OS disk encryption settings can’t be changed after initial VM creation

[kazimierzbudzyk]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform (and AzureRM Provider) Version

terraform v0.12.20
provider.azurerm v2.0.0

Affected Resource(s)

• azurerm_linux_virtual_machine
• azurerm_disk_encryption_set

Terraform Configuration Files

resource "azurerm_virtual_network" "cmk-test" {
  name                = "cmk-test-network"
  address_space       = ["10.0.0.0/16"]
  location            = data.azurerm_resource_group.zaz_rg.location
  resource_group_name = data.azurerm_resource_group.zaz_rg.name
}

resource "azurerm_subnet" "cmk-test" {
  name                 = "internal"
  resource_group_name  = data.azurerm_resource_group.zaz_rg.name
  virtual_network_name = azurerm_virtual_network.cmk-test.name
  address_prefix       = "10.0.2.0/24"
}

resource "azurerm_network_interface" "cmk-test" {
  name                = "cmk-test-nic"
  location            = data.azurerm_resource_group.zaz_rg.location
  resource_group_name = data.azurerm_resource_group.zaz_rg.name
  
  ip_configuration {
    name                          = "internal"
    subnet_id                     = azurerm_subnet.cmk-test.id
    private_ip_address_allocation = "Dynamic"
  }
}

resource "azurerm_linux_virtual_machine" "cmk-test-vm" {
  name                = "cmk-test-vm"
  resource_group_name = data.azurerm_resource_group.zaz_rg.name
  location            = data.azurerm_resource_group.zaz_rg.location
  size                = "Standard_D2s_v3"
  admin_username      = "adminuser"

  network_interface_ids = [
    azurerm_network_interface.cmk-test.id,
  ]

  zone = "1"
  admin_ssh_key {
    username   = "adminuser"
    public_key = file("~/.ssh/id_rsa.pub")
  }
  
  os_disk {
    name                 = "cmk-os-disk"
    caching              = "ReadWrite"
    storage_account_type = "Premium_LRS"
    disk_size_gb         = "30"
    # disk_encryption_set_id = azurerm_disk_encryption_set.cmk-disk-encryption-set.id
  }
  source_image_reference {
    publisher = "OpenLogic"
    offer     = "CentOS"
    sku       = "7.7"
    version   = "latest"
  }
}

Expected Behavior

OS disk can be added to encryption set for previously created VM.

Actual Behavior

OS disks encryption settings can't be modified outside of initial VM creation. Error:

*Error: **Error updating Linux Virtual Machine "cmk-test-vm" (Resource Group "zaz-resource-group"): compute.VirtualMachinesClient#Update: Failure sending request: StatusCode=0 -- Original Error: autorest/azure: Service returned an error. Status=<nil> Code="OperationNotAllowed" Message="Managed disk encryption set resource id change for disk 'cmk-os-disk' via Virtual Machine 'cmk-test-vm' is not allowed. Please update disk resource at /subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/resourceGroups/ZAZ-RESOURCE-GROUP/providers/Microsoft.Compute/disks/cmk-os-disk." Target="diskEncryptionSets"*

Steps to Reproduce

1. terraform plan
2. terraform apply
3. uncomment # disk_encryption_set_id = azurerm_disk_encryption_set.cmk-disk-encryption-set.id
4. terraform plan
5. terraform apply

Important Factoids

KeyVault and encryption set are otherwise configured correctly (verified in UI).
VM was manually deallocated before attempting enabling CMK encryption.

[ghost]

This has been released in version 2.5.0 of the provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading. As an example:

provider "azurerm" {
    version = "~> 2.5.0"
}
# ... other configuration ...

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. If you feel I made an error 🤖 🙉 , please reach out to my human friends 👉 [email protected]. Thanks!