resources.yml

# Resource lifecycle configuration for Declarative Automation Bundles.
# This file defines how field changes affect resource operations.
#
# Available options:
#   recreate_on_changes: fields that trigger delete + create
#   update_id_on_changes: fields that trigger UpdateWithID (ID may change)
#   ignore_remote_changes: fields where remote changes are ignored
#   ignore_local_changes: fields where local changes are ignored (can't be updated via API)
#   backend_defaults: fields where the backend may set defaults (skipped when old/new are nil but remote is set)
#     Optional "values" list constrains which remote values are allowed (as JSON-compatible literals).
#
# Each field entry has:
#   field: the field path
#   reason: why this field is in this category (immutable, input_only, output_only, or descriptive text)

resources:

  jobs:
    ignore_remote_changes:
      # Same as clusters.{aws,azure,gcp}_attributes — see clusters/resource_cluster.go#L361-L363
      # s.SchemaPath("aws_attributes").SetSuppressDiff()
      # s.SchemaPath("azure_attributes").SetSuppressDiff()
      # s.SchemaPath("gcp_attributes").SetSuppressDiff()
      - field: tasks[*].new_cluster.aws_attributes
        reason: managed
      - field: tasks[*].new_cluster.azure_attributes
        reason: managed
      - field: tasks[*].new_cluster.gcp_attributes
        reason: managed
      - field: job_clusters[*].new_cluster.aws_attributes
        reason: managed
      - field: job_clusters[*].new_cluster.azure_attributes
        reason: managed
      - field: job_clusters[*].new_cluster.gcp_attributes
        reason: managed

    backend_defaults:
      # Same as clusters.enable_elastic_disk — see clusters/resource_cluster.go#L331
      # s.SchemaPath("enable_elastic_disk").SetComputed()
      - field: tasks[*].new_cluster.enable_elastic_disk
      - field: job_clusters[*].new_cluster.enable_elastic_disk

      # Same as clusters.enable_local_disk_encryption — see clusters/resource_cluster.go#L332
      # s.SchemaPath("enable_local_disk_encryption").SetComputed()
      - field: tasks[*].new_cluster.enable_local_disk_encryption
      - field: job_clusters[*].new_cluster.enable_local_disk_encryption

      # Same as clusters.node_type_id — see clusters/resource_cluster.go#L333
      # s.SchemaPath("node_type_id").SetComputed()
      - field: tasks[*].new_cluster.node_type_id
      - field: job_clusters[*].new_cluster.node_type_id

      # Same as clusters.driver_node_type_id — see clusters/resource_cluster.go#L334
      # s.SchemaPath("driver_node_type_id").SetComputed()
      - field: tasks[*].new_cluster.driver_node_type_id
      - field: job_clusters[*].new_cluster.driver_node_type_id

      # Same as clusters.driver_instance_pool_id — see clusters/resource_cluster.go#L335
      # s.SchemaPath("driver_instance_pool_id").SetComputed()
      - field: tasks[*].new_cluster.driver_instance_pool_id
      - field: job_clusters[*].new_cluster.driver_instance_pool_id

      # https://github.com/databricks/terraform-provider-databricks/blob/4eba541abe1a9f50993ea7b9dd83874207e224a1/jobs/resource_job.go#L531
      # s.SchemaPath("format").SetComputed()
      - field: format
        values: ["MULTI_TASK", "SINGLE_TASK"]

      # https://github.com/databricks/terraform-provider-databricks/blob/4eba541abe1a9f50993ea7b9dd83874207e224a1/jobs/resource_job.go#L639
      # s.SchemaPath("task", "run_if").SetSuppressDiffWithDefault(jobs.RunIfAllSuccess)
      - field: "tasks[*].run_if"
        values: ["ALL_SUCCESS"]

      # https://github.com/databricks/terraform-provider-databricks/blob/4eba541abe1a9f50993ea7b9dd83874207e224a1/jobs/resource_job.go#L640
      # s.SchemaPath("task", "for_each_task", "task", "run_if").SetSuppressDiffWithDefault(jobs.RunIfAllSuccess)
      - field: "tasks[*].for_each_task.task.run_if"
        values: ["ALL_SUCCESS"]

