title: Terraform keeps reporting changes - Codepipeline
body: <p>My Terraform code keeps reporting changes after apply although the plan has been correctly applied.</p>
  <p>Terraform and provider version:</p>
  <pre><code>Terraform v1.1.7
  on darwin_amd64
  + provider registry.terraform.io/hashicorp/aws v4.6.0
  </code></pre>
  <pre><code>resource &quot;aws_codepipeline&quot; &quot;this&quot; {
    name     = &quot;${lookup(var.tags, &quot;Environment&quot;, &quot;&quot;)}-terraform-pipeline&quot;
    role_arn = aws_iam_role.this.arn
  
    artifact_store {
      location = data.aws_s3_bucket.codepipeline_bucket.bucket
      type     = &quot;S3&quot;
    }
  
    dynamic &quot;stage&quot; {
      for_each = local.stages
      content {
        name = stage.value.name
        dynamic &quot;action&quot; {
          for_each = stage.value.action
          content {
            name             = action.value.name
            category         = action.value.category
            owner            = action.value.owner
            provider         = action.value.provider
            version          = action.value.version
            run_order        = action.value.run_order
            input_artifacts  = action.value.input_artifacts
            output_artifacts = action.value.output_artifacts
            configuration    = action.value.configuration
          }
        }
      }
    }
  }
  
  locals {
    stages = [{
      name = &quot;Source&quot;
      action = [{
        run_order        = &quot;1&quot;
        category         = &quot;Source&quot;
        name             = &quot;Source&quot;
        owner            = &quot;AWS&quot;
        provider         = &quot;CodeCommit&quot;
        version          = &quot;1&quot;
        input_artifacts  = []
        output_artifacts = [&quot;SourceArtifacts&quot;]
        configuration = {
          BranchName           = &quot;master&quot;
          OutputArtifactFormat = &quot;CODEBUILD_CLONE_REF&quot;
          RepositoryName       = local.repo_name
          ProjectName          = null
        }
      }]
    }, {
      name = &quot;dev&quot;
      action = [{
        run_order        = &quot;2&quot;
        category         = &quot;Build&quot;
        name             = &quot;InitAndPlan&quot;
        owner            = &quot;AWS&quot;
        provider         = &quot;CodeBuild&quot;
        version          = &quot;1&quot;
        input_artifacts  = [&quot;SourceArtifacts&quot;]
        output_artifacts = [&quot;PlanArtifacts&quot;]
        configuration = {
          BranchName           = null
          OutputArtifactFormat = null
          RepositoryName       = null
          ProjectName          = module.codebuild_tf_init_plan.name
        }
      }, {
        run_order        = &quot;3&quot;
        category         = &quot;Approval&quot;
        name             = &quot;Approve&quot;
        owner            = &quot;AWS&quot;
        provider         = &quot;Manual&quot;
        version          = &quot;1&quot;
        input_artifacts  = []
        output_artifacts = []
        configuration = {
          BranchName           = null
          OutputArtifactFormat = null
          RepositoryName       = null
          ProjectName          = null
        }
      }]
    }]
  }
  </code></pre>
  <p>When I change the <code>run_order</code> (to be 2 and 2 for the <code>Approval</code> and <code>InitAndPlan</code>) stages, then the issue disapears. It is however, not what I want.</p>
  <p>The <code>Approve</code> stages needs to be executed after the <code>InitAndPlan</code> stages.</p>
  <p>What do I miss?</p>
  <p>As requested, here is the TF plan</p>
  <pre><code>Terraform will perform the following actions:
  
    # module.codepipeline.aws_codepipeline.this will be updated in-place
    ~ resource &quot;aws_codepipeline&quot; &quot;this&quot; {
          id       = &quot;sandbox-terraform-pipeline&quot;
          name     = &quot;sandbox-terraform-pipeline&quot;
          tags     = {}
          # (3 unchanged attributes hidden)
  
  
        ~ stage {
              name = &quot;dev&quot;
  
            ~ action {
                ~ category         = &quot;Build&quot; -&gt; &quot;Approval&quot;
                ~ configuration    = {
                    - &quot;ProjectName&quot; = &quot;sandbox-terraform-init-plan&quot; -&gt; null
                  }
                ~ input_artifacts  = [
                    - &quot;SourceArtifacts&quot;,
                  ]
                ~ name             = &quot;InitAndPlan&quot; -&gt; &quot;Approve&quot;
                ~ output_artifacts = [
                    - &quot;PlanArtifacts&quot;,
                  ]
                ~ provider         = &quot;CodeBuild&quot; -&gt; &quot;Manual&quot;
                ~ run_order        = 2 -&gt; 3
                  # (2 unchanged attributes hidden)
              }
            ~ action {
                ~ category         = &quot;Approval&quot; -&gt; &quot;Build&quot;
                ~ configuration    = {
                    + &quot;ProjectName&quot; = &quot;sandbox-terraform-init-plan&quot;
                  }
                ~ input_artifacts  = [
                    + &quot;SourceArtifacts&quot;,
                  ]
                ~ name             = &quot;Approve&quot; -&gt; &quot;InitAndPlan&quot;
                ~ output_artifacts = [
                    + &quot;PlanArtifacts&quot;,
                  ]
                ~ provider         = &quot;Manual&quot; -&gt; &quot;CodeBuild&quot;
                ~ run_order        = 3 -&gt; 2
                  # (2 unchanged attributes hidden)
              }
          }
          # (2 unchanged blocks hidden)
      }
  
  Plan: 0 to add, 1 to change, 0 to destroy.
  </code></pre>