azurerm_virtual_desktop_workspace not applying tags on first apply

[davetustin]

Is there an existing issue for this?

• I have searched the existing issues

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform Version

1.3.2

AzureRM Provider Version

3.23.0

Affected Resource(s)/Data Source(s)

azurerm_virtual_desktop_workspace

Terraform Configuration Files

variable "default_tags" {
  description = "The default tags applied to all the resources."
  default = {
    Owner: "##########"
    ManagedBy: "##########"
    Environment: "##########"
    Service: "##########"
  }
}

resource "azurerm_virtual_desktop_workspace" "workspace" {
  name                = var.workspace_name
  location            = azurerm_resource_group.rg.location
  resource_group_name = azurerm_resource_group.rg.name
  friendly_name       = var.workspace_friendly_name
  description         = var.workspace_friendly_description

  tags = var.default_tags
}

Debug Output/Panic Output

Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols:
  ~ update in-place

Terraform will perform the following actions:

  # azurerm_virtual_desktop_workspace.workspace will be updated in-place
  ~ resource "azurerm_virtual_desktop_workspace" "workspace" {
        id                  = "/subscriptions/046b1243-9774-4287-9dd9-6603b8edd864/resourceGroups/rg-avd-sandbox-standard/providers/Microsoft.DesktopVirtualization/workspaces/sandbox-standard-workspace"       
        name                = "sandbox-standard-workspace"
      ~ tags                = {
          + "Environment" = "##########"
          + "ManagedBy"   = "##########"
          + "Owner"       = "##########"
          + "Service"     = "##########"
        }
        # (4 unchanged attributes hidden)
    }

Plan: 0 to add, 1 to change, 0 to destroy.

Expected Behaviour

The tags are applied on the first apply.

Actual Behaviour

No tags are added to the azurerm_virtual_desktop_workspace resource. When running the apply a second time, the tags are applied.

All other resources are applying tags, it is only happening to azurerm_virtual_desktop_workspace.

Steps to Reproduce

terraform apply

Important Factoids

No response

References

No response

[davetustin]

The Terraform state file shows the tags on the resource. They are not on the resource in Azure.

[xuzhang3]

@davetustin I cannot reproduce this error, looks like this is a service issue. Though the tags has been send to the service and service has handled is properly(state file has tags and state file is updated based on service response). Do not know why azure resource cannot find the tags.

[jrwesolo]

@davetustin I was running into something similar. My tags would say they would apply, but not apply in the first or subsequent runs. I was on TF 1.3.2 and provider 3.23.0. I upgraded my provider to 3.30.0 and that behavior went away. I'm not sure if this is related, but this is the only change to the azurerm_virtual_desktop_workspace resource from v3.23.0 to v3.30.0.

[jrwesolo]

@davetustin I was running into something similar. My tags would say they would apply, but not apply in the first or subsequent runs. I was on TF 1.3.2 and provider 3.23.0. I upgraded my provider to 3.30.0 and that behavior went away. I'm not sure if this is related, but this is the only change to the azurerm_virtual_desktop_workspace resource from v3.23.0 to v3.30.0.

Actually, nevermind. It's still broken.

[davetustin]

Some additional information.

I have been having some issues with the workspace going missing. After some troubleshooting, if I delete azurerm_virtual_desktop_workspace_application_group_association and re-apply it, the workspace reappears.

At the same time, the tags also needed applying again.

Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the    
following symbols:
  + create
  ~ update in-place

Terraform will perform the following actions:

  # module.azure_virtual_desktop.azurerm_virtual_desktop_workspace.this will be updated in-place
  ~ resource "azurerm_virtual_desktop_workspace" "this" {
        id                  = "/subscriptions/7da2a97e-db58-4cac-91a4-1f374747986b/resourceGroups/rg-avd-casemanager/providers/Microsoft.DesktopVirtualization/workspaces/casemanager-workspace"
        name                = "casemanager-workspace"
      ~ tags                = {
          + "Cost"        = "Infra"
          + "Environment" = "Live"
          + "ManagedBy"   = "Terraform"
          + "Owner"       = "Platform Engineering"
          + "Service"     = "Azure Virtual Desktop"
        }
        # (4 unchanged attributes hidden)
    }

  # module.azure_virtual_desktop.azurerm_virtual_desktop_workspace_application_group_association.this will be created      
  + resource "azurerm_virtual_desktop_workspace_application_group_association" "this" {
      + application_group_id = "/subscriptions/7da2a97e-db58-4cac-91a4-1f374747986b/resourceGroups/rg-avd-casemanager/providers/Microsoft.DesktopVirtualization/applicationGroups/casemanager-dag"
      + id                   = (known after apply)
      + workspace_id         = "/subscriptions/7da2a97e-db58-4cac-91a4-1f374747986b/resourceGroups/rg-avd-casemanager/providers/Microsoft.DesktopVirtualization/workspaces/casemanager-workspace"
    }

Plan: 1 to add, 1 to change, 0 to destroy.

I am not quite sure where the issue lies but something isn't quite right.

[davetustin]

It looks like when the terraform is applied a second time for the tags, it is also removing the workspace. The following steps are done to have the infrastructure up to date.

1. Apply Terraform configuration to build the infrastructure.
2. Apply Terraform again to update the tags on the workspace as this didn't apply the first time. <- this shouldn't happen
3. After applying the configuration, a second time, the workspace disappears.
4. Disassociate the desktop availability group and workspace.
5. Associate the desktop availability group and workspace, the workspace appears.
6. Apply Terraform to confirm there are no infrastructure changes to be made.

I don't know if this is a service or azurerm provider issue at this point.

[davetustin]

After further testing it looks like making any changes to the tags on the azurerm_virtual_desktop_workspace resource removes the workspace so the end user cannot see it.

There is a fundamental issue with editing workspace tags by code. It doesn't happen when doing it in the portal.

[xuzhang3]

@davetustin thanks for the details. The root reason cause the tags remove is cause by azurerm_virtual_desktop_workspace_application_group_association. When you try to associate the workspace to a application group. The update operation will omit the tags. #19574 will fix this bug.

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.