      # https://github.com/databricks/terraform-provider-databricks/blob/4eba541abe1a9f50993ea7b9dd83874207e224a1/jobs/resource_job.go#L527
      # s.SchemaPath("run_as").SetComputed()
      - field: run_as

      # https://github.com/databricks/terraform-provider-databricks/blob/4eba541abe1a9f50993ea7b9dd83874207e224a1/jobs/resource_job.go#L521-L524
      # s.SchemaPath("task", "notebook_task", "source").SetSuppressDiff()
      # s.SchemaPath("task", "spark_python_task", "source").SetSuppressDiff()
      # s.SchemaPath("task", "sql_task", "file", "source").SetSuppressDiff()
      # s.SchemaPath("task", "dbt_task", "source").SetSuppressDiff()
      - field: tasks[*].notebook_task.source
      - field: tasks[*].for_each_task.task.notebook_task.source
      - field: tasks[*].spark_python_task.source
      - field: tasks[*].for_each_task.task.spark_python_task.source
      - field: tasks[*].sql_task.file.source
      - field: tasks[*].for_each_task.task.sql_task.file.source
      - field: tasks[*].dbt_task.source
      - field: tasks[*].for_each_task.task.dbt_task.source

      # Same as clusters.data_security_mode: backend sets this when not specified
      - field: tasks[*].new_cluster.data_security_mode
      - field: job_clusters[*].new_cluster.data_security_mode

  pipelines:
    recreate_on_changes:
      - field: storage
        reason: immutable
      - field: ingestion_definition.connection_name
        reason: immutable
      - field: ingestion_definition.ingestion_gateway_id
        reason: immutable
      # https://github.com/databricks/terraform-provider-databricks/blob/4eba541abe1a9f50993ea7b9dd83874207e224a1/pipelines/resource_pipeline.go#L204
      - field: gateway_definition.connection_id
        reason: immutable
      - field: gateway_definition.connection_name
        reason: immutable
      - field: gateway_definition.gateway_storage_catalog
        reason: immutable
      - field: gateway_definition.gateway_storage_schema
        reason: immutable
      # https://github.com/databricks/terraform-provider-databricks/blob/4eba541abe1a9f50993ea7b9dd83874207e224a1/pipelines/resource_pipeline.go#L209
      - field: ingestion_definition.ingest_from_uc_foreign_catalog
        reason: immutable

    ignore_remote_changes:
      # "id" is handled in a special way before any fields changed
      # However, it is also part of RemotePipeline via CreatePipeline.
      # Thus it shows up as a remote change since we don't set on the object.
      - field: id
        reason: "!drop"
      - field: run_as
        reason: input_only

    ignore_local_changes:
      # "id" is output-only, providing it in config would be a mistake
      - field: id
        reason: "!drop"

    backend_defaults:
      # https://github.com/databricks/terraform-provider-databricks/blob/4eba541abe1a9f50993ea7b9dd83874207e224a1/pipelines/resource_pipeline.go#L238
      # s.SchemaPath("storage").SetCustomSuppressDiff(suppressStorageDiff)
      # Backend generates storage path like dbfs:/pipelines/<id> when not set by user.
      - field: storage

      # https://github.com/databricks/terraform-provider-databricks/blob/4eba541abe1a9f50993ea7b9dd83874207e224a1/pipelines/resource_pipeline.go#L218
      # s.SchemaPath("cluster", "node_type_id").SetComputed()
      - field: clusters[*].node_type_id

      # https://github.com/databricks/terraform-provider-databricks/blob/4eba541abe1a9f50993ea7b9dd83874207e224a1/pipelines/resource_pipeline.go#L219
      # s.SchemaPath("cluster", "driver_node_type_id").SetComputed()
      - field: clusters[*].driver_node_type_id

      # https://github.com/databricks/terraform-provider-databricks/blob/4eba541abe1a9f50993ea7b9dd83874207e224a1/pipelines/resource_pipeline.go#L220
      # s.SchemaPath("cluster", "enable_local_disk_encryption").SetComputed()
      - field: clusters[*].enable_local_disk_encryption

