azurerm_linux_virtual_machine secure_boot_enabled forces replacement

[SanderBlom]

Is there an existing issue for this?

• I have searched the existing issues

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment and review the contribution guide to help.

Terraform Version

1.8.2

AzureRM Provider Version

3.101.0

Affected Resource(s)/Data Source(s)

azurerm_linux_virtual_machine

Terraform Configuration Files

resource "azurerm_linux_virtual_machine" "unifi" {
  name                                                   = "vm-unifi-${var.environment_name}"
  resource_group_name                                    = data.azurerm_resource_group.workload.name
  location                                               = data.azurerm_resource_group.workload.location
  size                                                   = local.vm_sku[var.environment_name]
  admin_username                                         = "unifi_admin_user"
  disable_password_authentication                        = false
  admin_password                                         = azurerm_key_vault_secret.unifi-vm-password.value
  tags = var.tags
  provision_vm_agent                                     = true
  encryption_at_host_enabled                             = true
  vtpm_enabled                                           = true
  secure_boot_enabled                                    = false #Changing this to true forces a recreation 
  bypass_platform_safety_checks_on_user_schedule_enabled = true
  network_interface_ids = [
    azurerm_network_interface.unifi_vm.id,
  ]

  os_disk {
    name                 = "osdisk-unifi-${var.environment_name}"
    caching              = "ReadWrite"
    storage_account_type = "Standard_LRS"
    disk_size_gb         = 128
  }

  source_image_reference {
    publisher = "Canonical"
    offer     = "ubuntu-24_04-lts"
    sku       = "server"
    version   = "latest"
  }
}

Debug Output/Panic Output

~ secure_boot_enabled = false -> true # forces replacement

Expected Behaviour

I expect this not to force a replacement as this can be changed with just a reboot in the portal.

Before checking the box and pressing apply:

After checking the box and pressing apply:

Actual Behaviour

The terraform plan says that the VM needs to be recreated

Steps to Reproduce

Deploy a VM without secure boot (needs gen 2 image). After the VM is deployed, change the secure_boot_enabled = false to secure_boot_enabled = true. Terraform should now say that the VM need to be replaced.

Important Factoids

No response

References

No response

[audunsolemdal]

This is true for both

vtpm_enabled
secure_boot_enabled

settings

I believe that this was originally a limitation which no longer exists, and the ForceNew flags should therefore be removed where relevant

https://learn.microsoft.com/en-us/azure/virtual-machines/trusted-launch-existing-vm?tabs=portal
https://learn.microsoft.com/en-us/azure/virtual-machines/trusted-launch-existing-vmss?tabs=template