azurerm_subnet : nsg and rt associations destroyed on reapply

[tcanelas]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform (and AzureRM Provider) Version

Terraform v0.11.13
+ provider.azurerm v1.22.1

Affected Resource(s)

• azurerm_subnet

Terraform Configuration Files

resource "azurerm_subnet" "devenv" {
  name                 = "DevEnv"
  resource_group_name  = "${azurerm_resource_group.rg.name}"
  virtual_network_name = "${azurerm_virtual_network.vnet.name}"
  address_prefix       = "${cidrsubnet(element(var.some_cidrs,0),3,0)}"
}

resource "azurerm_subnet_network_security_group_association" "devenv" {
  subnet_id                 = "${azurerm_subnet.devenv.id}"
  network_security_group_id = "${azurerm_network_security_group.devenv.id}"
}

resource "azurerm_subnet_route_table_association" "devenv" {
  subnet_id      = "${azurerm_subnet.devenv.id}"
  route_table_id = "${azurerm_route_table.default.id}"
}

Expected Behavior

terraform plan should return "Nothing to change" as the stack is the same after an apply

Actual Behavior

terraform plan :

Terraform will perform the following actions:

  ~ azurerm_subnet.devenv
      network_security_group_id: "/subscriptions/x-x-x-x/resourceGroups/core-network/providers/Microsoft.Network/networkSecurityGroups/devenv" => ""
      route_table_id:            "/subscriptions/x-x-x-x/resourceGroups/core-network/providers/Microsoft.Network/routeTables/defaultRouteTable" => ""


Plan: 0 to add, 1 to change, 0 to destroy.

Terraform will destroy the associations on another apply.
On next apply, it will recreate it, terraform plan:

Terraform will perform the following actions:

  + azurerm_subnet_network_security_group_association.devenv
      id:                        <computed>
      network_security_group_id: "/subscriptions/x-x-x-x/resourceGroups/core-network/providers/Microsoft.Network/networkSecurityGroups/devenv"
      subnet_id:                 "/subscriptions/x-x-x-x/resourceGroups/core-network/providers/Microsoft.Network/virtualNetworks/core-vnet/subnets/DevEnv"

  + azurerm_subnet_route_table_association.devenv
      id:                        <computed>
      route_table_id:            "/subscriptions/x-x-x-x/resourceGroups/core-network/providers/Microsoft.Network/routeTables/defaultRouteTable"
      subnet_id:                 "/subscriptions/x-x-x-x/resourceGroups/core-network/providers/Microsoft.Network/virtualNetworks/core-vnet/subnets/DevEnv"


Plan: 2 to add, 0 to change, 0 to destroy.

Steps to Reproduce

Use the stack provided and add provider,resourcegroup and vnet

1. terraform apply
2. terraform apply

[tombuildsstuff]

hi @tcanelas

Thanks for opening this issue :)

At this time unfortunately the association between a Subnet and the Network Security Group/Route Table need to be defined using both the in-line properties and the separate resources; otherwise they'll conflict (as you're seeing here). Whilst this is unfortunate this behaviour exists to prevent a breaking change in the Provider where it's possible to remove the NSG/Route Table from the Subnet by removing these fields from your Terraform Configuration.

We plan to make this breaking change in the next major version of the AzureRM Provider (2.0 - more details here) by removing the fields from within the azurerm_subnet resource (in favour of the split out resource, as such this is here to aid transitioning to 2.0) - however as mentioned above (and in the documentation) unfortunately at this time both fields will need to be specified. Would you be able to update your Terraform Configuration to ensure this association is defined both within the azurerm_subnet resource and using the separate association resources?

Since this is a question about Terraform Configuration rather than a bug in Terraform I'm going to close this issue for the moment, however please let us know if that doesn't work for you and we'll take another look.

Thanks!

[tcanelas]

hi @tombuildsstuff ,
Thanks for the lightning, it works using the old way only too, that's why i was asking myself.
I'll change it to use both ways,
Thanks

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. If you feel I made an error 🤖 🙉 , please reach out to my human friends 👉 [email protected]. Thanks!