[Bug] tencentcloud_teo_bind_security_template cannot reliably manage cross-zone EdgeOne security template bindings

[volts-zhang-tfs]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform Version

Tested with:

Terraform v1.14.x
provider registry.terraform.io/tencentcloudstack/tencentcloud v1.82.101

We also reproduced the same behavior through remote runs using Terraform 1.14.x.
Affected Resource(s)
tencentcloud_teo_bind_security_template
Terraform Configuration Files
Minimal example:

resource "tencentcloud_teo_bind_security_template" "example" {
  zone_id     = "ZONE_CONTEXT"
  entity      = "business-domain.example.com"
  template_id = "template-xxxxxxxx"
  operate     = "unbind-keep-policy"
  over_write  = true

  timeouts {
    create = "15m"
  }
}

Scenario:
the business domain belongs to one EdgeOne zone
the security template is owned by a different EdgeOne zone
the binding already exists and is visible in the EdgeOne console
this is therefore a cross-zone security template binding scenario
Debug Output
Debug logs can be provided if needed. The key API-level observations are summarized below.
Panic Output
None.
Expected Behavior
If cross-zone EdgeOne security template bindings are a supported cloud-side model, the Terraform resource should be able to reliably:
import an existing binding
read the binding after create/import
apply without failing due to conflicting zone context requirements
At minimum, the provider should document that this scenario is unsupported if it cannot be managed with the current resource model.
Actual Behavior
The resource cannot reliably manage an existing cross-zone binding.
Observed behavior:
Using the domain-owning zone as zone_id
terraform import fails with:Cannot import non-existent remote object

terraform apply may fail after repeated polling with errors such as:couldn't find resource (21 retries)
timeout while waiting for state to become 'online'

Direct API verification shows that DescribeSecurityTemplateBindings returns an empty result when called with the domain-owning zone.

Using the template-owning zone as zone_id
direct DescribeSecurityTemplateBindings returns the existing binding correctly
but terraform apply fails with an API error similar to:InvalidParameter.Security: The domain has not enabled the security function or does not exist

This suggests that:
the read/list API expects the template-owning zone context
the write/bind API expects the domain-owning zone context
the Terraform resource exposes only one zone_id, so create/read/import cannot all work in this cross-zone model

Steps to Reproduce:
Create or identify an existing EdgeOne security template binding where:
the business domain belongs to Zone B
the security template belongs to Zone A
the domain is already explicitly bound to that template in the EdgeOne console

Attempt to import the binding using the domain-owning zone:

terraform import <resource-address> <domain-zone>#<template-id>#<domain>

Observe import failure:
Cannot import non-existent remote object

Call the read API with the domain-owning zone:
DescribeSecurityTemplateBindings
observe empty result

Call the same API with the template-owning zone:
observe that the binding is returned correctly

Change Terraform to use the template-owning zone as zone_id

Run:

terraform apply

Observe apply failure with an error similar to:InvalidParameter.Security: The domain has not enabled the security function or does not exist

Important Factoids
This issue appears only in a cross-zone binding model:
the domain and the template do not belong to the same EdgeOne zone
the binding is valid and visible in the EdgeOne console
the Terraform resource seems unable to reconcile the different zone-context requirements between read and write operations
This does not appear to be a Terraform core issue. It appears to be either:
a provider modeling limitationor an unhandled inconsistency between the underlying EdgeOne binding APIs

References
Relevant APIs involved in this behavior:

• DescribeSecurityTemplateBindings
• BindSecurityTemplateToEntity
  Affected Terraform resource:
• tencentcloud_teo_bind_security_template