Data source schema incorrectly allows identity to be defined

[remyleone]

SDK version

github.com/hashicorp/terraform-plugin-sdk/v2 v2.37.0

Relevant provider source code

func blockIdentity() *schema.ResourceIdentity {
	return &schema.ResourceIdentity{
		Version: 0,
		SchemaFunc: func() map[string]*schema.Schema {
			return map[string]*schema.Schema{
				"snapshot_id": {
					Type:              schema.TypeString,
					RequiredForImport: true,
					Description:       "Snapshot ID",
				},
				"zone": {
					Type:              schema.TypeString,
					RequiredForImport: true,
					Description:       "Zone ID",
				},
			}
		},
	}
}

Terraform Configuration Files

resource "scaleway_instance_volume" "test" {
						size_in_gb = 2
						type = "b_ssd"
					}

					resource "scaleway_instance_snapshot" "from_volume" {
						name = "%s"
						volume_id = scaleway_instance_volume.test.id
					}

					data "scaleway_instance_snapshot" "by_id" {
						snapshot_id = scaleway_instance_snapshot.from_volume.id
					}

					data "scaleway_instance_snapshot" "by_name" {
						name = scaleway_instance_snapshot.from_volume.name
					}

https://github.com/scaleway/terraform-provider-scaleway/blob/0caa7e64c42a774a75c339367d27c2b9b0d16de4/internal/services/instance/snapshot_data_source_test.go#L12

Debug Output

Error: -25T13:57:43.526Z [ERROR] sdk.proto: Response contains error diagnostic: diagnostic_detail="" diagnostic_severity=ERROR diagnostic_summary="Resource does not have Identity schema. Please set one in order to use Identity(). This is always a problem in the provider code." tf_req_id=f9a15696-5d31-a10a-dbf8-a1d0039615c3 tf_provider_addr=registry.terraform.io/hashicorp/scaleway tf_proto_version=5.9 tf_rpc=ReadDataSource tf_data_source_type=scaleway_block_snapshot

Expected Behavior

The identity should be taken into account

Actual Behavior

  | Error: Resource does not have Identity schema. Please set one in order to use Identity(). This is always a problem in the provider code.

Steps to Reproduce

scaleway/terraform-provider-scaleway#3276

References

https://github.com/search?q=repo%3Ahashicorp%2Fterraform-plugin-sdk+%22Resource+does+not+have+Identity+schema.%22&type=code

[austinvalle]

Hey there @remyleone 👋🏻 ,

Data sources don't support identity as that's a managed resource concept. (similar to how data sources don't support write-only attributes, for example)

• ReadDataSource: https://github.com/hashicorp/terraform/blob/3b12eb08667d9ad922fa73eb7765767cefb13c76/docs/plugin-protocol/tfplugin6.proto#L808-L814
• ReadResource: https://github.com/hashicorp/terraform/blob/3b12eb08667d9ad922fa73eb7765767cefb13c76/docs/plugin-protocol/tfplugin6.proto#L655

Unfortunately for SDKv2, data sources and resources share the same schema object, so I think SDKv2 should have raised an error message earlier indicating the exact problem (something along the lines of "data source has identity schema set, which is not supported"). I'm guessing that internally SDKv2 ignored the identity schema on the data source, so when you went to set it later it returned an error.

Regardless, there isn't a way for us to send identity data back for a data source and it's not possible to define an identity schema for a data source either, so the only option here is to remove that code that sets identity during the data source read (and also from the schema, since we should probably introduce a validation error there).

---

I see your data source and resource are sharing read logic, which is unfortunate because you'll need to make that distinction of "is this a data source" somehow, or ignore the error of setting identity assuming that it was running on a data source 🤔

[remyleone]

Thanks a lot for your answer :-) Yes I think it would be helpful to have a check that identity cannot be set with a data source. That said it is really a pain to duplicate schema and that's one of the main draw back of going to the framework is the need to maintain two schémas. Initially I had three identity only implemented in the resource but then the data source asked for it to be defined which I guess make sense in a way if the schémas are duplicated. I guess extra validation on the SDK side would be a nice addition. But for me, the schémas for identity seem to be completely split from the traditional resource schema so I have trouble understanding why this should be an issue in the first place. Le lun. 25 août 2025, 21:15, Austin Valle ***@***.***> a écrit :

