auth0 tf generate fails when connection name contains only digits

[Ga13Ou]

Checklist

• I have looked into the README and have not found a suitable solution or answer.
• I have looked into the documentation and have not found a suitable solution or answer.
• I have searched the issues and have not found a suitable solution or answer.
• I have upgraded to the latest version of this project and the issue still persists.
• I have searched the Auth0 Community forums and have not found a suitable solution or answer.
• I agree to the terms within the Auth0 Code of Conduct.

Description

Hi team,

I encountered a bug when using the auth0 tf generate command when we have at least one connection whose name consists only of digits (e.g., "123456").

Fetching data from Auth0... done
 ▸    Output directory "./" is not empty. Proceeding will overwrite the auth0_main.tf, auth0_import.tf and auth0_generated.tf files.
Generating Terraform configuration... failed
 ▸    Terraform resource config generated successfully but there was an error with terraform plan.


 ▸    Run ./terraform plan to troubleshoot


 ▸    Once the plan succeeds, run ./terraform apply to complete the import.


 ▸    The terraform binary and auth0_import.tf files can be deleted afterwards.

What I noticed:

When a Connection name start with a digit and contains other characters (e.g., "123aabbcc"). The generated terraform resource will be auth0_connection.aabbcc which is a valid resource name.
However, when the connection name only contains digits (e.g., "123456") the generation fails to generate the auth0_generated.tf file with the message Generating Terraform configuration... failed. And the auth0_import.tf file will contain an invalid import block as follows

import {
  id = "con_<redacted>"
  to = auth0_connection.
}

import {
  id = "con_con_<redacted>"
  to = auth0_connection_clients.
}

Actual result:

Only the following files are generated:

• auth0_import.tf
• auth0_main.tf
• terraform

Expectation

Terraform resources are generated successfully, including all the following files:

• auth0_import.tf
• auth0_main.tf
• auth0_generated.tf
• terraform

Reproduction

1. Create a Entreprise Saml connection in Auth0 with a name that contains only numbers (e.g., 123456).
2. Run auth0 tf generate to generate the Terraform configuration.

Auth0 CLI version

1.16.0

[Ga13Ou]

I've proposed a fix for this issue in this PR #1294 I opened. I hope it's a satisfying solution!

The fix handles the case where connection names start with a digit by prefixing them with an underscore to make valid Terraform resource names.

[ramya18101]

Hello @Ga13Ou ,

Thank you for bringing this issue and with the solution.

We appreciate your suggestion and acknowledge the challenge with connection names that consist solely of digits. Unfortunately, supporting purely numeric names presents complications especially around resource sanitization and the risk of creating duplicate resources (e.g., both _123456 and 123456 could map to the same sanitized name, causing further issues).

Given these concerns, we have decided not to add additional sanitize. Instead, we recommend using connection names that contain at least one non-numeric character to ensure compatibility with Terraform resource naming conventions and avoid potential conflicts.

Thank you for your understanding and for contributing to the improvement of the CLI. suggestions, feel free to let us know!

[Ga13Ou]

Hi @ramya18101 ,

Thanks a lot for taking the time to look into this and provide a detailed explanation!

I totally understand the concern about resource name collisions and the need to avoid ambiguous or duplicate Terraform resources. However, I’d like to point out that the risk of collision already exists in the current sanitization logic — even before introducing a leading underscore for numeric-only names.

For example, different connection names like 12345aabbcc, 6789aabbcc and aabbcc would all get sanitized to the same name (aabbcc), causing a collision. With the fix I proposed (adding a _ prefix when the name starts with a digit), these would become _12345aabbcc, _6789aabbcc and aabbcc, which are unique. So while the mapping is still not injective, the fix not only fixes the main Terraform generation issue for numeric-only names but also reduces the likelihood of collisions overall.

Also, renaming the connection isn’t always a viable workaround. In our case, the connections already exist in production, are referenced by other systems, and Auth0 doesn’t allow renaming them after creation — so we’re constrained to working with the current names.

That said, we’ve already built our own auth0 binary locally with the updated sanitization logic to unblock our workflow and successfully generate the Terraform code.

Thanks again for your work on the CLI — it’s a great tool and this was the only hiccup we encountered so far!

[duedares-rvj]

@Ga13Ou Hello 👋
Thanks for the thoughtful explanation, totally appreciate it!

At the inception of the CLI, we did add a few rules - but we’re trying to avoid introducing additional sanitization logic at this point in time. Our goal is to align with Terraform core rules, and the official guidance from HashiCorp is to avoid naming resources that start with numbers. Also, it doesn’t look like that’s going to change anytime soon.
Ref this github issue: hashicorp/terraform#34786

And I totally understand your constraints around existing production connections. Renaming or recreating them isn't feasible.

All said, we’ll definitely give this more thought for a future major release and see if we can make the tf generate experience more robust in such cases. Instead of closing this issue, we are going to park this in under Discussions and hear more from the community.

Also, thank you for the kind words - glad to hear the tool has been working well for you!
Regards.