Added space awareness to Agent Policies (#1390)

* Added space awareness to Agent Policies

* Update schema.go

Co-authored-by: Copilot <[email protected]>

* Added version checks to testing

* Updated Docs

* Fix integration_policy state upgrade for space_ids

When upgrading from schema V0 to V1, the space_ids field was not
initialized in the upgraded state model, causing a type mismatch error
during state migration.

This fix initializes SpaceIds to null for V0 states that didn't have
this field, matching the pattern used for agent_policy_ids.

Fixes test: TestAccResourceIntegrationPolicySecretsFromSDK

* Improve error handling in agent_policy Create

- Make GET after CREATE optional (only if CREATE returned valid ID)
- Gracefully fall back to CREATE response if GET fails
- Add defensive nil checks to prevent unknown value errors

This should handle cases where space configuration prevents
immediate read-back of created policies.

* Fix space-aware agent policy creation

When creating an agent policy with space_ids, the policy is created
within that specific Kibana space. The subsequent GET request to read
back the policy must include the space context in the URL, otherwise
it returns 404 due to Kibana's space isolation.

Changes:
- Added GetAgentPolicyInSpace() function to make space-aware GET requests
  using the pattern /s/{space_id}/api/fleet/agent_policies/{id}
- Updated Create() to use GetAgentPolicyInSpace() when space_ids is set
- Falls back to standard GetAgentPolicy() for non-space-aware policies

This fixes the runtime error where policies with space_ids would fail
with "Provider returned invalid result object after apply" showing
unknown values for id, policy_id, and other fields.

Resolves the 404 error when reading back space-aware policies.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <[email protected]>

* Add space-aware support for all CRUD operations

Extended space-aware API support beyond CREATE to cover the full
resource lifecycle (READ, UPDATE, DELETE). When a policy is created
with space_ids, all subsequent operations must use space-aware URLs.

Changes:
- Added GetAgentPolicyInSpace() for space-aware GET requests
- Added UpdateAgentPolicyInSpace() for space-aware PUT requests
- Added DeleteAgentPolicyInSpace() for space-aware DELETE requests
- Updated Read() to use space-aware GET when space_ids is set
- Updated Update() to use space-aware PUT when space_ids is set
- Updated Delete() to use space-aware DELETE when space_ids is set

All operations now follow the pattern:
- Default space: /api/fleet/agent_policies/...
- Custom space: /s/{space_id}/api/fleet/agent_policies/...

Testing confirmed all CRUD operations work correctly with space_ids:
✅ CREATE - Policy created with space_ids
✅ READ - Policy read from correct space
✅ UPDATE - Policy updated within space
✅ DELETE - Policy deleted from space

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <[email protected]>

* feat: implement complete space-aware Fleet support with state consistency fixes

Adds full Kibana Space support for Fleet agent policies and integration policies,
enabling multi-tenant deployments with space isolation.

Changes:
- Add space-aware API functions for package policies in Fleet client
  * GetPackagePolicyInSpace, CreatePackagePolicyInSpace
  * UpdatePackagePolicyInSpace, DeletePackagePolicyInSpace
- Update all integration_policy CRUD operations to use space-aware requests
- Make integration_policy space_ids Optional+Computed instead of read-only
- Fix state consistency: preserve space_ids when API doesn't return it
- Fix input handling: don't populate auto-generated inputs when not configured

This enables creating integration policies in specific Kibana spaces by
referencing space-aware agent policies. The space context is passed via
space-aware URLs (/s/{space_id}/api/fleet/...) for proper API isolation.

Fixes #1390

* Added space awareness to all ofther fleet resources and datasources

* Fixing error handling

* fix: resolve integration policy import failures and space_ids verification

Fixes three issues causing TestAccResourceIntegrationPolicySecrets failures:

1. Import state handling: Added import detection logic in Read function
   to preserve inputs populated from API during import operations.
   Previously, inputs were incorrectly nullified when prior state was
   empty (which occurs during all import operations).

2. Test configuration: Corrected step 3 import test to use
   testAccResourceIntegrationPolicySecretsUpdate() instead of
   testAccResourceIntegrationPolicyUpdate(), ensuring AWS logs
   configuration matches steps 1-2.

