A classic portal resource manages an older portal implementation, while a newer portal resource targets the current portal model and feature set. The difference matters because the underlying schema, behavior, and migration path can change. Teams should map existing resources carefully before upgrading so automation continues to manage the intended portal object.
Why This Matters for Security Teams
A Terraform provider can expose two resources that look similar in documentation but behave differently at the API layer, and that difference affects drift detection, state management, and upgrade safety. Security and platform teams care because the wrong resource type can silently preserve old behavior, miss new controls, or force a destructive replacement during migration. That is a governance problem as much as an infrastructure problem.
This pattern is familiar in NHI and secrets management too: legacy objects often persist longer than intended, and automation keeps managing them as if nothing changed. NHI Mgmt Group’s Ultimate Guide to NHIs notes that 71% of NHIs are not rotated within recommended time frames, which shows how easily older identity assets remain in place after newer patterns exist. The lesson translates directly to provider resources: schema evolution is not just a code issue, it is an operational control issue. For the broader control lens, NIST SP 800-53 Rev 5 Security and Privacy Controls reinforces the need to maintain authoritative configuration and change control over managed assets. In practice, many security teams encounter the impact only after a provider upgrade changes the object their automation is actually managing.
How It Works in Practice
A classic portal resource usually maps to an older API shape, older defaults, or a legacy object model. A newer portal resource typically targets the current API contract and may expose additional fields, new validation rules, or revised lifecycle behavior. In Terraform terms, that means the same business object can be represented by two different schemas, and each schema can produce different diffs, state imports, and replacement behavior.
The safest way to handle this is to treat the resource choice as an implementation decision, not a naming preference. Start by confirming which portal object already exists, then compare the provider documentation, import ID format, and any notes about deprecation or migration. If the newer resource is intended to replace the classic one, plan for a controlled state migration rather than a simple code rename. That is especially important when the resource manages secrets-bearing or access-bearing portal objects, because unintended recreation can disrupt access or expose stale configuration. The risk profile is similar to what NHIMG documents in JetBrains GitHub plugin token exposure and Hard-Coded Secrets in VSCode Extensions: the object looks routine, but hidden implementation details decide whether automation is safe.
- Verify whether the provider marks the classic resource as legacy, deprecated, or frozen.
- Check whether the newer resource changes defaults, naming, or required arguments.
- Import existing resources before switching code paths so Terraform does not create a duplicate object.
- Review plan output for replacement actions, especially if the portal object is tied to access control or integrations.
- Use version pinning and staged rollout to avoid accidental schema drift across environments.
Current guidance suggests treating provider resource migration as a change-management activity, not a routine refactor. These controls tend to break down when teams upgrade the provider without first validating how the classic and newer resources map to the same live portal object.
Common Variations and Edge Cases
Tighter resource mapping often increases migration overhead, requiring organisations to balance upgrade speed against state correctness. That tradeoff becomes more visible when the classic resource and newer resource are only partially compatible, or when the provider keeps both available for backward compatibility. In those cases, there is no universal standard for how aggressively to migrate; the right choice depends on the API’s deprecation path and the blast radius of replacement.
One common edge case is a resource that can be imported successfully under both schemas, but only one schema preserves all current settings. Another is a portal object created long ago with settings that the newer resource now normalizes or rejects. In that situation, the plan may look clean while still masking a behavioral change after apply. For teams managing sensitive automation, the safest stance is to document the mapping, test in a non-production workspace, and confirm post-apply behavior before rolling forward. The broader NHI lesson from Ultimate Guide to NHIs — What are Non-Human Identities applies here: lifecycle and visibility matter as much as initial configuration. If the provider resource is tied to a platform with rapid API evolution, current guidance suggests keeping a migration runbook because schema drift often appears first as an unexpected plan diff, not an outage.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST CSF 2.0, NIST AI RMF and NIST Zero Trust (SP 800-207) set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | CM-2 | Resource migrations depend on controlled baselines and approved configuration. |
| OWASP Non-Human Identity Top 10 | NHI-01 | Portal resources may manage identities or secrets and need clear ownership. |
| NIST AI RMF | This is a governance and lifecycle question about managed automation behavior. | |
| NIST Zero Trust (SP 800-207) | PS-3 | Different resource models can alter the trust boundary and access path. |
Validate that the newer resource preserves least-privilege access and intended trust boundaries.
Related resources from NHI Mgmt Group
- What is the difference between privilege reduction and secret rotation?
- What is the difference between a rules-based secret scanner and a hybrid scanner?
- What is the difference between code scanning and runtime identity monitoring?
- What is the difference between zero trust for users and zero trust for NHIs?
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on August 27, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
