Ignoring VSTS Configuration on Azure Data Factory fails on initial apply only - subsequent apply succeeds

[dps3ven]

Is there an existing issue for this?

• I have searched the existing issues

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform Version

1.3.7

AzureRM Provider Version

3.48.0

Affected Resource(s)/Data Source(s)

azurerm_data_factory

Terraform Configuration Files

provider "azurerm" {
  features {}
}

data "azurerm_client_config" "current" {}
data "azurerm_resource_group" "resource_group" {
  name = local.resource_group_name
}

resource "random_string" "random" {
  length  = 2
  special = false
  upper   = false
}

resource "azurerm_data_factory" "data_factory" {
  name                            = format("example-test-%s", random_string.random.result)
  location                        = data.azurerm_resource_group.resource_group.location
  resource_group_name             = data.azurerm_resource_group.resource_group.name
  # tags                          = {"test" = "this"}

  lifecycle {
    ignore_changes = [
      vsts_configuration, 
      github_configuration
    ]
  }
}

Debug Output/Panic Output

Initial Apply Debug results summary (failure):

2023-03-22T12:08:44.459-0500 [WARN]  Provider "registry.terraform.io/hashicorp/azurerm" produced an unexpected new value for azurerm_data_factory.data_factory during refresh.
      - .vsts_configuration: block count changed from 0 to 1

Subsequent Apply Debug results summary (success):

2023-03-22T12:10:53.028-0500 [WARN]  Provider "registry.terraform.io/hashicorp/azurerm" produced an unexpected new value for azurerm_data_factory.data_factory during refresh.
      - .vsts_configuration: block count changed from 1 to 0

Further apply attempts succeed and do not append this warning to the log file.

Expected Behaviour

Apply complete! Resources: 0 added, 1 changed, 0 destroyed.

Actual Behaviour

StatusCode=403 -- Original Error: autorest/azure: Service returned an error. Status=403 Code="AuthorizationFailed" Message="The client does not have authorization to perform action 'Microsoft.DataFactory/locations/configureFactoryRepo/action' over scope ' or the scope is invalid. If access was recently granted, please refresh your credentials."

Steps to Reproduce

1. terraform apply (succeeds)
2. manually configure the git repo in the Azure Portal
3. add tags to the terraform configuration
4. terraform apply (fails with 403 above)
5. terraform apply (succeeds with expected behavior))

Important Factoids

No response

References

Known issue:
#6484

The attempt to ignore the changes to the vsts configuration is a workaround to this expected 403 error.