 However, it does successfully deactivate controller functionality on the appliance.
I think it seems to be checking if the specific resource ID doesn't exist anymore, but for the appgatesdp_appliance_controller_activation resource, the resource ID actually points to the appliance, which will still exist even after the controller functionality is disabled.
My current workaround is to run terraform state rm <name of activation resource> at the point it gets stuck, and then after that terraform destroy works as expected for the rest of my state.

Terraform CLI, Terraform appgatesdp Provider Version, and Appgate Appliance version(s)
terraform cli: v1.2.7
terraform-provider-appgatesdp:  v1.0.0
appgate appliance version: 5.4.6-27046-release

Affected Resource(s)

appgatesdp_appliance_controller_activation

Terraform Configuration Files

Please include all Terraform configurations required to reproduce the bug. Bug reports without a functional reproduction may be closed without investigation.
resource "appgatesdp_appliance_controller_activation" "activator" {
  count        = var.enable_controller ? 1 : 0
  depends_on   = [null_resource.seed_appliance]
  appliance_id = appgatesdp_appliance.appliance.id
  controller {
    enabled = var.enable_controller
  }
  admin_interface {
    hostname   = var.peer_hostname
    https_port = 8443
    allow_sources {
      address = "<IP_ADDRESS>"
      netmask = 0
      nic     = "eth0"
    }
    https_ciphers = [
      "ECDHE-RSA-AES256-GCM-SHA384",
      "ECDHE-RSA-AES128-GCM-SHA256",
    ]
  }
}

Debug Output
module.secondary_controllers["sdpctrl2_ops_cits_hpc_mil"].appgatesdp_appliance_controller_activation.activator[0]: Still destroying... [id=658df124-054e-4758-a4b4-f903e585fa1a, 15m30s elapsed]
│ Error: timeout while waiting for state to become 'success' (timeout: 15m0s)

Steps to Reproduce

terraform destroy

This seems like an issue on the Appgate SDP Controller itself where it is getting stuck when removing a Controller from the collective.
Can you open a ticket with Appgate SDP support?
You can include log bundles gathered via the admin UI for all Controllers.

Everything actually works on the Appgate side- the controller functionality
on the appliance is successfully removed. It’s terraform that doesn’t seem
to detect that the change happened successfully.
On Fri, Sep 16, 2022 at 03:12 Thomas Cellerier @.***>
wrote:

This seems like an issue on the Appgate SDP Controller itself where it is
getting stuck when removing a Controller from the collective.
Can you open a ticket with Appgate SDP support?
You can include log bundles gathered via the admin UI for all Controllers.
—
Reply to this email directly, view it on GitHub
https://github.com/appgate/terraform-provider-appgatesdp/issues/258#issuecomment-1249002891,
or unsubscribe
https://github.com/notifications/unsubscribe-auth/AB53AMQNXXRYQN3KL2YVPJLV6QMVPANCNFSM6AAAAAAQNM2YYA
.
You are receiving this because you authored the thread.Message ID:
@.***>

aha I see, I think there is room for improvement here, I will take a closer look next week.

I'm closing this issue, We have updated this behavior in v1.0.2 and the resource appgatesdp_appliance_controller_activation will no longer report as a fatal error on destroy if the appliance state is in wrong state when the resource timeout expires.