azurerm_api_management keeps updating developer_portal certificates

[alex-goncharov]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform (and AzureRM Provider) Version

Terraform v0.12.26

• provider.azuread v0.10.0

Affected Resource(s)

• azurerm_api_management

Terraform Configuration Files

resource "azurerm_api_management" "this" {
  name                = "apim"
  location            = "eastus2"
  resource_group_name = "rg"
  publisher_name      = "Publisher"
  publisher_email     = "[email protected]"
  sku_name            = "Developer_1"

  hostname_configuration {
    management {
      host_name            = "mgmt.example.com"
      certificate          = filebase64("./cert.pfx")
      certificate_password = "123qwe"
    }
    portal {
      host_name            = "portal.example.com"
      certificate          = filebase64("./cert.pfx")
      certificate_password = "123qwe"
    }
    developer_portal {
      host_name                    = "dev.example.com"
      certificate                  = filebase64("./cert.pfx")
      certificate_password         = "123qwe"
      negotiate_client_certificate = false
    }
    scm {
      host_name            = "scm.example.com"
      certificate          = filebase64("./cert.pfx")
      certificate_password = "123qwe"
    }

    proxy {
      #default_ssl_binding          = true
      host_name                    = format("%s.azure-api.net", module.labels.id_with_suffix.apim)
      negotiate_client_certificate = false
    }

    proxy {
      #default_ssl_binding          = false
      host_name                    = "api.example.com"
      negotiate_client_certificate = false
      certificate                  = filebase64("./cert.pfx")
      certificate_password         = "123qwe"
    }
  }

  identity {
    type = "SystemAssigned"
  }

  virtual_network_type = "External"

  virtual_network_configuration {
    subnet_id = var.subnet_id
  }
}

Expected Behavior

I do not expect any changes in the plan.

Actual Behavior

  # azurerm_api_management.this will be updated in-place
      ~ hostname_configuration {
          ~ developer_portal {
              + certificate                  = (sensitive value)
              + certificate_password         = (sensitive value)
                host_name                    = "dev.example.com"
                negotiate_client_certificate = false
            }

Steps to Reproduce

1. Create a plan with azurerm_api_management and configure custom hostnames.
2. terraform apply
3. terraform plan

[DamonStamper]

I'm seeing behaviour that seems related.

~ hostname_configuration {

          ~ proxy {
                certificate                  = (sensitive value)
                certificate_password         = (sensitive value)
                default_ssl_binding          = false
              ~ host_name                    = "resource-name.azure-api.net" -> "custom.domain.com"
                negotiate_client_certificate = false
            }
          - proxy {
              - default_ssl_binding          = true -> null
              - host_name                    = "custom.domain.com" -> null
              - negotiate_client_certificate = false -> null

If I set

  lifecycle {
    ignore_changes = [
      hostname_configuration[0].proxy[0].host_name
    ]
  }

Then I get

Error: creating/updating API Management Service "redacted" (Resource Group "redacted"): apimanagement.ServiceClient#CreateOrUpdate: Failure sending request: StatusCode=400 -- Original Error: Code="NotSupported" Message="Certificate management for the default domain 'resource-name.azure-api.net' is not allowed."

[ghost]

This has been released in version 2.38.0 of the provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading. As an example:

provider "azurerm" {
    version = "~> 2.38.0"
}
# ... other configuration ...

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. If you feel I made an error 🤖 🙉 , please reach out to my human friends 👉 [email protected]. Thanks!