3. Import verification: Added space_ids to ImportStateVerifyIgnore
   for both single-valued and multi-valued secret tests. The API
   returns space_ids for all policies, but test configs don't
   specify it since it's inherited from agent policies.

Space-aware Fleet functionality fully preserved:
- All space-aware CRUD operations unchanged
- Import detection doesn't interfere with space_ids handling
- Works correctly for both space-aware and regular imports

Files changed:
- internal/fleet/integration_policy/read.go: Import detection logic
- internal/fleet/integration_policy/acc_test.go: Test fixes

Resolves CI test failures in TestAccResourceIntegrationPolicySecrets

* fix: resolve Fleet output space_ids non-empty plan issue

Fixes TestAccResourceOutputKafka test failure caused by space_ids
appearing in plan after update operations.

Problem:
After updating a Fleet output resource, Terraform showed a non-empty
plan with 'space_ids = (known after apply)', even though no changes
were made. This occurred because:
- space_ids is marked as Optional + Computed in schema
- Previous logic conditionally preserved space_ids from prior state
- When config didn't specify space_ids, but state had it, Terraform
  detected a diff

Solution:
Simplified space_ids handling to ALWAYS set to null during Read
operations, since:
- API doesn't return space_ids for Fleet outputs
- space_ids is only used to route API calls during create/update/delete
- Users shouldn't rely on reading this value back from state

Applied fix to all three output types:
- Elasticsearch: internal/fleet/output/models_elasticsearch.go
- Kafka: internal/fleet/output/models_kafka.go
- Logstash: internal/fleet/output/models_logstash.go

Changes:
- Removed conditional logic (if IsNull || IsUnknown)
- Always set space_ids to null in fromAPI* methods
- Updated comments to reflect correct behavior

This ensures plan stability after apply while preserving space-aware
Fleet functionality for create/update/delete operations.

Resolves CI test failures in TestAccResourceOutputKafka

* fix: add UseStateForUnknown plan modifier to space_ids fields

Resolves plan stability issues where space_ids was showing as
"(known after apply)" instead of remaining null after updates.

The issue occurred because space_ids is marked as Optional+Computed
but lacked a plan modifier. Without UseStateForUnknown(), Terraform
treats null computed values as potentially changing, causing non-empty
plans after updates.

Changes:
- Add listplanmodifier.UseStateForUnknown() to space_ids in all resources
- Import listplanmodifier package where needed
- Fixes TestAccResourceOutputKafka and prevents similar issues in other resources

Affected resources:
- agent_policy
- integration_policy
- output (Elasticsearch, Kafka, Logstash)
- server_host

This ensures space_ids null values are preserved across update operations,
preventing spurious plan diffs.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <[email protected]>

* fix: preserve space_ids in output models, remove incorrect plan modifiers

This commit fixes two related issues with space_ids handling:

**Issue 1: Output resources showing non-empty plans**
The output populate functions were unconditionally setting space_ids to null,
causing Terraform to detect a change even when nothing changed. Since the
Fleet API doesn't return space_ids for outputs, we now preserve the value
from the plan/state instead of overwriting it.

**Issue 2: Agent policy version errors on older Elasticsearch**
Adding UseStateForUnknown() plan modifier caused space_ids values to persist
across updates, triggering version checks on Elasticsearch < 9.1.0 even when
space_ids wasn't explicitly configured. The plan modifier was preserving the
["default"] value returned by the API during create.

**Solution:**
1. **Output models**: Remove space_ids null assignment in populateFromAPI
   - Files: models_elasticsearch.go, models_kafka.go, models_logstash.go
   - Now preserves plan/state value instead of overwriting to null

2. **All resources**: Remove UseStateForUnknown() plan modifiers
   - For agent_policy/integration_policy/server_host: API returns space_ids,
     so we want to follow the API response, not preserve state values
   - For output: Fix at populate level, not schema level
   - Removes unnecessary imports of listplanmodifier

**Test Impact:**
- Fixes TestAccResourceOutputKafka (non-empty plan issue)
- Fixes TestAccResourceAgentPolicy* (version check issue on older ES)

The root cause was attempting to use plan modifiers for state management
when the real issue was in the populate logic. This fix addresses both
the symptom (plan diffs) and the cause (inappropriate null assignment).

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <[email protected]>

* fix: conditionally set space_ids to null in output models

Fixes "Provider returned invalid result object after apply" error
during CREATE operations for output resources.

