Terraform Optional Parameter for List of String - terraform

Question

Trying to implement Azure WAF policy and associate with http listener the code was working fine until I try to include a new optional parameter called http_listener_ids
Tf code:
variable "http_listener_ids"{
type = "list"
description = "A list of HTTP Listener IDs from an azurerm_application_gateway"
default = []
}
locals {
http_listener_ids ="${var.http_listener_ids}" == [] ? null: "${var.http_listener_ids}"
}
resource "azurerm_web_application_firewall_policy" "example" {
name = "example-wafpolicy"
resource_group_name = azurerm_resource_group.example.name
location = azurerm_resource_group.example.location
http_listener_ids = "${local.http_listener_ids}"
custom_rules {
name = "Rule1"
priority = 1
rule_type = "MatchRule"
match_conditions {
match_variables {
variable_name = "RemoteAddr"
}
operator = "IPMatch"
negation_condition = false
match_values = ["192.168.1.0/24", "10.0.0.0/24"]
}
action = "Block"
}
custom_rules {
name = "Rule2"
priority = 2
rule_type = "MatchRule"
match_conditions {
match_variables {
variable_name = "RemoteAddr"
}
operator = "IPMatch"
negation_condition = false
match_values = ["192.168.1.0/24"]
}
match_conditions {
match_variables {
variable_name = "RequestHeaders"
selector = "UserAgent"
}
operator = "Contains"
negation_condition = false
match_values = ["Windows"]
}
action = "Block"
}
policy_settings {
enabled = true
mode = "Prevention"
request_body_check = true
file_upload_limit_in_mb = 100
max_request_body_size_in_kb = 128
}
managed_rules {
exclusion {
match_variable = "RequestHeaderNames"
selector = "x-company-secret-header"
selector_match_operator = "Equals"
}
exclusion {
match_variable = "RequestCookieNames"
selector = "too-tasty"
selector_match_operator = "EndsWith"
}
managed_rule_set {
type = "OWASP"
version = "3.1"
rule_group_override {
rule_group_name = "REQUEST-920-PROTOCOL-ENFORCEMENT"
disabled_rules = [
"920300",
"920440"
]
}
}
}
}
Error I got is
Error: "http_listener_ids": this field cannot be set
I thought http_listener_ids property is not skipping and try to assign the value of null instead. So i try to implement dynamic block. But the problem is since http_listener_ids a simple list of string and not a block as such . So not sure what to put inside the content
dynamic "http_listener_ids"{
for_each = "${var.http_listener_ids}"
content{
??
}
}

Answer 1

According to a recent GitHub PR, http_listener_ids is read only, and can't be set. Maybe docs haven't been updated yet.

Answer 2

The documentation for the azurerm_web_application_firewall_policy resource is out of date but http_listener_ids and path_based_rule_ids are read only now (as of v2.55.0) so you can't set them and can only read them as an attribute of the resource.