…

*austinvalle* left a comment (hashicorp/terraform-plugin-sdk#1511) <#1511 (comment)> Hey there @remyleone <https://github.com/remyleone> 👋🏻 , Data sources don't support identity as that's a managed resource concept. (similar to how data sources don't support write-only attributes, for example) - ReadDataSource: https://github.com/hashicorp/terraform/blob/3b12eb08667d9ad922fa73eb7765767cefb13c76/docs/plugin-protocol/tfplugin6.proto#L808-L814 - ReadResource: https://github.com/hashicorp/terraform/blob/3b12eb08667d9ad922fa73eb7765767cefb13c76/docs/plugin-protocol/tfplugin6.proto#L655 Unfortunately for SDKv2, data sources and resources share the same schema object, so I think SDKv2 should have raised an error message earlier indicating the exact problem (something along the lines of "data source has identity schema set, which is not supported"). I'm guessing that internally SDKv2 ignored the identity schema on the data source, so when you went to set it later it returned an error. Regardless, there isn't a way for us to send identity data back for a data source and it's not possible to define an identity schema for a data source either, so the only option here is to remove that code that sets identity during the data source read (and also from the schema, since we should probably introduce a validation error there). ------------------------------ I see your data source and resource are sharing read logic, which is unfortunate because you'll need to make that distinction of "is this a data source" somehow, or ignore the error of setting identity assuming that it was running on a data source 🤔 — Reply to this email directly, view it on GitHub <#1511 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AACJOIVONLWAKGGCF5OBIRT3PNOELAVCNFSM6AAAAACEYE7D46VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZTEMRRGQZTOMZUG4> . You are receiving this because you were mentioned.Message ID: ***@***.***>

[austinvalle]

Cool, I'll adjust the title of the issue to represent that we should add more validation to ensure data sources schemas attempting to use an identity receive a clearer error message.

---

That said it is really a pain to duplicate schema and that's one of the main draw back of going to the framework is the need to maintain two schémas.

Yeah, that's understandable. There are certainly differences in what is supported by each schema type in Terraform and the best way we can ensure that there isn't feature creep between the two is to completely separate them. (luckily for this issue, the feature creep didn't actually result in any incorrect state data being stored, just a confusing error)

Helper methods could take something like a resource/schema and convert it into a datasource/schema, although they don't support all of the same features, so some opinion would need to be taken on how that's handled. (error message, ignore, etc.)

Initially I had three identity only implemented in the resource but then the data source asked for it to be defined which I guess make sense in a way if the schémas are duplicated.

I'm not 100% following this, was there a specific error message you received from SDKv2 requesting that identity schema be added? Perhaps it's unavoidable, but we try to do internal validation to avoid confusing error messages (sometimes the opposite can happen 😅 )

But for me, the schémas for identity seem to be completely split from the traditional resource schema so I have trouble understanding why this should be an issue in the first place.

Identity still uses a lot of the same underlying data structures that all of SDKv2 works with, it's an unfortunate trade-off of our continued development in SDKv2, but for features like resource identity we couldn't implement it as a Framework-only feature like ephemeral resources for example.

[remyleone]

One of the thing that I don't understand is that even after removing the code from the data source I still get:

        Error: Resource does not have Identity schema. Please set one in order to use Identity(). This is always a problem in the provider code.
        
          with data.scaleway_block_volume.find_by_id,
          on terraform_plugin_test.tf line 12, in data "scaleway_block_volume" "find_by_id":
          12:                                   data scaleway_block_volume find_by_id {

For me the Schema and Identity are two completely separated field in the ressource definition so I don't understand why if I duplicate the schema, identity is interfering.

[austinvalle]

Data source read logic cannot call (*schema.ResourceData).Identity(), which is what is returning that error message as it's impossible for a data source to have an identity schema:

terraform-plugin-sdk/helper/schema/resource_data.go

Lines 745 to 747 in 22a1f5b

	if d.identitySchema == nil {
	return nil, fmt.Errorf("Resource does not have Identity schema. Please set one in order to use Identity(). This is always a problem in the provider code.")
	}