azurerm_recovery_services_protected_vm is recreating the resource every time

[kjhosein]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform (and AzureRM Provider) Version

Terraform v0.11.10
AzureRM v1.21.0

Affected Resource(s)

• azurerm_recovery_services_protected_vm

Terraform Configuration Files

resource "azurerm_recovery_services_protected_vm" "backup_vm" {
  resource_group_name = "kjhResourceGroup"
  recovery_vault_name = "rs-kjh-test-2"
  source_vm_id        = "${azurerm_virtual_machine.linux-vm.id}"
  backup_policy_id    = "${data.azurerm_subscription.current.id}/resourcegroups/kjhResourceGroup/providers/Microsoft.RecoveryServices/vaults/rs-kjh-test-2/backupPolicies/DefaultPolicy"
}

Expected Behavior

Terraform should have seen that the backup enrollment(s) was already in place and ignored it (not attempt to destroy and re-create them).

Actual Behavior

Starting from scratch, Terraform successfully creates the Azure Backup enrollment of the VM(s) in approx 1.5-2 minutes.

Without any changes to the deployed resources or the TF code, re-running terraform apply results in a plan that says it has to destroy and re-create the backup:

-/+ module.linux_vm.azurerm_recovery_services_protected_vm.backup_vm[0] (new resource required)
      id:                         "/subscriptions/abzaf8ae-9504-4a34-980c-aad6c39a3c6f/resourceGroups/kjhResourceGroup/providers/Microsoft.RecoveryServices/vaults/rs-kjh-test-2/backupFabrics/Azure/protectionContainers/IaasVMContainer;iaasvmcontainerv2;rg-test;vm0001/protectedItems/VM;iaasvmcontainerv2;rg-test;vm0001" => <computed> (forces new resource)
      backup_policy_id:           "/subscriptions/abzaf8ae-9504-4a34-980c-aad6c39a3c6f/resourceGroups/kjhResourceGroup/providers/Microsoft.RecoveryServices/vaults/rs-kjh-test-2/backupPolicies/DefaultPolicy" => "/subscriptions/abzaf8ae-9504-4a34-980c-aad6c39a3c6f/resourcegroups/kjhResourceGroup/providers/Microsoft.RecoveryServices/vaults/rs-kjh-test-2/backupPolicies/DefaultPolicy" (forces new resource)
      recovery_vault_name:        "rs-kjh-test-2" => "rs-kjh-test-2"
      resource_group_name:        "kjhResourceGroup" => "kjhResourceGroup"
      source_vm_id:               "/subscriptions/abzaf8ae-9504-4a34-980c-aad6c39a3c6f/resourceGroups/rg-test/providers/Microsoft.Compute/virtualMachines/vm0001" => "/subscriptions/abzaf8ae-9504-4a34-980c-aad6c39a3c6f/resourceGroups/rg-test/providers/Microsoft.Compute/virtualMachines/vm0001"

Note that while the id attribute is obviously different (existing value vs computed), the backup_policy_id attribute is the same but yet says "forces new resource".

The other related issue is this:

Saying "yes" to the plan and proceeding results in:

1. Terraform destroying the existing azurerm_recovery_services_protected_vm resources in approx 1.5 mins.
2. Terraform attempting to re-create the azurerm_recovery_services_protected_vm resources but never succeeding. I've had multiple tests run past 15 mins before I killed them.

Lastly:
3. After killing the TF job in step #2, re-running terraform apply runs successfully as it sees that the defined azurerm_recovery_services_protected_vm resources don't exist and creates them.

Steps to Reproduce

1. terraform apply on an already deployed set of azurerm_recovery_services_protected_vm resources without making any changes.

[katbyte]

Hi @kjhosein,

It looks like a casing issue is the root cause here. Could you try changing backup_policy_id = "${data.azurerm_subscription.current.id}/resourcegroups/kjhResourceGroup/providers/Microsoft.RecoveryServices/vaults/rs-kjh-test-2/backupPolicies/DefaultPolicy" } to backup_policy_id = "${data.azurerm_subscription.current.id}/resourceGroups/kjhResourceGroup/providers/Microsoft.RecoveryServices/vaults/rs-kjh-test-2/backupPolicies/DefaultPolicy" }

resourceGroups should have a capital in it.

[kjhosein]

Great eyes @katbyte !
I fixed that error and ran some more tests. Looks like that did the trick. Thanks!

[jlucktay]

I'm having a similar issue with the source_vm_id field, where the resource group section is being lower-cased at some point, so it wants to destroy and re-create the azurerm_recovery_services_protected_vm resource every time.
Even hand-editing the state file, to fix the casing on the resource groups, doesn't get around it.
It does seem to be distinct from this though, so I will investigate a little further, and maybe create a new issue to address it.

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. If you feel I made an error 🤖 🙉 , please reach out to my human friends 👉 [email protected]. Thanks!