BUG > azurerm_subscription resource forces recreation on existing statefiles

[kuwas]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform (and AzureRM Provider) Version

• terraform v1.0.0
• terraform-provider-azurerm v2.63.0

Affected Resource(s)

• azurerm_subscription

Terraform Configuration Files

locals {
  subscription = {
    types = {
      dev  = "DevTest"
      prod = "Production"
    }
  }
}

resource "azurerm_subscription" "default" {
  billing_scope_id  = data.azurerm_billing_enrollment_account_scope.default.id
  workload          = local.subscription.types[var.subscription_type]
  subscription_name = module.names.internal.subscription.name_unique
  alias             = module.names.internal.subscription.name_unique
  timeouts {
    create = "60m"
    update = "60m"
    delete = "60m"
  }
}

Debug Output

terraform plan

  # module.projects["<redacted>"].module.subscriptions["<redacted>"].azurerm_subscription.default must be replaced
-/+ resource "azurerm_subscription" "default" {
      ~ id                = "/providers/Microsoft.Subscription/aliases/sub-<redacted>" -> (known after apply)
      ~ subscription_id   = "<redacted>" -> (known after apply)
      ~ tags              = {} -> (known after apply)
      ~ tenant_id         = "<redacted>" -> (known after apply)
      + workload          = "Production" # forces replacement
        # (3 unchanged attributes hidden)

        # (1 unchanged block hidden)
    }

statefile

    {
      "module": "module.projects[\"<redacted>\"].module.subscriptions[\"<redacted>\"]",
      "mode": "managed",
      "type": "azurerm_subscription",
      "name": "default",
      "provider": "provider[\"registry.terraform.io/hashicorp/azurerm\"]",
      "instances": [
        {
          "schema_version": 0,
          "attributes": {
            "alias": "sub-<redacted>",
            "billing_scope_id": "/providers/Microsoft.Billing/billingAccounts/<redacted>/enrollmentAccounts/<redacted>",
            "id": "/providers/Microsoft.Subscription/aliases/sub-<redacted>",
            "subscription_id": "<redacted>",
            "subscription_name": "<redacted>",
            "tags": {},
            "tenant_id": "<redacted>",
            "timeouts": {
              "create": "60m",
              "delete": "60m",
              "read": null,
              "update": "60m"
            },
            "workload": null
          },
          "sensitive_attributes": [],
          "private": "<redacted>",
          "dependencies": [
            "module.projects.module.subscriptions.data.azurerm_billing_enrollment_account_scope.default"
          ]
        }
      ]
    }

Panic Output

Expected Behaviour

• azurerm_subscription resources are not recreated
  • Old statefiles should be compatible and no recreation should be required

Actual Behaviour

• azurerm_subscription resources are being recreated
  • Previous versions of the resource stored null as the workload in the statefile
  • azurerm_subscription - fix ability to specify DevTest as workload #12066 is now storing a non-null value as the workload in the statefile
  • workload is set to ForceNew: true
    • https://github.com/terraform-providers/terraform-provider-azurerm/blob/master/azurerm/internal/services/subscription/subscription_resource.go#L80

Steps to Reproduce

1. terraform plan

Important Factoids

• We have hundreds of production azurerm_subscription resources managed in terraform, recreation would not be possible.

References

• azurerm_subscription - fix ability to specify DevTest as workload #12066

[juicybaba]

@katbyte any update on this?

Tagging subscription is finally supported in 2.88.0, but as soon as I bump up azurerm version to 2.63.0 or newer, the subscription has to be force recreated.

terraform-provider-azurerm/internal/services/subscription/subscription_resource.go

Line 82 in 661037e

ForceNew: true,

[yann-soubeyrand]

@henryxuteck I came up with two workarounds in my case:

• You can add a block like the following on your subscriptions resources

  lifecycle {
    ignore_changes = [
      workload,
    ]
  }
  

• You can pull your state, edit it to replace "workload": null with "workload": "Production" or "workload": "DevTest" for each of your subscriptions, and push back the state.

[juicybaba]

@yann-soubeyrand
Thanks for the workarounds, I guess I have to go this way before it gets officially fixed or officially announced non-fix-able.

[rcskosir]

Thanks for opening this issue. This was a problem in the 2.x version of the provider which is no longer actively maintained.
If this is still an issue with the 3.x version of the provider please do let us know by opening a new issue, thanks!

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.