      # https://github.com/databricks/terraform-provider-databricks/blob/4eba541abe1a9f50993ea7b9dd83874207e224a1/pipelines/resource_pipeline.go#L229-L230
      # s.SchemaPath("event_log", "catalog").SetComputed()
      # s.SchemaPath("event_log", "schema").SetComputed()
      - field: event_log.catalog
      - field: event_log.schema

  models:
    recreate_on_changes:
      # Recreate matches current behavior of Terraform. It is possible to rename without recreate
      # but that would require dynamic select of the method during update since
      # the ml.RenameModel needs to be called instead of ml.UpdateModel.
      # We might reasonably choose to never fix this because this is a legacy resource.
      - field: name
        reason: terraform_compat
    # Allowing updates for tags requires dynamic selection of the method since
    # tags can only be updated by calling ml.SetModelTag or ml.DeleteModelTag methods.
    # Skip annotation matches the current behavior of Terraform where tags changes are showed
    # in plan but are just ignored / not applied. Since this is a legacy resource we might
    # reasonably choose to not fix it here as well.
    ignore_remote_changes:
      - field: tags
        reason: terraform_compat
    ignore_local_changes:
      - field: tags
        reason: terraform_compat

  # TF implementation: https://github.com/databricks/terraform-provider-databricks/blob/6c106e8e7052bb2726148d66309fd460ed444236/mlflow/resource_mlflow_experiment.go#L22
  experiments:
    recreate_on_changes:
      - field: artifact_location
        reason: immutable
    backend_defaults:
      # https://github.com/databricks/terraform-provider-databricks/blob/4eba541abe1a9f50993ea7b9dd83874207e224a1/mlflow/resource_mlflow_experiment.go#L34
      # SetForceNew().SetSuppressDiff(): backend generates artifact_location when not set by user
      - field: artifact_location
    ignore_remote_changes:
      # Tags updates are not supported by TF. This mirrors that behaviour.
      - field: tags
        reason: terraform_compat
    ignore_local_changes:
      - field: tags
        reason: terraform_compat

  # TF implementation: https://github.com/databricks/terraform-provider-databricks/blob/6c106e8e7052bb2726148d66309fd460ed444236/mlflow/resource_mlflow_experiment.go#L22
  model_serving_endpoints:
    recreate_on_changes:
      - field: name
        reason: immutable
      # description is immutable, can't be updated via API
      - field: description
        reason: immutable
      - field: config.auto_capture_config.catalog_name
        reason: immutable
      - field: config.auto_capture_config.schema_name
        reason: immutable
      - field: config.auto_capture_config.table_name_prefix
        reason: immutable
      - field: route_optimized
        reason: immutable
    ignore_remote_changes:
      # https://github.com/databricks/terraform-provider-databricks/blob/4eba541abe1a9f50993ea7b9dd83874207e224a1/serving/resource_model_serving.go#L370
      # common.CustomizeSchemaPath(m, "config", "traffic_config").SetComputed()
      # Routes have custom SuppressDiff (lines 387-388)
      - field: config.traffic_config
        reason: managed
      - field: budget_policy_id
        reason: no_update_api
        # There is PublicPreview endpoints but we're not using it https://docs.databricks.com/api/workspace/servingendpoints/put
      - field: rate_limits
        reason: not_implemented
    ignore_local_changes:
      - field: budget_policy_id
        reason: no_update_api
      - field: rate_limits
        reason: not_implemented
    backend_defaults:
      # https://github.com/databricks/terraform-provider-databricks/blob/4eba541abe1a9f50993ea7b9dd83874207e224a1/serving/resource_model_serving.go#L383
      # common.CustomizeSchemaPath(m, "config", "served_entities", "name").SetComputed()
      - field: config.served_entities[*].name

      # https://github.com/databricks/terraform-provider-databricks/blob/4eba541abe1a9f50993ea7b9dd83874207e224a1/serving/resource_model_serving.go#L384
      # common.CustomizeSchemaPath(m, "config", "served_entities", "workload_type").SetComputed()
      - field: config.served_entities[*].workload_type

