Terraform Identity Errors After a Provider Upgrade

What resource identity is

Since Terraform 1.12, a provider can store a small identity for each resource next to its settings in state, the record of what Terraform has built,: the few values that pin down exactly which real object it is, such as its name, account and region. It must never change while the object exists. The provider checks it on every read.

When a release gets that check wrong for one resource type, every resource of that type fails, with one of these:

Error: Missing Resource Identity After Read: The Terraform provider unexpectedly
returned no resource identity after having no errors in the resource read.

Error: Unexpected Identity Change: During the read operation, the Terraform
Provider unexpectedly returned a different identity then the previously stored one.

Both messages go on to say that this is always a problem with the provider, and they are right. The checks are in the libraries (SDKs) that providers are built with, not in Terraform itself. That is why they can appear even if you run an older Terraform.

What fixed it in practice

In the AWS provider each case so far was a one-release bug: aws_network_acl_rule broke in 6.59.0 and was fixed in 6.60.0; aws_ssm_parameter names with a leading slash broke in 6.58.0 and were fixed in 6.59.0. So:

terraform init -upgrade
terraform plan

If that still fails, exclude the bad version and keep the rest of your constraint:

version = ">= 6.0, != 6.59.0"

Then search the provider's issues for the resource type and the message; if nobody has reported it, report it with both identities from the error.

What not to do

Removing a resource from state and importing it again by hand can attach the wrong real object. Back up state before any state command, and prefer the provider fix.

The full page is Missing Resource Identity After Read. Upgrades that break plans for other reasons are covered by the dependency lock file page.