Remove minItem for zone in firewall (#7817)

hashicorp · Jul 24, 2020 · 61aa6f9 · 61aa6f9
1 parent 8f8da95
commit 61aa6f9
Show file tree

Hide file tree

Showing 3 changed files with 70 additions and 2 deletions.
diff --git a/azurerm/internal/services/network/firewall_resource.go b/azurerm/internal/services/network/firewall_resource.go
@@ -90,7 +90,7 @@ func resourceArmFirewall() *schema.Resource {
 				}, false),
 			},
 
-			"zones": azure.SchemaMultipleZones(),
+			"zones": azure.SchemaZones(),
 
 			"tags": tags.Schema(),
 		},

diff --git a/azurerm/internal/services/network/tests/firewall_resource_test.go b/azurerm/internal/services/network/tests/firewall_resource_test.go
@@ -177,6 +177,25 @@ func TestAccAzureRMFirewall_withZones(t *testing.T) {
 	})
 }
 
+func TestAccAzureRMFirewall_withoutZone(t *testing.T) {
+	data := acceptance.BuildTestData(t, "azurerm_firewall", "test")
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:     func() { acceptance.PreCheck(t) },
+		Providers:    acceptance.SupportedProviders,
+		CheckDestroy: testCheckAzureRMFirewallDestroy,
+		Steps: []resource.TestStep{
+			{
+				Config: testAccAzureRMFirewall_withoutZone(data),
+				Check: resource.ComposeTestCheckFunc(
+					testCheckAzureRMFirewallExists(data.ResourceName),
+				),
+			},
+			data.ImportStep(),
+		},
+	})
+}
+
 func TestAccAzureRMFirewall_disappears(t *testing.T) {
 	data := acceptance.BuildTestData(t, "azurerm_firewall", "test")
 
@@ -563,3 +582,52 @@ resource "azurerm_firewall" "test" {
 }
 `, data.RandomInteger, data.Locations.Primary, data.RandomInteger, data.RandomInteger, data.RandomInteger, zoneString)
 }
+
+func testAccAzureRMFirewall_withoutZone(data acceptance.TestData) string {
+	return fmt.Sprintf(`
+provider "azurerm" {
+  features {}
+}
+
+resource "azurerm_resource_group" "test" {
+  name     = "acctestRG-%d"
+  location = "%s"
+}
+
+resource "azurerm_virtual_network" "test" {
+  name                = "acctestvirtnet%d"
+  address_space       = ["10.0.0.0/16"]
+  location            = azurerm_resource_group.test.location
+  resource_group_name = azurerm_resource_group.test.name
+}
+
+resource "azurerm_subnet" "test" {
+  name                 = "AzureFirewallSubnet"
+  resource_group_name  = azurerm_resource_group.test.name
+  virtual_network_name = azurerm_virtual_network.test.name
+  address_prefix       = "10.0.1.0/24"
+}
+
+resource "azurerm_public_ip" "test" {
+  name                = "acctestpip%d"
+  location            = azurerm_resource_group.test.location
+  resource_group_name = azurerm_resource_group.test.name
+  allocation_method   = "Static"
+  sku                 = "Standard"
+}
+
+resource "azurerm_firewall" "test" {
+  name                = "acctestfirewall%d"
+  location            = azurerm_resource_group.test.location
+  resource_group_name = azurerm_resource_group.test.name
+
+  ip_configuration {
+    name                 = "configuration"
+    subnet_id            = azurerm_subnet.test.id
+    public_ip_address_id = azurerm_public_ip.test.id
+  }
+
+  zones = []
+}
+`, data.RandomInteger, data.Locations.Primary, data.RandomInteger, data.RandomInteger, data.RandomInteger)
+}
diff --git a/website/docs/r/firewall.html.markdown b/website/docs/r/firewall.html.markdown
@@ -68,7 +68,7 @@ The following arguments are supported:
 
 * `threat_intel_mode` - (Optional) The operation mode for threat intelligence-based filtering. Possible values are: `Off`, `Alert` and `Deny`. Defaults to `Alert`
 
-* `zones` - (Optional) Specifies the availability zones in which the Azure Firewall should be created.
+* `zones` - (Optional) Specifies the availability zones in which the Azure Firewall should be created. Changing this forces a new resource to be created.
 
 -> **Please Note**: Availability Zones are [only supported in several regions at this time](https://docs.microsoft.com/en-us/azure/availability-zones/az-overview).