      # https://github.com/databricks/terraform-provider-databricks/blob/4eba541abe1a9f50993ea7b9dd83874207e224a1/serving/resource_model_serving.go#L372
      # common.CustomizeSchemaPath(m, "config", "auto_capture_config", "enabled").SetComputed()
      - field: config.auto_capture_config.enabled

      # https://github.com/databricks/terraform-provider-databricks/blob/4eba541abe1a9f50993ea7b9dd83874207e224a1/serving/resource_model_serving.go#L395-L396
      # route_optimized is ForceNew; backend returns false when not set by user.
      - field: route_optimized
        values: [false]

  registered_models:
    ignore_remote_changes:
      # Output-only timestamp/user fields zeroed in RemapState but still show up
      # via ForceSendFields. These should never participate in diffs.
      - field: created_at
        reason: output_only
      - field: created_by
        reason: output_only
      - field: updated_at
        reason: output_only
      - field: updated_by
        reason: output_only
    recreate_on_changes:
      # The name can technically be updated without recreate. We recreate for now though
      # to match TF implementation.
      - field: name
        reason: terraform_compat
      - field: catalog_name
        reason: immutable
      - field: schema_name
        reason: immutable
      - field: storage_location
        reason: immutable
    backend_defaults:
      # https://github.com/databricks/terraform-provider-databricks/blob/4eba541abe1a9f50993ea7b9dd83874207e224a1/catalog/resource_registered_model.go#L28
      # m["storage_location"].Computed = true
      - field: storage_location
      # owner, full_name, metastore_id are Computed in TF (backend-set output fields).
      - field: owner
      - field: full_name
      - field: metastore_id

  quality_monitors:
    recreate_on_changes:
      - field: assets_dir
        reason: immutable
      - field: table_name
        reason: immutable
    ignore_remote_changes:
      - field: warehouse_id
        reason: input_only
      # skip_builtin_dashboard is input-only, not returned by the Get API.
      # TF preserves it from state; see resource_quality_monitor.go.
      - field: skip_builtin_dashboard
        reason: input_only

  catalogs:
    recreate_on_changes:
      - field: storage_root
        reason: immutable
      - field: connection_name
        reason: immutable
      - field: provider_name
        reason: immutable
      - field: share_name
        reason: immutable
    update_id_on_changes:
      - field: name
        reason: id_changes

  schemas:
    recreate_on_changes:
      - field: name
        reason: immutable
      - field: catalog_name
        reason: immutable
      - field: storage_root
        reason: immutable
    normalize_case:
      # UC lowercases identifier names; remote returns "myschema" for config "MySchema".
      - field: name
        reason: uc_case
      - field: catalog_name
        reason: uc_case
    normalize_slash:
      - field: storage_root
        reason: uc_strips_trailing_slash

  external_locations:
    recreate_on_changes:
      - field: credential_name
        reason: immutable
      - field: encryption_details
        reason: immutable
      - field: file_event_queue
        reason: immutable
    update_id_on_changes:
      - field: name
        reason: id_changes
    ignore_remote_changes:
      # skip_validation is input-only and not returned by the API
      - field: skip_validation
        reason: input_only

  volumes:
    recreate_on_changes:
      - field: catalog_name
        reason: immutable
      - field: schema_name
        reason: immutable
      - field: storage_location
        reason: immutable
      - field: volume_type
        reason: immutable
    update_id_on_changes:
      - field: name
        reason: id_changes
    normalize_case:
      # UC lowercases identifier names. name is in update_id_on_changes, so a
      # case-only diff would otherwise trigger a spurious rename (DoUpdateWithID).
      - field: catalog_name
        reason: uc_case
      - field: schema_name
        reason: uc_case
      - field: name
        reason: uc_case
    normalize_slash:
      # UC strips trailing slashes on create; matches the Terraform provider's suppressLocationDiff.
      # https://github.com/databricks/terraform-provider-databricks/blob/v1.65.1/catalog/resource_volume.go#L25
      - field: storage_location
        reason: uc_strips_trailing_slash
    backend_defaults:
      # storage_location is Computed; backend generates it for managed volumes.
      - field: storage_location

  dashboards:
    ignore_remote_changes:
      # "serialized_dashboard" locally and remotely will have different contents
      # We only need to rely on etag here, and can skip this field for diff computation.
      - field: serialized_dashboard
        reason: etag_based

