title: Terraform resources has changed
body: <p>With the following Terraform and aws provider</p>
  <pre><code>Terraform v1.1.8
  on linux_amd64
  Installed hashicorp/aws v4.10.0
  </code></pre>
  <p>And the following code</p>
  <pre><code># S3 Bucket Policy
  data &quot;aws_iam_policy_document&quot; &quot;lambda-bucket&quot; {
    statement {
      effect = &quot;Allow&quot;
  
      actions = [
        &quot;s3:*&quot;,
      ]
  
      principals {
        type = &quot;AWS&quot;
  
        identifiers = [
          &quot;arn:aws:iam::${var.account_ids.account_1}:role/Teamcity-fullaccess&quot;,
          &quot;arn:aws:iam::${var.account_ids.account_2}:role/teamcity-poweruser&quot;
        ]
      }
  
      resources = [
        aws_s3_bucket.lambda-bucket.arn,
        &quot;${aws_s3_bucket.lambda-bucket.arn}/*&quot;,
      ]
    }
  }
  
  # Bucket
  resource &quot;aws_s3_bucket&quot; &quot;lambda-bucket&quot; {
    bucket = &quot;lambdas-${terraform.workspace}&quot;
    tags = merge(var.default_tags, local.env_tag, {
      Name = &quot;lambdas-${terraform.workspace}&quot;
    })
  }
  
  resource &quot;aws_s3_bucket_versioning&quot; &quot;lambda-bucket&quot; {
    bucket = aws_s3_bucket.lambda-bucket.bucket
    versioning_configuration {
      status = &quot;Enabled&quot;
    }
  }
  
  resource &quot;aws_s3_bucket_server_side_encryption_configuration&quot; &quot;lambda-bucket&quot; {
    bucket = aws_s3_bucket.lambda-bucket.bucket
  
    rule {
      apply_server_side_encryption_by_default {
        sse_algorithm = &quot;AES256&quot;
      }
    }
  }
  
  resource &quot;aws_s3_bucket_acl&quot; &quot;lambda-bucket&quot; {
    bucket = aws_s3_bucket.lambda-bucket.bucket
    acl    = &quot;private&quot;
  }
  
  resource &quot;aws_s3_bucket_policy&quot; &quot;lambda-bucket&quot; {
    bucket = aws_s3_bucket.lambda-bucket.id
    policy = data.aws_iam_policy_document.lambda-bucket.json
  }
  </code></pre>
  <p>I keep getting a notifications saying objects have changed outside of Terraform, which is not true AFAIK</p>
  <pre><code>  # aws_s3_bucket.lambda-bucket has changed
    ~ resource &quot;aws_s3_bucket&quot; &quot;lambda-bucket&quot; {
          id                          = &quot;lambdas-dev1&quot;
        ~ policy                      = jsonencode(
            ~ {
                ~ Statement = [
                    ~ {
                        ~ Principal = {
                            ~ AWS = [
                                - &quot;arn:aws:iam::xxxx:role/Teamcity-fullaccess&quot;,
                                  &quot;arn:aws:iam::yyyy:role/teamcity-poweruser&quot;,
                                + &quot;arn:aws:iam::xxxx:role/Teamcity-fullaccess&quot;,
                              ]
                          }
                          # (3 unchanged elements hidden)
                      },
                  ]
                  # (1 unchanged element hidden)
              }
          )
          tags                        = {
              &quot;Environment&quot;  = &quot;dev1&quot;
              &quot;Name&quot;         = &quot;lambdas-dev1&quot;
              &quot;Terraform&quot;    = &quot;True&quot;
          }
          # (11 unchanged attributes hidden)
  
  
  
          # (3 unchanged blocks hidden)
      }
  </code></pre>
  <p>If it worth something, here's my account ids vars</p>
  <pre><code># Account IDs
  account_ids = {
    &quot;account_1&quot; = &quot;xxxx&quot;,
    &quot;account_2&quot; = &quot;yyyy&quot;
  }
  </code></pre>
  <p>Do I miss something here?</p>