**Problem:**
When space_ids is not specified in config, the plan has space_ids=null.
After calling populateFromAPI during create, space_ids remained null
(not explicitly set). Since space_ids is Optional+Computed, Terraform
requires it to have a known value after apply, not remain unset.

**Solution:**
Only set space_ids to null if it's currently null/unknown. This ensures:
1. CREATE: space_ids starts null → set to explicit null → satisfies Terraform
2. UPDATE: space_ids has value from plan → preserved → no plan diff

**Why Conditional Check:**
- `IsNull() || IsUnknown()` → Set to explicit null (fixes create)
- Has concrete value → Preserve it (prevents update plan diffs)

This combines the benefits of both approaches:
- CREATE works (explicit null satisfies Terraform)
- UPDATE works (preserves plan value, no spurious diffs)

Fixes TestAccResourceOutputElasticsearch and TestAccResourceOutputLogstash.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <[email protected]>

* fix: preserve space_ids from state during output update operations

Fixes "non-refresh plan was not empty" error showing space_ids as
"(known after apply)" during UPDATE operations for output resources.

**Root Cause:**
During update, we only read from req.Plan, which doesn't include
space_ids when it's not in the config. This caused space_ids to be
null in planModel, and when populateFromAPI set it to explicit null,
Terraform couldn't tell if this was intentional or computed, showing
it as "(known after apply)".

**Solution:**
1. Read BOTH plan and state at the start of Update
2. If space_ids is not in plan (null/unknown), copy from state
3. This ensures planModel has the correct space_ids value before
   populateFromAPI is called
4. No plan diff because state value is preserved

**Flow:**
- Plan has space_ids = null (not in config)
- State has space_ids = null (from create)
- Copy from state → planModel.SpaceIds = null (from state)
- populateFromAPI sees IsNull() → sets to explicit null (no change)
- Save to state → no diff detected

**Why This Works:**
- UPDATE with space_ids not in config: Preserves state value → no diff
- UPDATE with space_ids in config: Uses plan value → works as expected
- CREATE: Only has plan, no state → conditional null works

Fixes TestAccResourceOutputKafka Step 2/2 failure.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <[email protected]>

* fix: add UseStateForUnknown plan modifier to output space_ids

Resolves persistent "non-refresh plan was not empty" issue where space_ids
shows as "(known after apply)" after update operations.

**Root Cause:**
The issue occurs during the REFRESH (Read) operation after an update:
1. Update completes, state has space_ids = null
2. Terraform performs refresh (calls Read)
3. Read calls populateFromAPI which sets space_ids = null
4. Terraform sees space_ids as "computed" and marks it as unknown
5. Next plan shows: + space_ids = (known after apply)

**Why Previous Fixes Didn't Work:**
- Commit 2ac6f2f: Removed plan modifier → fixed agent_policy but broke output
- Commit 0346a2d: Conditional null → fixed CREATE but not UPDATE refresh
- Commit 051561a: State preservation in Update → didn't address Read refresh

**The Correct Solution:**
Use UseStateForUnknown() plan modifier ONLY for output resources.

**Why It's Safe for Output:**
- Output API never returns space_ids → always null in state
- No version check in output resources (unlike agent_policy)
- Plan modifier prevents Terraform from marking null as unknown during refresh

**Why agent_policy doesn't use it:**
- Agent policy API DOES return space_ids = ["default"]
- Plan modifier would preserve this value
- Would trigger version check on ES < 9.1.0

**Flow with Plan Modifier:**
- CREATE: space_ids = null → saved to state
- UPDATE: space_ids = null in config
  - Plan modifier: If unknown, use state value (null)
  - Update: space_ids stays null
  - Read refresh: space_ids stays null
  - Plan modifier prevents marking as unknown
- Result: No plan diff

Fixes TestAccResourceOutputKafka for all Elasticsearch versions.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <[email protected]>

* refactor: address code review feedback and improve space-aware implementations

Implemented fixes based on GitHub Copilot code review feedback:

1. **Add space-aware GetEnrollmentTokens function**
   - Created GetEnrollmentTokensInSpace() in fleet client for consistency
   - Updated enrollment_tokens/read.go to use space-aware method when querying all tokens
   - Ensures space filtering works correctly for both policy-specific and all-tokens queries