      # "dataset_catalog" and "dataset_schema" are write-only fields that are not returned by the server.
      # They will always differ between local config (which has values) and remote state (which has empty strings).
      - field: dataset_catalog
        reason: input_only
      - field: dataset_schema
        reason: input_only

    hashed_in_state:
      # serialized_dashboard holds the inlined dashboard JSON (often megabytes). It is
      # ignore_remote_changes (etag_based) and re-sent from config on every deploy, so it
      # is never read back from state; persist only its content hash to keep state small.
      - field: serialized_dashboard
        reason: large_content

  genie_spaces:
    ignore_remote_changes:
      # serialized_space locally (structured YAML) and remotely (JSON string) will differ
      # textually, so we cannot meaningfully compare them for drift.
      - field: serialized_space
        reason: etag_based

  apps:
    recreate_on_changes:
      - field: name
        reason: immutable
    backend_defaults:
      # Backend sets it "MEDIUM" when not specified in the config
      - field: compute_size
      # lifecycle.started is derived from remote compute status in RemapState, so the
      # remote side always has a value. When the user omits lifecycle from config,
      # both old and new are nil and backend_defaults correctly skips the remote value.
      # When the user explicitly sets lifecycle.started, old/new are non-nil and normal
      # drift detection applies (e.g. detecting out-of-band stop).
      - field: lifecycle
      - field: lifecycle.started
    ignore_remote_changes:
      - field: space # This field is not yet supported by Update APIs but exposed in the API spec. TODO: fix when update APIs supports it.
        reason: managed
      - field: compute_min_instances # This field does not work correctly in update_mask but exposed in the API spec. TODO: add back when update APIs correctly support it
        reason: managed
      - field: compute_max_instances # This field does not work correctly in update_mask but exposed in the API spec. TODO: add back when update APIs correctly support it
        reason: managed

  secret_scopes:
    backend_defaults:
      # The Secrets API defaults scope_backend_type to DATABRICKS when not specified.
      - field: scope_backend_type
        values: ["DATABRICKS"]
    recreate_on_changes:
      - field: scope
        reason: immutable
      - field: scope_backend_type
        reason: immutable
      - field: backend_azure_keyvault
        reason: immutable
      - field: initial_manage_principal
        reason: immutable

  # Permissions for secret scopes use ResourceSecretScopeAcls.
  secret_scopes.permissions:
    update_id_on_changes:
      # When scope name changes, we need UpdateWithID trigger. This is necessary so that subsequent
      # DoRead operations use the correct ID and we do not end up with a persistent drift.
      - field: scope_name
        reason: id_changes

  clusters:
    ignore_remote_changes:
      # https://github.com/databricks/terraform-provider-databricks/blob/4eba541abe1a9f50993ea7b9dd83874207e224a1/clusters/resource_cluster.go#L361-L363
      # s.SchemaPath("aws_attributes").SetSuppressDiff()
      # s.SchemaPath("azure_attributes").SetSuppressDiff()
      # s.SchemaPath("gcp_attributes").SetSuppressDiff()
      - field: aws_attributes
        reason: managed
      - field: azure_attributes
        reason: managed
      - field: gcp_attributes
        reason: managed
    backend_defaults:
      # lifecycle.started is derived from remote cluster state in RemapState, so the
      # remote side always has a value. When the user omits lifecycle from config,
      # both old and new are nil and backend_defaults correctly skips the remote value.
      # When the user explicitly sets lifecycle.started, old/new are non-nil and normal
      # drift detection applies (e.g. detecting out-of-band terminate).
      - field: lifecycle
      - field: lifecycle.started
      # https://github.com/databricks/terraform-provider-databricks/blob/4eba541abe1a9f50993ea7b9dd83874207e224a1/clusters/resource_cluster.go#L331
      # s.SchemaPath("enable_elastic_disk").SetComputed()
      - field: enable_elastic_disk

