Can anyone clarify the correct retry logic for WFM user group assignments via Terraform provider v1.19.0? The pipeline fails with a 409 Conflict on the /api/v2/wfm/schedules/users endpoint when bulk assigning users to a schedule group.
The error payload indicates a race condition with the underlying WFM engine. The Terraform plan shows no changes, yet apply fails. This happens specifically when the user count exceeds 50 in a single resource block. The GitHub Actions runner is in the Sydney region, matching the org location.
Current HCL block uses depends_on for the schedule group creation, but the conflict persists. The API docs mention eventual consistency, but the provider does not seem to handle the backoff. Manual re-apply eventually succeeds, breaking the CI/CD gate.
Looking for a workaround or a provider configuration to handle this idempotency issue. Using GC CLI for debugging shows the users are already assigned, but the API returns 409. Need a robust solution for production deployments.
The documentation actually says to implement a randomized exponential backoff starting at 500ms, because the WFM engine holds a write lock on the group resource during bulk updates. Splitting the user array into chunks of 25 also bypasses the internal batch limit that triggers the 409.
Warning: Ensure the If-Match header matches the current ETag from a fresh GET request before retrying, otherwise the conflict persists.
This issue stems from the underlying WFM engine holding a write lock on the group resource during bulk updates. The suggestion above regarding randomized exponential backoff is correct. When dealing with legal hold exports or audit trail integrity, data consistency is paramount. A 409 conflict often indicates that the ETag has changed between the plan and apply phases. Ensure the If-Match header matches the current ETag from a fresh GET request before retrying. Splitting the user array into chunks of 25 also bypasses the internal batch limit that triggers the conflict. For Terraform providers, implementing a retry loop with a 500ms initial delay usually resolves this. Do not ignore the ETag validation. In our experience with bulk metadata exports, skipping this step leads to silent data corruption or incomplete records. The pipeline will appear successful but the audit trail will show missing assignments. Always verify the final state via the API after the apply completes. This ensures chain of custody remains intact for any subsequent discovery requests.