2. **Refactor integration_policy update.go**
   - Eliminated code duplication in UpdatePackagePolicy calls
   - Extracted space ID determination into single location
   - Simplified conditional logic for better readability

3. **Test argument validation**
   - Verified testAccResourceIntegrationPolicySecretsUpdate argument is correct
   - The "updated" value is intentionally used for testing secret updates

**Impact**: Improved code quality, consistency, and maintainability without changing functionality.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <[email protected]>

* Update internal/fleet/integration_policy/read.go

Co-authored-by: Copilot <[email protected]>

* Update internal/fleet/server_host/models.go

Co-authored-by: Copilot <[email protected]>

* refactor: implement code review feedback for state preservation and DRY improvements

Addressed GitHub Copilot code review feedback:

1. **Fix state preservation timing in output/update.go**
   - Moved space_ids state preservation to after populateFromAPI call
   - Follows the pattern established in integration_policy/update.go (lines 81-111)
   - Ensures state is preserved after API response is processed, not before

2. **Extract buildSpaceAwarePath helper function**
   - Created buildSpaceAwarePath(spaceID, basePath) to eliminate duplication
   - Replaced 60+ occurrences of the space-aware path construction pattern
   - Improved maintainability and consistency across all Fleet API methods

**Impact**: Improved code quality through proper state handling timing and DRY principle application.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <[email protected]>

* fix: revert incorrect Copilot suggestion for import detection

The previous Copilot suggestion changed the import detection logic to use
`req.ImportState`, which doesn't exist on `resource.ReadRequest` in the
terraform-plugin-framework.

Reverted to the previous working implementation that detects imports by
checking if PolicyID is set while Name is null/unknown.

This fixes the build failure:
- req.ImportState undefined (type resource.ReadRequest has no field or method ImportState)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <[email protected]>

* feat: implement default-space-first pattern for Fleet resources

Apply default-space-first operational model across all space-aware Fleet
resources to prevent resource orphaning when users reorder space_ids.

Changes:
- Add GetOperationalSpace() utility that always prefers "default" space
- Update agent_policy (read, update, delete operations)
- Update integration_policy (read, update, delete operations)
- Update output (read, update, delete operations)
- Update server_host (read, update, delete operations)

The "default" space is used as the operational anchor because it cannot
be deleted in Kibana, making it a stable reference point. This prevents
resource orphaning when space_ids list is reordered.

Testing:
- 23 unit tests for GetOperationalSpace() including orphaning prevention
- All existing tests passing
- No breaking changes

Fixes resource orphaning bug identified in code review.

* built docs and fmt

* refactor: change enrollment token space_ids to space_id (breaking change)

BREAKING CHANGE: The `space_ids` field in the enrollment tokens data source
has been changed from a list to a single `space_id` string field.

Since enrollment tokens are scoped to a single space, using a list was
semantically incorrect. This change aligns the API with the actual Fleet
behavior where each token belongs to exactly one space.

Migration:
- Before: `space_ids = ["my-space"]`
- After:  `space_id = "my-space"`

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <[email protected]>

* test: add comprehensive test suite for space-aware Fleet implementation

Added comprehensive unit and acceptance tests covering:

Unit Tests (17 new tests):
- TestExtractSpaceIDs: Validates Terraform List → Go slice conversion
  * Null/unknown lists
  * Single and multiple spaces
  * Special characters and empty strings

- TestSpaceIDsToList: Validates Go slice → Terraform List conversion
  * Empty/nil slices return null lists (by design)
  * Single and multiple spaces
  * Special characters

- TestExtractAndConvertRoundTrip: Validates bidirectional conversion
  * Ensures ExtractSpaceIDs and SpaceIDsToList are inverse operations
  * Tests 0-5 space scenarios

Acceptance Tests (1 critical test):
- TestAccResourceAgentPolicySpaceReordering: THE CRITICAL BUG FIX VALIDATION
  * Step 1: Create with space_ids = ["default"]
  * Step 2: Prepend new space → ["space-test-a", "default"]
    - Validates policy_id UNCHANGED (no recreation/orphaning)
  * Step 3: Reorder spaces → ["default", "space-test-a"]
    - Validates policy_id STILL unchanged

This test EXPLICITLY validates the default-space-first operational model
prevents resource orphaning when users reorder space_ids.

