repro for https://github.com/tailscale/terraform-provider-tailscale/pull/310

main.tf

variable "recreate_if_invalid" {
  default = "never"
}

resource "tailscale_tailnet_key" "instance" {
  expiry              = 30
  reusable            = true
  tags.               = ["tag:demo-infra"]
  recreate_if_invalid = var.recreate_if_invalid
}

output "key" {
  value = tailscale_tailnet_key.instance
  sensitive = true
}

z-output

# terraform apply -auto-approve  
╷
│ Warning: Provider development overrides are in effect
│ 
│ The following provider development overrides are set in the CLI configuration:
│  - tailscale/tailscale in /Users/cameron/.terraform.d/plugins/github.com/tailscale/tailscale/203.0/darwin_arm64
│ 
│ The behavior may therefore not match any released version of the provider and applying changes may cause the state to become incompatible with
│ published releases.
╵

Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols:
  + create

Terraform will perform the following actions:

  # tailscale_tailnet_key.instance will be created
  + resource "tailscale_tailnet_key" "instance" {
      + created_at          = (known after apply)
      + expires_at          = (known after apply)
      + expiry              = 30
      + id                  = (known after apply)
      + invalid             = (known after apply)
      + key                 = (sensitive value)
      + recreate_if_invalid = "never"
      + reusable            = true
      + tags                = [
          + "tag:demo-infra",
        ]
    }

Plan: 1 to add, 0 to change, 0 to destroy.

Changes to Outputs:
  + key = (sensitive value)
tailscale_tailnet_key.instance: Creating...
tailscale_tailnet_key.instance: Creation complete after 0s [id=k9SM996CNTRL]

Apply complete! Resources: 1 added, 0 changed, 0 destroyed.

Outputs:

key = <sensitive>
# terraform output key         
{
  "created_at" = "2023-12-11T17:01:32Z"
  "description" = tostring(null)
  "ephemeral" = tobool(null)
  "expires_at" = "2023-12-11T17:02:02Z"
  "expiry" = 30
  "id" = "k9SM996CNTRL"
  "invalid" = false
  "key" = "tskey-auth-k9SM996CNTRL-asdf"
  "preauthorized" = tobool(null)
  "recreate_if_invalid" = "never"
  "reusable" = true
  "tags" = toset([
    "tag:demo-infra",
  ])
}
# sleep 30                       
# terraform refresh            
tailscale_tailnet_key.instance: Refreshing state... [id=k9SM996CNTRL]

Outputs:

key = <sensitive>
# terraform output key
{
  "created_at" = "2023-12-11T17:01:32Z"
  "description" = ""
  "ephemeral" = false
  "expires_at" = "2023-12-11T17:02:02Z"
  "expiry" = 30
  "id" = "k9SM996CNTRL"
  "invalid" = true
  "key" = "tskey-auth-k9SM996CNTRL-asdf"
  "preauthorized" = tobool(null)
  "recreate_if_invalid" = "never"
  "reusable" = true
  "tags" = toset([
    "tag:demo-infra",
  ])
}
# echo 'recreate_if_invalid = "always"' > terraform.tfvars
# terraform apply -auto-approve                           
╷
│ Warning: Provider development overrides are in effect
│ 
│ The following provider development overrides are set in the CLI configuration:
│  - tailscale/tailscale in /Users/cameron/.terraform.d/plugins/github.com/tailscale/tailscale/203.0/darwin_arm64
│ 
│ The behavior may therefore not match any released version of the provider and applying changes may cause the state to become incompatible with
│ published releases.
╵
tailscale_tailnet_key.instance: Refreshing state... [id=k9SM996CNTRL]

Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols:
  ~ update in-place

Terraform will perform the following actions:

  # tailscale_tailnet_key.instance will be updated in-place
  ~ resource "tailscale_tailnet_key" "instance" {
        id                  = "k9SM996CNTRL"
      ~ recreate_if_invalid = "never" -> "always"
        tags                = [
            "tag:demo-infra",
        ]
        # (7 unchanged attributes hidden)
    }

Plan: 0 to add, 1 to change, 0 to destroy.

Changes to Outputs:
  ~ key = (sensitive value)
tailscale_tailnet_key.instance: Modifying... [id=k9SM996CNTRL]
tailscale_tailnet_key.instance: Modifications complete after 0s [id=k9SM996CNTRL]

Apply complete! Resources: 0 added, 1 changed, 0 destroyed.

Outputs:

key = <sensitive>
# terraform output key                                    
{
  "created_at" = "2023-12-11T17:01:32Z"
  "description" = ""
  "ephemeral" = false
  "expires_at" = "2023-12-11T17:02:02Z"
  "expiry" = 30
  "id" = "k9SM996CNTRL"
  "invalid" = true
  "key" = "tskey-auth-k9SM996CNTRL-asdf"
  "preauthorized" = tobool(null)
  "recreate_if_invalid" = "always"
  "reusable" = true
  "tags" = toset([
    "tag:demo-infra",
  ])
}
# terraform apply -auto-approve
╷
│ Warning: Provider development overrides are in effect
│ 
│ The following provider development overrides are set in the CLI configuration:
│  - tailscale/tailscale in /Users/cameron/.terraform.d/plugins/github.com/tailscale/tailscale/203.0/darwin_arm64
│ 
│ The behavior may therefore not match any released version of the provider and applying changes may cause the state to become incompatible with
│ published releases.
╵
tailscale_tailnet_key.instance: Refreshing state... [id=k9SM996CNTRL]

Note: Objects have changed outside of Terraform

Terraform detected the following changes made outside of Terraform since the last "terraform apply" which may have affected this plan:

  # tailscale_tailnet_key.instance has been deleted
  - resource "tailscale_tailnet_key" "instance" {
      - created_at          = "2023-12-11T17:01:32Z" -> null
      - ephemeral           = false -> null
      - expires_at          = "2023-12-11T17:02:02Z" -> null
      - expiry              = 30 -> null
      - id                  = "k9SM996CNTRL" -> null
      - invalid             = true -> null
      - key                 = (sensitive value) -> null
      - recreate_if_invalid = "always" -> null
      - reusable            = true -> null
      - tags                = [
          - "tag:demo-infra",
        ] -> null
    }


Unless you have made equivalent changes to your configuration, or ignored the relevant attributes using ignore_changes, the following plan may
include actions to undo or respond to these changes.

─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────

Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols:
  + create

Terraform will perform the following actions:

  # tailscale_tailnet_key.instance will be created
  + resource "tailscale_tailnet_key" "instance" {
      + created_at          = (known after apply)
      + expires_at          = (known after apply)
      + expiry              = 30
      + id                  = (known after apply)
      + invalid             = (known after apply)
      + key                 = (sensitive value)
      + recreate_if_invalid = "always"
      + reusable            = true
      + tags                = [
          + "tag:demo-infra",
        ]
    }

Plan: 1 to add, 0 to change, 0 to destroy.

Changes to Outputs:
  ~ key = (sensitive value)
tailscale_tailnet_key.instance: Creating...
tailscale_tailnet_key.instance: Creation complete after 1s [id=kBEkMi2CNTRL]

Apply complete! Resources: 1 added, 0 changed, 0 destroyed.

Outputs:

key = <sensitive>
#