      # https://github.com/databricks/terraform-provider-databricks/blob/4eba541abe1a9f50993ea7b9dd83874207e224a1/clusters/resource_cluster.go#L332
      # s.SchemaPath("enable_local_disk_encryption").SetComputed()
      - field: enable_local_disk_encryption

      # https://github.com/databricks/terraform-provider-databricks/blob/4eba541abe1a9f50993ea7b9dd83874207e224a1/clusters/resource_cluster.go#L333
      # s.SchemaPath("node_type_id").SetComputed()
      - field: node_type_id

      # https://github.com/databricks/terraform-provider-databricks/blob/4eba541abe1a9f50993ea7b9dd83874207e224a1/clusters/resource_cluster.go#L334
      # s.SchemaPath("driver_node_type_id").SetComputed()
      - field: driver_node_type_id

      # https://github.com/databricks/terraform-provider-databricks/blob/4eba541abe1a9f50993ea7b9dd83874207e224a1/clusters/resource_cluster.go#L335
      # s.SchemaPath("driver_instance_pool_id").SetComputed()
      - field: driver_instance_pool_id

      # Terraform currently does not do this, but it is a field with backend default.
      # See https://github.com/databricks/cli/issues/4418
      - field: single_user_name

    # We have custom handler for this in cluster.go
    # https://github.com/databricks/terraform-provider-databricks/blob/4eba541abe1a9f50993ea7b9dd83874207e224a1/clusters/resource_cluster.go#L109-L118
    # DataSecurityModeDiffSuppressFunc: suppress when old != "" && new == ""
    #- field: data_security_mode

  sql_warehouses:
    ignore_remote_changes:
      # https://github.com/databricks/terraform-provider-databricks/blob/4eba541abe1a9f50993ea7b9dd83874207e224a1/sql/resource_sql_endpoint.go#L62
      # common.CustomizeSchemaPath(m, "channel").SetSuppressDiff()
      - field: channel
        reason: managed

      # https://github.com/databricks/terraform-provider-databricks/blob/4eba541abe1a9f50993ea7b9dd83874207e224a1/sql/resource_sql_endpoint.go#L82
      # common.CustomizeSchemaPath(m, "tags").SetSuppressDiff()
      - field: tags
        reason: managed

      # https://github.com/databricks/terraform-provider-databricks/blob/4eba541abe1a9f50993ea7b9dd83874207e224a1/sql/resource_sql_endpoint.go#L85-L87
      # common.CustomizeSchemaPath(m, "warehouse_type").SetSuppressDiff()
      - field: warehouse_type
        reason: managed

      # https://github.com/databricks/terraform-provider-databricks/blob/4eba541abe1a9f50993ea7b9dd83874207e224a1/sql/resource_sql_endpoint.go#L75
      # common.CustomizeSchemaPath(m, "min_num_clusters").SetSuppressDiff()
      - field: min_num_clusters
        reason: managed

      # creator_name is readonly, can't be updated via API
      - field: creator_name
        reason: output_only

    backend_defaults:
      # lifecycle.started is derived from remote warehouse state in RemapState, so the
      # remote side always has a value. When the user omits lifecycle from config,
      # both old and new are nil and backend_defaults correctly skips the remote value.
      # When the user explicitly sets lifecycle.started, old/new are non-nil and normal
      # drift detection applies (e.g. detecting out-of-band stop).
      - field: lifecycle
      - field: lifecycle.started

