stackit_vpn_connection: Updating POLICY_BASED connections fails because staticRoutes is included

[oliverhinz0707]

Description

Updating an existing stackit_vpn_connection with routing_type = "POLICY_BASED" fails although the Terraform configuration does not specify any static_routes. This happens with TF stackit provider version 0.104.0 and Terraform v1.14.6

The STACKIT API returns the following validation error:

field: staticRoutes
validationError: field must be excluded

This suggests that the provider includes the staticRoutes field in the update request (likely as an empty list), although the API requires this field to be omitted entirely for policy-based VPN connections.

The resource can be created successfully, but subsequent updates fail with a 400 Bad Request.

Steps to reproduce

resource "stackit_vpn_connection" "example" {
  project_id = "<project-id>"
  gateway_id = stackit_vpn_gateway.example.id

  display_name = "example"
  routing_type = "POLICY_BASED"

  local_subnets = [
    "172.16.0.0/24"
  ]

  remote_subnets = [
    "172.17.0.0/24"
  ]

  tunnel1 {
    remote_address            = "203.0.113.10"
    pre_shared_key_wo         = "<psk>"
    pre_shared_key_wo_version = 1

    phase1 {
      encryption_algorithms = ["aes256"]
      integrity_algorithms  = ["sha2_384"]
      dh_groups             = ["ecp384"]
      rekey_time            = 14400
    }

    phase2 {
      encryption_algorithms = ["aes256"]
      integrity_algorithms  = ["sha2_384"]
      dh_groups             = ["ecp384"]
      dpd_action            = "restart"
      rekey_time            = 3600
      start_action          = "start"
    }
  }

  tunnel2 {
    remote_address            = "203.0.113.11"
    pre_shared_key_wo         = "<psk>"
    pre_shared_key_wo_version = 1

    phase1 {
      encryption_algorithms = ["aes256"]
      integrity_algorithms  = ["sha2_384"]
      dh_groups             = ["ecp384"]
      rekey_time            = 14400
    }

    phase2 {
      encryption_algorithms = ["aes256"]
      integrity_algorithms  = ["sha2_384"]
      dh_groups             = ["ecp384"]
      dpd_action            = "restart"
      rekey_time            = 3600
      start_action          = "none"
    }
  }
}

1. Create a POLICY_BASED VPN connection using Terraform.
2. Run terraform apply.
3. Modify any updatable attribute of the VPN connection (for example start_action within tunnel configuration).
4. Run terraform apply again.

Actual behavior

Terraform fails while updating the VPN connection with:

│ Error: Error updating VPN connection
│ 
│   with module.vpn["example-a"].stackit_vpn_connection.policy_based["example-a.primary"],
│   on vpn/main.tf line 52, in resource "stackit_vpn_connection" "policy_based":
│   52: resource "stackit_vpn_connection" "policy_based" {
│ 
│ 400 Bad Request, status code 400, Body: {"error":{"code":400,"message":"One or more fields are
│ invalid.","status":"BAD_REQUEST","details":[{"reason":"INVALID_FIELD","domain":"vpn.access.stackit.cloud","metadata":{"field":"staticRoutes","validationError":"field must be excluded"}}]}}
│ 
│ Trace ID: "1c5b80f7eaa7dbc1f46f2640e3c61df0"

The Terraform configuration does not specify static_routes, therefore the provider appears to include the field during the update request although it should be omitted.

Expected behavior

For POLICY_BASED VPN connections, the provider should completely omit the staticRoutes field from the update request.

Updating unrelated attributes should succeed without requiring the VPN connection to be recreated.

[GokceGK]

Hi @oliverhinz0707,

thanks for reporting this issue. We will take a look at it.

Regards,
Gökce from the STACKIT Developer Tools Team