AKS OMS LAW ID repetitively updated due to unnecessary case sensibility

[jingchen1992]

Is there an existing issue for this?

• I have searched the existing issues

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform Version

1.0.8

AzureRM Provider Version

3.1.0

Affected Resource(s)/Data Source(s)

azurerm_kubernetes_cluster.k8s[0]

Terraform Configuration Files

resource "azurerm_kubernetes_cluster" "k8s" {
  count = var.enable_aks ? 1 : 0
  name                = var.aks_name
  ...

  addon_profile {
    oms_agent {
      enabled                    = true
      log_analytics_workspace_id = var.log_analytics_workspace_id
    }
  }

}

Debug Output/Panic Output

~ addon_profile {

          ~ oms_agent {
              ~ log_analytics_workspace_id = "/subscriptions/***/resourceGroups/***-law-rg/providers/Microsoft.OperationalInsights/workspaces/***-law" -> "/subscriptions/***/resourcegroups/***law-rg/providers/microsoft.operationalinsights/workspaces/***-law"

Expected Behaviour

Terraform+Azurerm should NOT plan/apply the change of LAW ID repetitively just due to case sensitivity

Actual Behaviour

Terraform+Azurerm plan/apply change of LAW ID repetitively just due to case sensitivity, even though actual LAW ID is the SAME. It seems what the actual env. value retrieved by Terraform/Azurerm has DIFFERENT CASE from what's configured in Terraform config whose value comes from Azure portal which is all lower case

Steps to Reproduce

1. Copy LAW ID from Azure Portal and paste to replace var.log_analytics_workspace_id
2. Run terraform plan/apply
3. After change is applied, run terraform plan again, and same LAW is being updated again in the plan

Important Factoids

No response

References

No response

[tombuildsstuff]

hi @jingchen1992

Taking a look through here it appears that the value being provided to Terraform isn't provided in the casing we're expecting here - whilst at this point in time this particular field doesn't validate the casing of the particular segments for the Log Analytics Workspace ID that's being provided, this functionality will be added in a future release and as such in the interim you'll need to ensure the value being provided in var.log_analytics_workspace_id matches the value being returned here.

The casing used in the Azure Portal can differ from what's returned from the Azure API - and unfortunately we've found that a number of the Azure APIs can subtly (and silently) break when the incorrect casing is provided, as such we end up having to treat Resource IDs as case-sensitive. As mentioned above we'll be bringing case-specific validation to this field in the future - however for now the casing we're expecting can be found in the documentation for the azurerm_log_analytics_workspace resource (or what's being returned here) - but you should be able to workaround this by updating the casing to match what's expected/being returned here.

Thanks!

[jingchen1992]

Thanks @tombuildsstuff! Now I understand why azurerm treats Resource ID as case sensitive due to other issues of Azure APIs, and your planned fix of applying case-specific validation in the future makes sense. Also FYI, for Log Analytics Workspace Resource ID, I did verify both both Azure Portal and az cli returns all lower case and believe ARM API should return the same.

We are using one of the workaround options including the one your mentioned, but they require extra steps and can cause future confusion. So please let me know how I we can be notified when this fix is available.

Thanks again!

[alxndr13]

@tombuildsstuff unfortunately, even if we provide the LAW Resource ID in the correct casing (all lowercase), the provider always wants to reapply. Seems like Azure transforms the string after the apply.

Edit: seems like the string gets transformed by ID() in log_analytics_workspace.go each time and this causes the repetitive update as the api wants something in lowercase.

[jingchen1992]

Provider reapply in all lowercase if OK. The issue is Terraform Plan repetitively capture this unnecessary change so the fix mentioned by @tombuildsstuff totally makes sense for azurerm ignore casing in comparison and validation for LAW Resource ID.

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.