stackit_cdn_distribution: empty WAF rule group lists cause "Provider produced inconsistent result after apply" #1629

Description

Configuring the WAF rule group attributes with empty lists causes terraform apply to fail with a provider consistency error.

The issue occurs when one or more of the following attributes are explicitly set to an empty list:

• enabled_rule_group_ids
• disabled_rule_group_ids
• log_only_rule_group_ids

Steps to reproduce

resource "stackit_cdn_distribution" "example" {
  project_id = var.project_id

  config = {
    # ...

    waf = {
      enabled_rule_group_ids  = []
      disabled_rule_group_ids = []
      log_only_rule_group_ids = []
    }
  }
}

1. Run terraform apply

Actual behavior

Error: Provider produced inconsistent result after apply

When applying changes to
module.cdn_distribution["website"].stackit_cdn_distribution.this,
provider "registry.terraform.io/stackitcloud/stackit"
produced an unexpected new value:

.config.waf.enabled_rule_group_ids:
length changed from 0 to 1.

This is a bug in the provider, which should be reported in the provider's own issue tracker.

Expected behavior

The provider should accept explicitly configured empty lists for the WAF rule group attributes and complete the apply successfully.

No provider state inconsistency should occur when these attributes are configured as empty collections..

Environment

• OS: Windows
• Terraform version (see terraform --version): v1.15.8
• Version of the STACKIT Terraform provider: v0.104.0

Additional information

The issue only occurs when the attributes are explicitly configured as empty lists.

If the attributes are omitted completely, terraform apply succeeds without errors.

This behavior suggests that the provider does not correctly handle empty collections returned from the API, resulting in an inconsistent Terraform state after apply.