      # https://github.com/databricks/terraform-provider-databricks/blob/4eba541abe1a9f50993ea7b9dd83874207e224a1/sql/resource_sql_endpoint.go#L69
      # m["enable_serverless_compute"].Computed = true
      - field: enable_serverless_compute

  postgres_projects:
    recreate_on_changes:
      # project_id is immutable (part of hierarchical name, not in API spec)
      - field: project_id
        reason: immutable
    ignore_remote_changes:
      # purge_on_delete is a delete-time query parameter; not returned by GET.
      # When the user changes it locally we still want the new value to land
      # in state so the next destroy honors it.
      - field: purge_on_delete
        reason: input_only

  postgres_branches:
    recreate_on_changes:
      # parent and branch_id are immutable (part of hierarchical name, not in API spec)
      - field: parent
        reason: immutable
      - field: branch_id
        reason: immutable
    ignore_remote_changes:
      # replace_existing is a create-time query parameter; not returned by GET.
      - field: replace_existing
        reason: input_only
    ignore_local_changes:
      # replace_existing only takes effect on create; toggling it later is a no-op.
      - field: replace_existing
        reason: "input_only; cannot be updated after create"

  postgres_endpoints:
    recreate_on_changes:
      # parent and endpoint_id are immutable (part of hierarchical name, not in API spec)
      - field: parent
        reason: immutable
      - field: endpoint_id
        reason: immutable
    ignore_remote_changes:
      # replace_existing is a create-time query parameter; not returned by GET.
      - field: replace_existing
        reason: input_only
    ignore_local_changes:
      # replace_existing only takes effect on create; toggling it later is a no-op.
      - field: replace_existing
        reason: "input_only; cannot be updated after create"

  postgres_catalogs:
    recreate_on_changes:
      # catalog_id is part of the hierarchical name and immutable.
      - field: catalog_id
        reason: immutable
      # The Postgres SDK has no UpdateCatalog endpoint, so any local change
      # requires delete+create. The OpenAPI spec only marks postgres_database
      # as IMMUTABLE (handled by autogen); branch and create_database_if_missing
      # need explicit entries here.
      - field: branch
        reason: immutable
      - field: create_database_if_missing
        reason: immutable

  postgres_synced_tables:
    # The Postgres API has no UpdateSyncedTable endpoint, so every settable
    # field is recreate-only on the intent side (local YAML edit -> delete +
    # create). The complementary ignore_remote_changes block for this resource
    # lives in resources.generated.yml and handles the read side: it suppresses
    # drift for the same fields because the GET API does not echo back the
    # spec. Together they make no-op deploys idempotent while a real config
    # edit still triggers a recreate. Same pattern as secret_scopes.
    recreate_on_changes:
      - field: synced_table_id
        reason: immutable
      - field: branch
        reason: immutable
      - field: postgres_database
        reason: immutable
      - field: source_table_full_name
        reason: immutable
      - field: primary_key_columns
        reason: immutable
      - field: timeseries_key
        reason: immutable
      - field: scheduling_policy
        reason: immutable
      - field: create_database_objects_if_missing
        reason: immutable
      - field: new_pipeline_spec
        reason: immutable
      - field: existing_pipeline_id
        reason: immutable

  vector_search_endpoints:
    recreate_on_changes:
      - field: endpoint_type
        reason: immutable
    ignore_remote_changes:
      # The API returns effective_budget_policy_id which may include inherited workspace policies,
      # not the user-set budget_policy_id. Ignore until the API exposes the user-set value directly.
      - field: budget_policy_id
        reason: effective_vs_requested

  vector_search_indexes:
    recreate_on_changes:
      # The index API has no rename or update path, so every config change
      # has to go through delete + create.
      - field: name
        reason: immutable
      - field: endpoint_name
        reason: immutable
      - field: index_type
        reason: immutable
      - field: index_subtype
        reason: immutable
      - field: primary_key
        reason: immutable
      - field: delta_sync_index_spec
        reason: immutable
      - field: direct_access_index_spec
        reason: immutable
    ignore_remote_changes:
      # The backend rewrites schema_json on create: user-facing type names
      # ("integer", "long", "short", "byte") are stored in Unity Catalog as
      # Spark type names ("int", "bigint", "smallint", "tinyint") and the
      # columns come back in sorted key order, so GET never echoes the user's
      # literal input. Without this rule the rewrite reads as a change to the
      # immutable direct_access_index_spec and plans a destructive recreate
      # that drops all upserted vectors.
      - field: direct_access_index_spec.schema_json
        reason: normalized_by_backend
    backend_defaults:
      # The Vector Search API assigns index_subtype when the config omits it
      - field: index_subtype