okta_group_memberships Create returns before all requested users are visible

[bfdy18]

Terraform Version & Okta Provider Version(s)

Terraform v1.12.0

• provider registry.terraform.io/okta/okta v6.5.5

The same implementation is present in v6.11.0.

Affected Resource(s)

• okta_group_memberships

Can this be done in the Admin UI?

Yes

Can this be done in the actual API call?

Yes

Terraform Configuration

resource "okta_group_memberships" "example" {
  group_id = "<group-id>"
  users = [
    "<first-user-id>",
    "<second-user-id>",
  ]
}

Debug Output

No customer-specific debug output is included. The behavior is directly visible in the provider source.

Expected Behavior

Create should wait until every ID in users is visible in the group's membership list before declaring the resource created.

Actual Behavior

Create waits only until the group has at least one member. checkIfGroupHasUsers ignores the requested users parameter and returns len(groupUsers) > 0. A group that already has any member completes immediately; an initially empty group completes after the first membership becomes visible. Remaining memberships can still be subject to Okta's eventual consistency, which causes a subsequent refresh/plan to observe a partial set and report drift.

Steps to Reproduce

1. Select a group with an existing member, or an empty group.
2. Configure one okta_group_memberships resource with two or more user IDs.
3. Run terraform apply.
4. Immediately run terraform plan while membership propagation is still incomplete.
5. Observe the membership set is not stable until the remaining API writes become visible.

Important Factoids

The create implementation acknowledges eventual consistency and includes a TODO asking whether it should wait for all users, but the predicate currently only checks whether the returned list is non-empty.

References

• v6.5.5 create/retry: https://github.com/okta/terraform-provider-okta/blob/v6.5.5/okta/services/idaas/resource_okta_group_memberships.go#L92-L114
• v6.5.5 predicate: https://github.com/okta/terraform-provider-okta/blob/v6.5.5/okta/services/idaas/resource_okta_group_memberships.go#L303-L309
• Same code in v6.11.0: https://github.com/okta/terraform-provider-okta/blob/v6.11.0/okta/services/idaas/resource_okta_group_memberships.go#L117-L139