Feature Request: Subnets defined in-line within the Virtual Network resource doesn't support all parameters

[JamesDLD]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Description

Subnets defined in-line within the Virtual Network resource doesn't support all parameters that are available in the standalone Subnet resource.

Subnets defined in-line within the Virtual Network resource support -->

• name
• address_prefix
• security_group

Subnet defined in the standalone Subnet resource support -->

• name
• resource_group_name
• virtual_network_name
• address_prefix
• network_security_group_id
• route_table_id
• service_endpoints
• delegation
• service_delegation

New or Affected Resource(s)

• azurerm_virtual_network

Potential Terraform Configuration

resource "azurerm_resource_group" "test" {
  name     = "acceptanceTestResourceGroup1"
  location = "West US"
}

resource "azurerm_network_security_group" "test" {
  name                = "acceptanceTestSecurityGroup1"
  location            = "${azurerm_resource_group.test.location}"
  resource_group_name = "${azurerm_resource_group.test.name}"
}

resource "azurerm_route_table" "test" {
  name                          = "acceptanceTestRouteTable"
  location                      = "${azurerm_resource_group.test.location}"
  resource_group_name           = "${azurerm_resource_group.test.name}"
  disable_bgp_route_propagation = false

  route {
    name           = "route1"
    address_prefix = "10.1.0.0/16"
    next_hop_type  = "vnetlocal"
  }

  tags = {
    environment = "Production"
  }
}

resource "azurerm_ddos_protection_plan" "test" {
  name                = "ddospplan1"
  location            = "${azurerm_resource_group.test.location}"
  resource_group_name = "${azurerm_resource_group.test.name}"
}

resource "azurerm_virtual_network" "test" {
  name                = "virtualNetwork1"
  location            = "${azurerm_resource_group.test.location}"
  resource_group_name = "${azurerm_resource_group.test.name}"
  address_space       = ["10.0.0.0/16"]
  dns_servers         = ["10.0.0.4", "10.0.0.5"]

  ddos_protection_plan {
    id     = "${azurerm_ddos_protection_plan.test.id}"
    enable = true
  }

  subnet {
    name              = "subnet1"
    address_prefix    = "10.0.1.0/24"
    route_table_id    = azurerm_route_table.test.id
    service_endpoints = ["Microsoft.Sql", "Microsoft.Storage"]
    delegation {
      name = "acctestdelegation"

      service_delegation {
        name    = "Microsoft.ContainerInstance/containerGroups"
        actions = ["Microsoft.Network/virtualNetworks/subnets/action"]
      }
    }
  }

  subnet {
    name           = "subnet2"
    address_prefix = "10.0.2.0/24"
    security_group = azurerm_network_security_group.test.id
  }

  tags = {
    environment = "Production"
  }
}

References

azurerm_subnet : https://www.terraform.io/docs/providers/azurerm/r/subnet.html
azurerm_virtual_network : https://www.terraform.io/docs/providers/azurerm/r/virtual_network.html

[tradosh]

the subnet for address_prefix should accept IPv4 and IPv6 values instead of just one value in here

[jtracey93]

I can see in the azurerm_subnet resource source code that support for "address_prefix" will be removed in the next major release (https://github.com/terraform-providers/terraform-provider-azurerm/blob/master/azurerm/internal/services/network/subnet_resource.go#L60) and therefore a push towards "address_prefixes" (what we need for the above issue that @tradosh mentioned/created above) will be required in the subnet & VNET resources for Terraform.

Is there an ETA on this being completed? As this also could help with #9022 in some scenarios, especially @tradosh's above 😃

[wwasher3]

Sorry to ask for an ETA but looks as through there is nothing new on this issue for quite a while and was interested in getting an update/ETA.
Thanks.

[gettek]

Hi @tombuildsstuff

Can't remember if these are automatically set during association but is there also scope for including the below Private Link Endpoints or Private Link Services flags as available in the standalone subnet resource? Thanks!

• enforce_private_link_endpoint_network_policies
• azurerm_subnet_network_security_group_association