errors, but this error should not be wrapped
+		if ok && oapiErr.StatusCode == http.StatusNotFound {
+			return
+		}
 		core.LogAndAddError(ctx, &resp.Diagnostics, "Error deleting network interface", fmt.Sprintf("Calling API: %v", err))
 		return
 	}

stackit/internal/services/iaas/networkinterfaceattach/resource.go

@@ -295,6 +295,10 @@ func (r *networkInterfaceAttachResource) Delete(ctx context.Context, req resourc
 	// Remove network_interface from server
 	err := r.client.RemoveNicFromServer(ctx, projectId, region, serverId, network_interfaceId).Execute()
 	if err != nil {
+		oapiErr, ok := err.(*oapierror.GenericOpenAPIError) //nolint:errorlint //complaining that error.As should be used to catch wrapped errors, but this error should not be wrapped
+		if ok && oapiErr.StatusCode == http.StatusNotFound {
+			return
+		}
 		core.LogAndAddError(ctx, &resp.Diagnostics, "Error removing network interface from server", fmt.Sprintf("Calling API: %v", err))
 		return
 	}

stackit/internal/services/iaas/publicip/resource.go

@@ -239,6 +239,11 @@ func (r *publicIpResource) Read(ctx context.Context, req resource.ReadRequest, r
 	projectId := model.ProjectId.ValueString()
 	region := r.providerData.GetRegionWithOverride(model.Region)
 	publicIpId := model.PublicIpId.ValueString()
+	if publicIpId == "" {
+		// Resource not yet created; ID is unknown.
+		resp.State.RemoveResource(ctx)
+		return
+	}
 
 	ctx = core.InitProviderContext(ctx)
 

stackit/internal/services/iaas/routingtable/route/resource.go

@@ -301,6 +301,11 @@ func (r *routeResource) Read(ctx context.Context, req resource.ReadRequest, resp
 	routingTableId := model.RoutingTableId.ValueString()
 	networkAreaId := model.NetworkAreaId.ValueString()
 	routeId := model.RouteId.ValueString()
+	if routeId == "" {
+		// Resource not yet created; ID is unknown.
+		resp.State.RemoveResource(ctx)
+		return
+	}
 	region := r.providerData.GetRegionWithOverride(model.Region)
 
 	ctx = tflog.SetField(ctx, "organization_id", organizationId)

stackit/internal/services/iaas/routingtable/table/resource.go

@@ -283,6 +283,11 @@ func (r *routingTableResource) Read(ctx context.Context, req resource.ReadReques
 
 	organizationId := model.OrganizationId.ValueString()
 	routingTableId := model.RoutingTableId.ValueString()
+	if routingTableId == "" {
+		// Resource not yet created; ID is unknown.
+		resp.State.RemoveResource(ctx)
+		return
+	}
 	networkAreaId := model.NetworkAreaId.ValueString()
 	region := r.providerData.GetRegionWithOverride(model.Region)
 

stackit/internal/services/iaas/securitygroup/resource.go

@@ -258,6 +258,11 @@ func (r *securityGroupResource) Read(ctx context.Context, req resource.ReadReque
 	projectId := model.ProjectId.ValueString()
 	region := r.providerData.GetRegionWithOverride(model.Region)
 	securityGroupId := model.SecurityGroupId.ValueString()
+	if securityGroupId == "" {
+		// Resource not yet created; ID is unknown.
+		resp.State.RemoveResource(ctx)
+		return
+	}
 
 	ctx = core.InitProviderContext(ctx)
 

stackit/internal/services/iaas/securitygrouprule/resource.go

@@ -517,6 +517,11 @@ func (r *securityGroupRuleResource) Read(ctx context.Context, req resource.ReadR
 	region := r.providerData.GetRegionWithOverride(model.Region)
 	securityGroupId := model.SecurityGroupId.ValueString()
 	securityGroupRuleId := model.SecurityGroupRuleId.ValueString()
+	if securityGroupRuleId == "" {
+		// Resource not yet created; ID is unknown.
+		resp.State.RemoveResource(ctx)
+		return
+	}
 
 	ctx = core.InitProviderContext(ctx)
 

stackit/internal/services/iaas/server/resource.go

@@ -670,6 +670,11 @@ func (r *serverResource) Read(ctx context.Context, req resource.ReadRequest, res
 	projectId := model.ProjectId.ValueString()
 	region := r.providerData.GetRegionWithOverride(model.Region)
 	serverId := model.ServerId.ValueString()
+	if serverId == "" {
+		// Resource not yet created; ID is unknown.
+		resp.State.RemoveResource(ctx)
+		return
+	}
 
 	ctx = core.InitProviderContext(ctx)
 

