Nat Gateway IP association migration does not work.

[dkistner]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform (and AzureRM Provider) Version

$ tf version
Terraform v0.12.23
+ provider.azurerm v2.12.0

Affected Resource(s)

• azurerm_nat_gateway
• azurerm_nat_gateway_public_ip_association

Terraform Configuration Files

1. Apply this.

provider "azurerm" {
   subscription_id = "subscription_id"
   tenant_id       = "tenant_id"
   client_id       = "sp-id"
   client_secret   = "sp-secret"
   version         = "2.12.0"
   features {}
}
resource "azurerm_resource_group" "rg" {
  name     = "test-nat"
  location = "westeurope"
}

resource "azurerm_public_ip" "natip" {
  name                = "nat-ip"
  location            = "westeurope"
  resource_group_name = "${azurerm_resource_group.rg.name}"
  allocation_method   = "Static"
  sku                 = "Standard"
}

resource "azurerm_nat_gateway" "nat" {
  name                    = "nat-gateway"
  location                = "westeurope"
  resource_group_name     = "${azurerm_resource_group.rg.name}"
  sku_name                = "Standard"
  public_ip_address_ids   = ["${azurerm_public_ip.natip.id}"]
}

2. Remove ip association (public_ip_address_ids) in the azurerm_nat_gateway resource and add azurerm_nat_gateway_public_ip_association resource instead. Reapply it.

resource "azurerm_nat_gateway" "nat" {
  name                    = "nat-gateway"
  location                = "westeurope"
  resource_group_name     = "${azurerm_resource_group.rg.name}"
  sku_name                = "Standard"
}

resource "azurerm_nat_gateway_public_ip_association" "nat-ip-association" {
   nat_gateway_id       = "${azurerm_nat_gateway.nat.id}"
   public_ip_address_id = "${azurerm_public_ip.natip.id}"
}

Panic Output

$ tf apply -auto-approve
azurerm_resource_group.rg: Refreshing state... [id=/subscriptions/<subscription-id>/resourceGroups/test-nat]
azurerm_public_ip.natip: Refreshing state... [id=/subscriptions/<subscription-id>/resourceGroups/test-nat/providers/Microsoft.Network/publicIPAddresses/nat-ip]
azurerm_nat_gateway.nat: Refreshing state... [id=/subscriptions/<subscription-id>/resourceGroups/test-nat/providers/Microsoft.Network/natGateways/nat-gateway]

An execution plan has been generated and is shown below.
Resource actions are indicated with the following symbols:
  + create

Terraform will perform the following actions:

  # azurerm_nat_gateway_public_ip_association.nat-ip-association will be created
  + resource "azurerm_nat_gateway_public_ip_association" "nat-ip-association" {
      + id                   = (known after apply)
      + nat_gateway_id       = "/subscriptions/<subscription-id>/resourceGroups/test-nat/providers/Microsoft.Network/natGateways/nat-gateway"
      + public_ip_address_id = "/subscriptions/<subscription-id>/resourceGroups/test-nat/providers/Microsoft.Network/publicIPAddresses/nat-ip"
    }

Plan: 1 to add, 0 to change, 0 to destroy.

...

azurerm_nat_gateway_public_ip_association.nat-ip-association: Creating...

Error: A resource with the ID "/subscriptions/<subscription-id>/resourceGroups/test-nat/providers/Microsoft.Network/natGateways/nat-gateway|/subscriptions/<subscription-id>/resourceGroups/test-nat/providers/Microsoft.Network/publicIPAddresses/nat-ip" already exists - to be managed via Terraform this resource needs to be imported into the State. Please see the resource documentation for "azurerm_nat_gateway_public_ip_association" for more information.

  on main.tf line 38, in resource "azurerm_nat_gateway_public_ip_association" "nat-ip-association":
  38: resource "azurerm_nat_gateway_public_ip_association" "nat-ip-association" {

Expected Behavior

1. Terraform should not modify the resource as the state on the infrastructure is the same
2. Terraform should migrate the state from internal natgateway ip association to natgateway ip association resource

Actual Behavior

Terraform nat gateway ip association migration from internal via public_ip_address_ids field to association resource azurerm_nat_gateway_public_ip_association is not working.

Steps to Reproduce

1. Apply the first manifest and wait until completed
2. Apply modified version, see second tf manifest
   • without ip association on the natgateway
   • with azurerm_nat_gateway_public_ip_association resource

Important Factoids

no

References

• #0000

[ArcturusZhang]

Hi @dkistner thanks for this issue!

The azurerm_nat_gateway_public_ip_association is a virtual resource that describes the association between a NAT Gateway and a public IP. It is introduced to resolve possible cyclic dependencies when using the NAT Gateway. Also it is a replacement of the public_ip_address_ids attribute in NAT Gateway, which should not use along with the azurerm_nat_gateway_public_ip_association resource.

Since the public_ip_address_ids is a Computed attribute, removing it will not erase the public IP references from the NAT Gateway (this is by-designed to keep backward compatibility). And the association will report it has been existed when terraform iterates all the public IPs in the NAT Gateway and finds a match. Therefore an require import error was thrown out.

To work out this, not only you need to remove the attribute public_ip_address_ids, before you run terraform plan or terraform apply you will have to import the association resource using the ID of the NAT Gateway. Then terraform apply will return no error.

Thanks!

[tombuildsstuff]

hi @dkistner

As @ArcturusZhang has mentioned for resources which already exist in Azure (such as this one) you'll need to import them into the state here (using terraform import) - so this behaviour is expected - and as such I'm going to close this issue for the moment - however once you've imported this into the state this should work as expected and show no diff going forward 👍

Thanks!

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. If you feel I made an error 🤖 🙉 , please reach out to my human friends 👉 hashibot-feedback@hashicorp.com. Thanks!