Coverage Impact:
- internal/fleet: 38.5% → 96.2% (+57.7% coverage!)
- ExtractSpaceIDs: 0% → 100%
- SpaceIDsToList: 0% → 100%
- GetOperationalSpace: Already 100% (from previous tests)

Test Count: 40 unit tests + 1 critical acceptance test = 41 total

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <[email protected]>

* Generated docs

* Fixed Space perms issue

* Fixed bug we're Kibana returns spaces in alphabetical order leading to inconsistent result

* Fix tests

* Append space parameter via request editor rather than duplicating all the funcs

* refactor: migrate Fleet space_ids from List to Set

- Changed space_ids to SetAttribute across all 5 Fleet resources
- Fixed prepend bug by reading from STATE not PLAN
- Removed 3 helper functions (ExtractSpaceIDs, GetOperationalSpace, ShouldPreserveSpaceIdsOrder)
- Eliminates drift from Kibana's alphabetical sorting
- Net -89 lines of code

Implements @tobio's PR feedback. All unit tests passing.

* Moved TestAccResourceAgentPolicySpaceReordering from list to set

* fix: remove incorrect UseStateForUnknown plan modifier from integration space_ids

The integration resource's space_ids field should only have RequiresReplace()
plan modifier, not UseStateForUnknown(). This restores the original behavior
from the ListAttribute implementation before the Set migration.

The two modifiers are contradictory: RequiresReplace() destroys the resource
on space_ids changes, so there's no state for UseStateForUnknown() to use.

* test: fix agent policy test to use Set assertion instead of List index

Update TestAccResourceAgentPolicy to use TestCheckTypeSetElemAttr instead
of index-based assertion for space_ids. Sets don't guarantee element order,
so index-based checks (space_ids.0) are incorrect. This brings the test
in line with the Set migration and matches the pattern used in
TestAccResourceAgentPolicySpaceReordering.

* refactor: apply request editor pattern to all Fleet resources

Following Tobio's enrollment tokens example, refactor all Fleet client
functions to use spaceAwarePathRequestEditor instead of duplicate *InSpace
functions with manual HTTP handling.

Changes:
- Deleted 17 duplicate *InSpace functions (~581 lines of manual HTTP code)
- Updated base functions to accept spaceID parameter and use request editor
- Simplified all CRUD operations to single function calls
- Updated test files for new signatures

Benefits:
- Single code path using generated client (vs manual HTTP)
- Consistent pattern across all Fleet resources
- Eliminates 50% code duplication for Fleet operations
- Easier to maintain and test

All Fleet resources now use:
  GetResource(ctx, client, id, spaceID)
  CreateResource(ctx, client, spaceID, body)
  UpdateResource(ctx, client, id, spaceID, body)
  DeleteResource(ctx, client, id, spaceID)

The spaceAwarePathRequestEditor handles path modification automatically.

* Changelog

---------

Co-authored-by: Copilot <[email protected]>
Co-authored-by: Claude <[email protected]>
Co-authored-by: Toby Brain <[email protected]>

Author: 4 people

CHANGELOG.md

@@ -3,6 +3,7 @@
 - Fix `elasticstack_elasticsearch_snapshot_lifecycle` metadata type conversion causing terraform apply to fail ([#1409](https://github.com/elastic/terraform-provider-elasticstack/issues/1409))
 - Add new `elasticstack_elasticsearch_ml_anomaly_detection_job` resource ([#1329](https://github.com/elastic/terraform-provider-elasticstack/pull/1329))
 - Add new `elasticstack_elasticsearch_ml_datafeed` resource ([1340](https://github.com/elastic/terraform-provider-elasticstack/pull/1340))
+- Add `space_ids` attribute to all Fleet resources to support space-aware Fleet resource management ([#1390](https://github.com/elastic/terraform-provider-elasticstack/pull/1390))
 
 ## [0.12.1] - 2025-10-22
 - Fix regression restricting the characters in an `elasticstack_elasticsearch_role_mapping` `name`. ([#1373](https://github.com/elastic/terraform-provider-elasticstack/pull/1373))

docs/data-sources/fleet_enrollment_tokens.md

@@ -28,6 +28,7 @@ data "elasticstack_fleet_enrollment_tokens" "test" {
 ### Optional
 
 - `policy_id` (String) The identifier of the target agent policy. When provided, only the enrollment tokens associated with this agent policy will be selected. Omit this value to select all enrollment tokens.
+- `space_id` (String) The Kibana space ID to query enrollment tokens from. When the agent policy is space-scoped, this must be set to match the policy's space. If not specified, queries the default space.
 
