Unrelated change in resource reference causes a change in custom_data and forces a new resource

[fl-max]

There appears to be an issue when updating the Tags of resources that are referenced in a custom_data template that is causing the VM to be replaced.

      - os_profile { # forces replacement
          - admin_username = "azuser" -> null
          - computer_name  = "Test" -> null
        }
      + os_profile { # forces replacement
          + admin_username = "azuser"
          + computer_name  = "Test"
          + custom_data    = (known after apply)
        }

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform (and AzureRM Provider) Version

$ terraform -v
Terraform v0.12.12
+ provider.azurerm v1.36.0
+ provider.template v2.1.2

Affected Resource(s)

• azurerm_virtual_machine
• data.template_cloudinit_config

Terraform Configuration Files

# Common Variables
locals {
  res_name_prefix = "Terraform-AzureRM"

  tags = {
    Environment         = var.environment
    Version             = var.project_version
  }
}

# Configure the Azure Provider
provider "azurerm" {
  version = "~> 1.36.0"

  subscription_id = var.subscription_id

  client_id     = var.client_id
  client_secret = var.client_secret
  tenant_id     = var.tenant_id
}

resource "azurerm_resource_group" "test" {
  name     = "${local.res_name_prefix}-VMTest"
  location = "eastus2"
  tags     = local.tags
}

resource "azurerm_network_security_group" "test" {
  name                = "${local.res_name_prefix}-Test"
  location            = azurerm_resource_group.test.location
  resource_group_name = azurerm_resource_group.test.name
  tags                = local.tags
}

resource "azurerm_virtual_network" "test" {
  name                = "${local.res_name_prefix}-Test"
  location            = azurerm_resource_group.test.location
  resource_group_name = azurerm_resource_group.test.name
  address_space       = ["192.168.0.0/24"]

  tags = local.tags
}

resource "azurerm_subnet" "test" {
  name                 = "default"
  resource_group_name  = azurerm_resource_group.test.name
  virtual_network_name = azurerm_virtual_network.test.name
  address_prefix       = "192.168.0.0/24"
}

resource "azurerm_subnet_network_security_group_association" "test" {
  subnet_id                 = azurerm_subnet.test.id
  network_security_group_id = azurerm_network_security_group.test.id
}

resource "azurerm_network_security_rule" "inbound-deny" {
  name                        = "${local.res_name_prefix}_inbound_deny"
  priority                    = 1000
  direction                   = "Inbound"
  access                      = "Deny"
  protocol                    = "Tcp"
  source_port_range           = "*"
  destination_port_range      = "*"
  source_address_prefix       = "*"
  destination_address_prefix  = "*"
  resource_group_name         = azurerm_resource_group.test.name
  network_security_group_name = azurerm_network_security_group.test.name
}

resource "azurerm_network_interface" "test" {
  name                      = "${local.res_name_prefix}-Test"
  location                  = azurerm_resource_group.test.location
  resource_group_name       = azurerm_resource_group.test.name
  network_security_group_id = azurerm_network_security_group.test.id

  ip_configuration {
    name                          = "primary"
    subnet_id                     = azurerm_subnet.test.id
    private_ip_address_allocation = "dynamic"
  }

  tags = local.tags
}

locals {
  rg_name = azurerm_resource_group.test.name
}

data "template_cloudinit_config" "main" {
  gzip          = false
  base64_encode = false

  part {
    content_type = "text/cloud-config"
    content      = "runcmd:\n  - echo ${azurerm_resource_group.test.name}" # Fails
    # content      = "runcmd:\n  - echo ${local.rg_name}" # Works
    # content      = "runcmd:\n  - echo ${azurerm_resource_group.test.location}" # Fails
    # content      = "runcmd:\n  - echo ${azurerm_network_security_group.test.name}" # Fails
  }
}

resource "azurerm_virtual_machine" "test" {
  name                = "Test"
  location            = azurerm_resource_group.test.location
  resource_group_name = azurerm_resource_group.test.name

  network_interface_ids = [
    azurerm_network_interface.test.id,
  ]

  primary_network_interface_id     = azurerm_network_interface.test.id
  vm_size                          = "Standard_A1"
  delete_os_disk_on_termination    = true
  delete_data_disks_on_termination = true
  storage_image_reference {
    publisher = "OpenLogic"
    offer     = "CentOS"
    sku       = "7-CI"
    version   = "latest"
  }
  storage_os_disk {
    name              = "master-osdisk"
    caching           = "None"
    create_option     = "FromImage"
    managed_disk_type = "Standard_LRS"
    disk_size_gb      = 32
  }
  os_profile {
    computer_name  = "Test"
    admin_username = "azuser"
    custom_data    = data.template_cloudinit_config.main.rendered
  }
  os_profile_linux_config {
    disable_password_authentication = true

    ssh_keys {
      path     = "/home/azuser/.ssh/authorized_keys"
      key_data = var.ssh_key
    }
  }
  
  tags = local.tags
}

Debug Output

Panic Output

Expected Behavior

Changing the value of a Resource Tag shouldn't cause unrelated values to change (ie. resource name). A subsequent apply should simply update the Tag and custom_data should not change.

Step 1)

$ terraform apply -var-file my.tfvars -var 'project_version=v0.1.0'
...
Plan: 8 to add, 0 to change, 0 to destroy.

Step 2)

$ terraform apply -var-file my.tfvars -var 'project_version=v0.1.1'
...
Plan: 0 to add, 6 to change, 0 to destroy.

Actual Behavior

Step 1)

$ terraform apply -var-file my.tfvars -var 'project_version=v0.1.0'
...
Plan: 8 to add, 0 to change, 0 to destroy.

Step 2)

$ terraform apply -var-file my.tfvars -var 'project_version=v0.1.1'
...
Plan: 1 to add, 5 to change, 1 to destroy.

Steps to Reproduce

1. terraform apply -var-file my.tfvars -var 'project_version=v0.1.0'
2. terraform apply -var-file my.tfvars -var 'project_version=v0.1.1'

Important Factoids

Putting the Resource reference in a Locals variable works around the issue.

References

• #0000

[tombuildsstuff]

hi @fl-max

We're currently working on version 2.0 of the Azure Provider which we previously announced in #2807.

As a part of this we're introducing five new resources which will supersede the existing azurerm_virtual_machine and azurerm_virtual_machine_scale_set resources:

• azurerm_linux_virtual_machine
• azurerm_linux_virtual_machine_scale_set
• azurerm_virtual_machine_scale_set_extension
• azurerm_windows_virtual_machine
• azurerm_windows_virtual_machine_scale_set

We recently opened #5550 which adds support for the new Virtual Machine resources - and I'm able to confirm that this is fixed in the new Virtual Machine resources - however unfortunately we have no plans to backport this to the existing azurerm_virtual_machine resource.

In order to get feedback on these new resources we'll be launching support for these new resources as an opt-in Beta in an upcoming 1.x release of the Azure Provider and ultimately release these as "GA" in the upcoming 2.0 release. We'll post an update in #2807 when both the opt-in Beta (1.x) & GA (2.0) are available - as such I'd recommend subscribing to that issue for updates.

This issue's been assigned to the milestone "2.0" since this is where this will ship - however (due to the way that closing Github Issues from PR's works, to be able to track this back for future users) this issue will be closed once the first of the new resources have been merged.

Thanks!

[ghost]

This has been released in version 2.0.0 of the provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading. As an example:

provider "azurerm" {
    version = "~> 2.0.0"
}
# ... other configuration ...

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. If you feel I made an error 🤖 🙉 , please reach out to my human friends 👉 [email protected]. Thanks!