Policies always apply updatedOn even when no change occurs

[jamie3]

Terraform Version = 0.11.11
AzureRM version = 1.17

I created a module which contains a resource group and a policy for applying

locals {
  resource_group_name = "${var.resource_group_name}-rg"
  enabled = "${var.count == "1" ? 1 : 0}"
}

data "azurerm_subscription" "current" {}

# Create Resource Group
resource "azurerm_resource_group" "resource_group" {
  count = "${local.enabled}"

  name     = "${local.resource_group_name}"
  location = "${var.location}"

  tags {
    environment       = "${var.environment}"
    implementor       = "${var.implementor}"
    owner             = "${var.owner}"
    application       = "${var.application}"
    business_unit     = "${var.business_unit}"
    decommission_date = "${var.decommission_date}"
  }
}

# Add RBAC
resource "azurerm_role_assignment" "contributor" {
  count                = "${length(var.contributor_id) == 0 ? 0 : length(var.contributor_id)}"
  scope                = "/subscriptions/${data.azurerm_subscription.current.subscription_id}/resourceGroups/${azurerm_resource_group.resource_group.name}"
  role_definition_name = "Contributor"
  principal_id         = "${var.contributor_id[count.index]}"
}

resource "azurerm_role_assignment" "reader" {
  count                = "${var.reader_id == "0" ? 0 : 1}"
  scope                = "/subscriptions/${data.azurerm_subscription.current.subscription_id}/resourceGroups/${azurerm_resource_group.resource_group.name}"
  role_definition_name = "Reader"
  principal_id         = "${var.reader_id}"
}

# Policies
resource "azurerm_policy_definition" "default_tags" {
  count        = "${local.enabled}"
  name         = "DefaultTags_${azurerm_resource_group.resource_group.name}"
  policy_type  = "Custom"
  mode         = "Indexed"
  display_name = "DefaultTags"

  policy_rule = <<POLICY_RULE
    {
  "if": {
    "field": "tags",
    "exists": "false"
  },
  "then": {
    "effect": "append",
    "details": [
      {
        "field": "tags",
        "value": {
          "environment": "${var.environment}",
          "owner": "${var.owner}",
          "application": "${var.application}",
          "implementor": "${var.implementor}",
          "business_unit": "${var.business_unit}",
          "decommission_date": "${var.decommission_date}"
        }
      }
    ]
  }
  }
POLICY_RULE
}

resource "azurerm_policy_assignment" "default_tags" {
  count                = "${local.enabled}"
  name                 = "DefaultTags_${azurerm_resource_group.resource_group.name}"
  scope                = "${azurerm_resource_group.resource_group.id}"
  policy_definition_id = "${azurerm_policy_definition.default_tags.id}"
  description          = "Resources that are deployed will inherit these tags"
  display_name         = "DefaultTags"
}

When using this module and running terraform plan, the policies always show a change

module.hello_world.module.resource_group_policies.azurerm_policy_definition.default_tags
      metadata:             "{\"createdBy\":\"b616349b-e815-4f28-b813-36732cf6a111\",\"createdOn\":\"2019-02-20T16:04:44.755199Z\",\"updatedBy\":\"b616349b-e815-4f28-b813-36732cf6a111\",\"updatedOn\":\"2019-02-22T15:26:15.171671Z\"}" => ""

It seems the updatedOn field always gets modified by terraform. Ideally if the policy code doesnt change then the updatedOn shouldnt change.

[ghost]

This has been released in version 1.23.0 of the provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading. As an example:

provider "azurerm" {
	version = "~> 1.23.0"
}
# ... other configuration ...

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. If you feel I made an error 🤖 🙉 , please reach out to my human friends 👉 [email protected]. Thanks!