azurerm_api_management_custom_domain: resource gets updated every time

azurerm/internal/services/apimanagement/api_management_custom_domain_resource.go

@@ -163,6 +163,7 @@ func apiManagementCustomDomainCreateUpdate(d *schema.ResourceData, meta interfac
 
 func apiManagementCustomDomainRead(d *schema.ResourceData, meta interface{}) error {
 	client := meta.(*clients.Client).ApiManagement.ServiceClient
+	environment := meta.(*clients.Client).Account.Environment
 	ctx, cancel := timeouts.ForRead(meta.(*clients.Client).StopContext, d)
 	defer cancel()
 
@@ -187,7 +188,8 @@ func apiManagementCustomDomainRead(d *schema.ResourceData, meta interface{}) err
 	d.Set("api_management_id", resp.ID)
 
 	if resp.ServiceProperties != nil && resp.ServiceProperties.HostnameConfigurations != nil {
-		configs := flattenApiManagementHostnameConfiguration(resp.ServiceProperties.HostnameConfigurations, d)
+		apimHostNameSuffix := environment.APIManagementHostNameSuffix
+		configs := flattenApiManagementHostnameConfiguration(resp.ServiceProperties.HostnameConfigurations, d, *resp.Name, apimHostNameSuffix)
 		for _, config := range configs {
 			for key, v := range config.(map[string]interface{}) {
 				// lintignore:R001
@@ -305,7 +307,7 @@ func expandApiManagementCustomDomains(input *schema.ResourceData) *[]apimanageme
 	return &results
 }
 
-func flattenApiManagementHostnameConfiguration(input *[]apimanagement.HostnameConfiguration, d *schema.ResourceData) []interface{} {
+func flattenApiManagementHostnameConfiguration(input *[]apimanagement.HostnameConfiguration, d *schema.ResourceData, name, apimHostNameSuffix string) []interface{} {
 	results := make([]interface{}, 0)
 	if input == nil {
 		return results
@@ -320,6 +322,11 @@ func flattenApiManagementHostnameConfiguration(input *[]apimanagement.HostnameCo
 	for _, config := range *input {
 		output := make(map[string]interface{})
 
+		// There'll always be a default custom domain with hostName "apim_name.azure-api.net" and Type "Proxy", which should be ignored
+		if *config.HostName == strings.ToLower(name)+"."+apimHostNameSuffix && config.Type == apimanagement.HostnameTypeProxy {
+			continue
+		}
+
 		if config.HostName != nil {
 			output["host_name"] = *config.HostName
 		}

azurerm/internal/services/apimanagement/api_management_custom_domain_resource_test.go

@@ -72,14 +72,6 @@ func TestAccApiManagementCustomDomain_update(t *testing.T) {
 				check.That(data.ResourceName).ExistsInAzure(r),
 			),
 		},
-		data.ImportStep(),
-		{
-			Config: r.builtinProxyOnly(data),
-			Check: resource.ComposeTestCheckFunc(
-				check.That(data.ResourceName).ExistsInAzure(r),
-			),
-		},
-		data.ImportStep(),
 	})
 }
 
@@ -106,10 +98,6 @@ func (r ApiManagementCustomDomainResource) basic(data acceptance.TestData) strin
 resource "azurerm_api_management_custom_domain" "test" {
   api_management_id = azurerm_api_management.test.id
 
-  proxy {
-    host_name = "${azurerm_api_management.test.name}.azure-api.net"
-  }
-
   proxy {
     host_name    = "api.example.com"
     key_vault_id = azurerm_key_vault_certificate.test.secret_id
@@ -130,10 +118,6 @@ func (r ApiManagementCustomDomainResource) proxyOnly(data acceptance.TestData) s
 resource "azurerm_api_management_custom_domain" "test" {
   api_management_id = azurerm_api_management.test.id
 
-  proxy {
-    host_name = "${azurerm_api_management.test.name}.azure-api.net"
-  }
-
   proxy {
     host_name    = "api.example.com"
     key_vault_id = azurerm_key_vault_certificate.test.secret_id
@@ -149,10 +133,6 @@ func (r ApiManagementCustomDomainResource) developerPortalOnly(data acceptance.T
 resource "azurerm_api_management_custom_domain" "test" {
   api_management_id = azurerm_api_management.test.id
 
-  proxy {
-    host_name = "${azurerm_api_management.test.name}.azure-api.net"
-  }
-
   developer_portal {
     host_name    = "portal.example.com"
     key_vault_id = azurerm_key_vault_certificate.test.secret_id
@@ -161,31 +141,13 @@ resource "azurerm_api_management_custom_domain" "test" {
 `, r.template(data))
 }
 
-func (r ApiManagementCustomDomainResource) builtinProxyOnly(data acceptance.TestData) string {
-	return fmt.Sprintf(`
-%s
-
-resource "azurerm_api_management_custom_domain" "test" {
-  api_management_id = azurerm_api_management.test.id
-
-  proxy {
-    host_name = "${azurerm_api_management.test.name}.azure-api.net"
-  }
-}
-`, r.template(data))
-}
-
 func (r ApiManagementCustomDomainResource) requiresImport(data acceptance.TestData) string {
 	return fmt.Sprintf(`
 %s
 
 resource "azurerm_api_management_custom_domain" "import" {
   api_management_id = azurerm_api_management_custom_domain.test.api_management_id
 
-  proxy {
-    host_name = "${azurerm_api_management.test.name}.azure-api.net"
-  }
-
   proxy {
     host_name    = "api.example.com"
     key_vault_id = azurerm_key_vault_certificate.test.secret_id
@@ -243,6 +205,7 @@ resource "azurerm_key_vault" "test" {
       "delete",
       "get",
       "update",
+      "purge",
     ]
 
     key_permissions = [

azurerm/internal/services/apimanagement/api_management_resource.go

@@ -363,6 +363,7 @@ func resourceApiManagementService() *schema.Resource {
 			"hostname_configuration": {
 				Type:     schema.TypeList,
 				Optional: true,
+				Computed: true,
 				MaxItems: 1,
 				Elem: &schema.Resource{
 					Schema: map[string]*schema.Schema{

website/docs/r/api_management_custom_domain.html.markdown

@@ -135,6 +135,8 @@ A `developer_portal`, `management`, `portal` or `scm` block supports the followi
 
 A `proxy` block supports the following:
 
+-> **Tip:** The default proxy hostname ending with `.azure-api.net` must not be added as it will be automatically created by Azure and ignored by Terraform.
+
 * `host_name` - (Required) The Hostname to use for the API Proxy Endpoint.
 
 * `certificate` - (Optional) The Base64 Encoded Certificate. (Mutually exlusive with `key_vault_id`.)