azurerm_virtual_network_gateway does not allow multiple vpn_client_configuration blocks

[Ticallion22]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform (and AzureRM Provider) Version

Terraform v0.14.4
+ provider registry.terraform.io/hashicorp/azurerm v2.56.0

Affected Resource(s)

• azurerm_virtual_network_gateway

Terraform Configuration Files

locals {
  location = "westeurope"
}

resource "azurerm_resource_group" "example" {
  name = "example-rg"
  location = local.location
}

resource "azurerm_virtual_network" "example" {
  name = "example-vnet"
  resource_group_name = azurerm_resource_group.example.name
  location = local.location

  address_space = ["10.0.0.0/24"]
}

resource "azurerm_subnet" "example" {
  name = "example-snet"
  resource_group_name = azurerm_resource_group.example.name
  virtual_network_name = azurerm_virtual_network.example.name

  address_prefixes = ["10.0.0.0/24"]
}

resource "azurerm_public_ip" "example" {
  name = "example-pip"
  resource_group_name = azurerm_resource_group.example.name
  location = local.location

  allocation_method = "Dynamic"
  ip_version = "IPv4"
}

and

resource "azurerm_virtual_network_gateway" "example" {
  name = "example-vgw"
  resource_group_name = azurerm_resource_group.example.name
  location = local.location

  generation = "Generation2"
  sku = "VpnGw2"
  type = "Vpn"
  vpn_type = "RouteBased"

  ip_configuration {
    name = "example-vgw-ipconfig"
    public_ip_address_id = azurerm_public_ip.example.id
    subnet_id = azurerm_subnet.example.id
  }

  vpn_client_configuration {
    address_space = ["10.0.1.0/24"]
    vpn_client_protocols = ["OpenVPN"]

    aad_tenant = ""

    root_certificate {
      name = "P2SRootCert"
      public_cert_data = <certificate>
    }

  }
}

or (less preferable, as it would not reflect the configuration options in the Azure portal)

resource "azurerm_virtual_network_gateway" "example" {
  name = "example-vgw"
  resource_group_name = azurerm_resource_group.example.name
  location = local.location

  generation = "Generation2"
  sku = "VpnGw2"
  type = "Vpn"
  vpn_type = "RouteBased"

  ip_configuration {
    name = "example-vgw-ipconfig"
    public_ip_address_id = azurerm_public_ip.example.id
    subnet_id = azurerm_subnet.example.id
  }

  vpn_client_configuration {
    address_space = ["10.0.1.0/24"]
    vpn_client_protocols = ["OpenVPN"]

    root_certificate {
      name = "P2SRootCert"
      public_cert_data = ""
    }

  }

  vpn_client_configuration {
    address_space = ["10.0.1.0/24"]
    vpn_client_protocols = ["OpenVPN"]

    aad_tenant = ""

  }

  }
}

Expected Behaviour

Azure Virtual Network Gateway being created with two authentication types.

In the Azure Portal it is possible to select multiple authentication types for a Point-to-site configuration:

According to the Terraform documentation, there can be only one vpn_client_configuration block and within that block, aad_tenant and root_certificate are incompatible.

https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/virtual_network_gateway#vpn_client_configuration

Actual Behaviour

Error: "vpn_client_configuration.0.root_certificate": conflicts with vpn_client_configuration.0.aad_tenant

or

Error: vpn_client_configuration: attribute supports 1 item maximum, config has 2 declared

Steps to Reproduce

1. terraform plan

[egorchabala]

This Azure feature is GA now.

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.