 ### Read-Only
 

docs/resources/fleet_agent_policy.md

@@ -24,6 +24,7 @@ resource "elasticstack_fleet_agent_policy" "test_policy" {
   sys_monitoring  = true
   monitor_logs    = true
   monitor_metrics = true
+  space_ids       = ["default"]
 
   global_data_tags = {
     first_tag = {
@@ -57,6 +58,7 @@ resource "elasticstack_fleet_agent_policy" "test_policy" {
 - `monitoring_output_id` (String) The identifier for monitoring output.
 - `policy_id` (String) Unique identifier of the agent policy.
 - `skip_destroy` (Boolean) Set to true if you do not wish the agent policy to be deleted at destroy time, and instead just remove the agent policy from the Terraform state.
+- `space_ids` (Set of String) The Kibana space IDs that this agent policy should be available in. When not specified, defaults to ["default"]. Note: The order of space IDs does not matter as this is a set.
 - `supports_agentless` (Boolean) Set to true to enable agentless data collection.
 - `sys_monitoring` (Boolean) Enable collection of system logs and metrics.
 - `unenrollment_timeout` (String) The unenrollment timeout for the agent policy. If an agent is inactive for this period, it will be automatically unenrolled. Supports duration strings (e.g., '30s', '2m', '1h').

docs/resources/fleet_integration.md

@@ -69,6 +69,7 @@ resource "elasticstack_fleet_integration" "test_integration" {
 
 - `force` (Boolean) Set to true to force the requested action.
 - `skip_destroy` (Boolean) Set to true if you do not wish the integration package to be uninstalled at destroy time, and instead just remove the integration package from the Terraform state.
+- `space_ids` (Set of String) The Kibana space IDs where this integration package should be installed. When set, the package will be installed and managed within the specified space. Note: The order of space IDs does not matter as this is a set.
 
 ### Read-Only
 

docs/resources/fleet_integration_policy.md

@@ -103,6 +103,7 @@ resource "elasticstack_fleet_integration_policy" "sample" {
 - `force` (Boolean) Force operations, such as creation and deletion, to occur.
 - `input` (Block List) Integration inputs. (see [below for nested schema](#nestedblock--input))
 - `policy_id` (String) Unique identifier of the integration policy.
+- `space_ids` (Set of String) The Kibana space IDs where this integration policy is available. When set, must match the space_ids of the referenced agent policy. If not set, will be inherited from the agent policy. Note: The order of space IDs does not matter as this is a set.
 - `vars_json` (String, Sensitive) Integration-level variables as JSON.
 
 ### Read-Only

docs/resources/fleet_output.md

@@ -213,6 +213,7 @@ resource "elasticstack_fleet_output" "kafka_round_robin" {
 - `hosts` (List of String) A list of hosts.
 - `kafka` (Attributes) Kafka-specific configuration. (see [below for nested schema](#nestedatt--kafka))
 - `output_id` (String) Unique identifier of the output.
+- `space_ids` (Set of String) The Kibana space IDs where this output is available. When set, the output will be created and managed within the specified space. Note: The order of space IDs does not matter as this is a set.
 - `ssl` (Attributes) SSL configuration. (see [below for nested schema](#nestedatt--ssl))
 
 ### Read-Only

docs/resources/fleet_server_host.md

@@ -38,6 +38,7 @@ resource "elasticstack_fleet_server_host" "test_host" {
 
 - `default` (Boolean) Set as default.
 - `host_id` (String) Unique identifier of the Fleet server host.
+- `space_ids` (Set of String) The Kibana space IDs where this server host is available. When set, the server host will be created and managed within the specified space. Note: The order of space IDs does not matter as this is a set.
 
 ### Read-Only
 

examples/resources/elasticstack_fleet_agent_policy/resource.tf

@@ -9,6 +9,7 @@ resource "elasticstack_fleet_agent_policy" "test_policy" {
   sys_monitoring  = true
   monitor_logs    = true
   monitor_metrics = true
+  space_ids       = ["default"]
 
   global_data_tags = {
     first_tag = {