stackit/internal/services/iaas/volume/resource.go

@@ -513,6 +513,11 @@ func (r *volumeResource) Read(ctx context.Context, req resource.ReadRequest, res
 	projectId := model.ProjectId.ValueString()
 	region := r.providerData.GetRegionWithOverride(model.Region)
 	volumeId := model.VolumeId.ValueString()
+	if volumeId == "" {
+		// Resource not yet created; ID is unknown.
+		resp.State.RemoveResource(ctx)
+		return
+	}
 
 	ctx = core.InitProviderContext(ctx)
 

stackit/internal/services/iaas/volumeattach/resource.go

@@ -301,6 +301,10 @@ func (r *volumeAttachResource) Delete(ctx context.Context, req resource.DeleteRe
 	// Remove volume from server
 	err := r.client.RemoveVolumeFromServer(ctx, projectId, region, serverId, volumeId).Execute()
 	if err != nil {
+		oapiErr, ok := err.(*oapierror.GenericOpenAPIError) //nolint:errorlint //complaining that error.As should be used to catch wrapped errors, but this error should not be wrapped
+		if ok && oapiErr.StatusCode == http.StatusNotFound {
+			return
+		}
 		core.LogAndAddError(ctx, &resp.Diagnostics, "Error removing volume from server", fmt.Sprintf("Calling API: %v", err))
 		return
 	}

stackit/internal/services/kms/key/resource.go

@@ -315,6 +315,11 @@ func (r *keyResource) Read(ctx context.Context, req resource.ReadRequest, resp *
 	keyRingId := model.KeyRingId.ValueString()
 	region := r.providerData.GetRegionWithOverride(model.Region)
 	keyId := model.KeyId.ValueString()
+	if keyId == "" {
+		// Resource not yet created; ID is unknown.
+		resp.State.RemoveResource(ctx)
+		return
+	}
 
 	ctx = tflog.SetField(ctx, "keyring_id", keyRingId)
 	ctx = tflog.SetField(ctx, "project_id", projectId)
@@ -370,7 +375,12 @@ func (r *keyResource) Delete(ctx context.Context, req resource.DeleteRequest, re
 
 	err := r.client.DeleteKey(ctx, projectId, region, keyRingId, keyId).Execute()
 	if err != nil {
+		oapiErr, ok := err.(*oapierror.GenericOpenAPIError) //nolint:errorlint //complaining that error.As should be used to catch wrapped errors, but this error should not be wrapped
+		if ok && oapiErr.StatusCode == http.StatusNotFound {
+			return
+		}
 		core.LogAndAddError(ctx, &resp.Diagnostics, "Error deleting key", fmt.Sprintf("Calling API: %v", err))
+		return
 	}
 
 	ctx = core.LogResponse(ctx)

stackit/internal/services/kms/keyring/resource.go

@@ -244,6 +244,11 @@ func (r *keyRingResource) Read(ctx context.Context, req resource.ReadRequest, re
 
 	projectId := model.ProjectId.ValueString()
 	keyRingId := model.KeyRingId.ValueString()
+	if keyRingId == "" {
+		// Resource not yet created; ID is unknown.
+		resp.State.RemoveResource(ctx)
+		return
+	}
 	region := r.providerData.GetRegionWithOverride(model.Region)
 
 	ctx = tflog.SetField(ctx, "keyring_id", keyRingId)

stackit/internal/services/kms/wrapping-key/resource.go

@@ -321,6 +321,11 @@ func (r *wrappingKeyResource) Read(ctx context.Context, request resource.ReadReq
 	keyRingId := model.KeyRingId.ValueString()
 	region := r.providerData.GetRegionWithOverride(model.Region)
 	wrappingKeyId := model.WrappingKeyId.ValueString()
+	if wrappingKeyId == "" {
+		// Resource not yet created; ID is unknown.
+		response.State.RemoveResource(ctx)
+		return
+	}
 
 	ctx = tflog.SetField(ctx, "keyring_id", keyRingId)
 	ctx = tflog.SetField(ctx, "project_id", projectId)
@@ -376,7 +381,12 @@ func (r *wrappingKeyResource) Delete(ctx context.Context, request resource.Delet
 
 	err := r.client.DeleteWrappingKey(ctx, projectId, region, keyRingId, wrappingKeyId).Execute()
 	if err != nil {
+		oapiErr, ok := err.(*oapierror.GenericOpenAPIError) //nolint:errorlint //complaining that error.As should be used to catch wrapped errors, but this error should not be wrapped
+		if ok && oapiErr.StatusCode == http.StatusNotFound {
+			return
+		}
 		core.LogAndAddError(ctx, &response.Diagnostics, "Error deleting wrapping key", fmt.Sprintf("Calling API: %v", err))
+		return
 	}
 
 	ctx = core.LogResponse(ctx)