azurerm_eventhub_namespace shows changes when there are none on network_rulesets when we provide the rule set through a list

[ShahidMafaz]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform (and AzureRM Provider) Version

Terraform v0.13.2
azurerm v2.26.0
azuread v1.0.0

Affected Resource(s)

• azurerm_eventhub_namespace

Terraform Configuration Files

provider "azurerm" {
  subscription_id = SUBSCRIPTIONID
  version         = "= 2.26.0"
  features {}
}

variable "network_rules" {
/*
A list of subnet ids used to create network rules for event hub namespace.
If this list is empty, no network rules will be created.
*/
  description = "A list of subnet ids used to create network rules."
  type = list(string)
  default = [] 
}

network_rules            = [var.subnetX_id, var.subnetY_id]

resource "azurerm_eventhub_namespace" "eventhub_namespace" {
  name                 = substr("${var.namespace_name}", 0, 50)
  location             = azurerm_resource_group.eventhub.location
  resource_group_name  = azurerm_resource_group.eventhub.name
  sku                  = var.namespace_sku
  capacity             = var.namespace_capacity

  network_rulesets {
    default_action = "Deny"
    virtual_network_rule = [
      for rule in var.network_rules: {
        subnet_id = rule
        ignore_missing_virtual_network_service_endpoint = false
      }
    ]
  }
}

Debug Output

Panic Output

Expected Behavior

When we do the successful 'Terraform apply' for the above eventhub for the first time it creates the eventhub namespace with the given network rule sets. When we run the exact configs and run a terraform plan after the apply, and it should show zero changes

Actual Behavior

When we do the 'Terraform apply' for the above eventhub for the first time it creates the eventhub namespace with the given network rulesets. When we run the exact configs and run a terraform plan after the apply, it shows as 1 resource to update and shows the output as below

 # module.ml_eventhub.module.ml_eventhub.azurerm_eventhub_namespace.eventhub_namespace will be updated in-place
  ~ resource "azurerm_eventhub_namespace" "eventhub_namespace" {
        auto_inflate_enabled                = false
        capacity                            = 1
        default_primary_connection_string   = (sensitive value)
        default_primary_key                 = (sensitive value)
        default_secondary_connection_string = (sensitive value)
        default_secondary_key               = (sensitive value)
        id                                  = "EVENTHUBID"
        location                            = "westus"
        maximum_throughput_units            = 0
        name                                = "EVENTHUBNAME"
      ~ network_rulesets                    = [
          ~ {
                default_action       = "Deny"
                ip_rule              = []
              ~ virtual_network_rule = [
                  ~ {
                        ignore_missing_virtual_network_service_endpoint = false
                      ~ subnet_id                                       = "subnetX_id" -> subnetY_id
                    },
                  ~ {
                        ignore_missing_virtual_network_service_endpoint = false
                      ~ subnet_id                                       = "subnetY_id" -> subnetX_id
                    },
                ]
            },
        ]
        resource_group_name                 = "EVENTHUBRESOURCEGROUPNAME"
        sku                                 = "Standard"
        tags                                = {}
        zone_redundant                      = false
    }

Plan: 0 to add, 1 to change, 0 to destroy.

Steps to Reproduce

1. Create a eventhub namespace terraform config as mentioned above and pass in the network_rulesets as a list variable.
   2 terraform apply this config and create the eventhub namespace with the network_rulesets
   3 Run a terraform plan and it shows there is 1 resource to change and shows and update to the network_rulesets in the eventhub namespace

Important Factoids

PLEASE NOTE THIS ISSUE SEEMS TO EFFECT ONLY ON CERTAIN EVENTHUB NAMESPACES. WE HAVE CREATED 6 EVENTHUB NAMESPACES THROUGH THE SAME CONFIG AND WE OBSERVE THE ISSUE ONLY ON 3 OF THOSE NAMESPACES.

References

[neil-yechenwei]

Thanks for opening this issue. After checked, seems it's an api issue since the subnet id which is returned by api is lower case so that terraform always shows difference after applied. So I raise an issue on Azure/azure-rest-api-specs#10855. I assume you have to use lower function as workaround.

resource "azurerm_eventhub_namespace" "test" {
  name                = "acctesteventhubnamespace-test01"
  location            = azurerm_resource_group.test.location
  resource_group_name = azurerm_resource_group.test.name
  sku                 = "Standard"
  capacity            = "2"

  network_rulesets {
    default_action = "Deny"

    virtual_network_rule {
	  ignore_missing_virtual_network_service_endpoint = false
      subnet_id = lower(azurerm_subnet.test2.id)
    }

    virtual_network_rule {
	  ignore_missing_virtual_network_service_endpoint = false
      subnet_id = lower(azurerm_subnet.test.id)
    }
  }
}

[ShahidMafaz]

@neil-yechenwei Thanks for the quick response and opening up the issue with Azure. Will keep an eye on it.
As for the workaround, we used lower() with the list(string) for the subnet id's and it didn't work as expected. It still shows updates to subnet id's on each run.

[VT83]

Any update on this issue ? We are also facing similar issues with our deployments.

[github-actions]

This functionality has been released in v3.28.0 of the Terraform Provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template. Thank you!

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.