stackit_cdn_distribution: removing WAF disabled_rule_ids is not detected during terraform plan #1630

Description

When a value is added to disabled_rule_ids, Terraform correctly detects the change and applies it successfully.

However, after removing the value from the Terraform configuration, terraform plan reports no changes, even though the rule is still configured remotely.

As a result, the configuration cannot be reverted using Terraform.

Steps to reproduce

resource "stackit_cdn_distribution" "example" {
  project_id = var.project_id

  config = {
    # ...

    waf = {
      disabled_rule_ids = [
        "@builtin/crs/request/942140"
      ]
    }
  }
}

1. Run terraform apply
2. Verify that the rule is successfully configured
3. Remove or comment out the disabled_rule_ids attribute.
4. Run terraform plan or terraform apply

Actual behavior

No changes. Your infrastructure matches the configuration.

Although the disabled_rule_ids configuration has been removed from the Terraform configuration, Terraform does not detect any changes and therefore never removes the rule from the remote resource.

Expected behavior

Terraform should detect that disabled_rule_ids has been removed from the configuration and generate an update plan that removes the rule from the remote resource.

- disabled_rule_ids = [
    "@builtin/crs/request/942140",
  ]

before applying the update.

Environment

• OS: Windows
• Terraform version (see terraform --version): v1.15.8
• Version of the STACKIT Terraform provider: v0.104.0

Additional information

Adding values to disabled_rule_ids works correctly and the provider successfully updates the resource.

The issue only occurs when removing previously configured values. Since Terraform reports "No changes", users cannot remove disabled WAF rules through Terraform once they have been applied.

This may indicate that the provider does not correctly compare the configured state with the remote state for disabled_rule_ids during the planning phase.

During testing, the same behavior appears to affect other WAF list attributes as well (for example enabled_rule_ids, enabled_rule_group_ids, disabled_rule_group_ids, log_only_rule_ids, and similar attributes), although only disabled_rule_ids has been verified in detail so far.

Additionally, after successfully applying disabled_rule_ids, the STACKIT Portal still displays the corresponding WAF rule as active instead of disabled. It is currently unclear whether this is only a UI issue in the portal or whether the rule is not being persisted correctly by the backend.