Add each available diagnostics category, but enable only those we want

This is a workaround for a know issue: hashicorp/terraform-provider-azurerm#7235

main.tf

@@ -84,6 +84,10 @@ resource "null_resource" "authorization_rules" {
 }
 
 
+data "azurerm_monitor_diagnostic_categories" "default" {
+  resource_id = azurerm_relay_namespace.arhc.id
+}
+
 resource "azurerm_monitor_diagnostic_setting" "namespace" {
   count                          = var.diagnostics != null ? 1 : 0
   name                           = "${var.name}-ns-diag"
@@ -93,24 +97,34 @@ resource "azurerm_monitor_diagnostic_setting" "namespace" {
   eventhub_name                  = local.parsed_diag.event_hub_auth_id != null ? var.diagnostics.eventhub_name : null
   storage_account_id             = local.parsed_diag.storage_account_id
 
+  # For each available log category, check if it should be enabled and set enabled = true if it should.
+  # All other categories are created with enabled = false to prevent TF from showing changes happening with each plan/apply.
+  # Ref: https://github.com/terraform-providers/terraform-provider-azurerm/issues/7235
   dynamic "log" {
-    for_each = local.parsed_diag.log
+    for_each = data.azurerm_monitor_diagnostic_categories.default.logs
     content {
       category = log.value
+      enabled  = contains(local.parsed_diag.log, log.value)
 
       retention_policy {
         enabled = false
+        days    = 0
       }
     }
   }
 
+  # For each available metric category, check if it should be enabled and set enabled = true if it should.
+  # All other categories are created with enabled = false to prevent TF from showing changes happening with each plan/apply.
+  # Ref: https://github.com/terraform-providers/terraform-provider-azurerm/issues/7235
   dynamic "metric" {
-    for_each = local.parsed_diag.metric
+    for_each = data.azurerm_monitor_diagnostic_categories.default.metrics
     content {
       category = metric.value
+      enabled  = contains(local.parsed_diag.metric, metric.value)
 
       retention_policy {
         enabled = false
+        days    = 0
       }
     }
   }