Terraform DNS provider cant connect to BIND9

Im using Ubuntu’s BIND9 (1:9.16.1-0ubuntu2.10 amd64) and getting strange situation:
when I configure my servers as Primary DNS and Secondary DNS, update with tsig-key works perfect.

When I reconfigure Primary DNS as terraform/dns with same tsig-key, “terraform plan” runs without any errors.

But when Im issuing “terraform apply”, it fails with error that Secondary DNS refused.

BIND logs on Secondary DNS contains error ‘signer “” denied’ on connection from TF.