azurerm_linux_function_app_{,slot}: setting only site_config.cors.allowed_origins wants to add support_credentials = false

[johanngyger]

Is there an existing issue for this?

• I have searched the existing issues

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform Version

1.3.7

AzureRM Provider Version

3.40.0

Affected Resource(s)/Data Source(s)

azurerm_linux_function_app, azurerm_linux_function_app_slot

Terraform Configuration Files

resource "azurerm_linux_function_app" "main" {
  (...)
  site_config {
    (...)
    cors {
      allowed_origins = var.cors_allowed_origins
    }
  }
}

Debug Output/Panic Output

~ resource "azurerm_linux_function_app" "main" {
    ~ app_settings                       = (sensitive value)
      # (26 unchanged attributes hidden)
    ~ site_config {
          # (25 unchanged attributes hidden)
        + cors {
            + support_credentials = false
          }
          # (1 unchanged block hidden)
      }
      # (3 unchanged blocks hidden)
  }

Expected Behaviour

No changes

Actual Behaviour

No response

Steps to Reproduce

No response

Important Factoids

No response

References

#20148

[xiaxyi]

Thanks for raising this issue @johanngyger .

Can you help me to clarify about your TF config? Are you setting cors as below?

 "cors": {
            "allowedOrigins": [],
            "supportCredentials": false
        },

[johanngyger]

Correct, @xiaxyi: it only happens with allowedOrigins being an empty set

[xiaxyi]

Yes, this is the default setting which equals to null value. We won't set the default setting in state so you are seeing diff here... I need to check whether to conditionally set the default value.

Is the diff bringing you any trouble?

[johanngyger]

No trouble, the diff just keeps showing up. We have a workaround.

[xiaxyi]

I see. Are you choosing the ignore_change option to avoid the cors diff?

[johanngyger]

Yes, but I just realized I could use a dynamic block because we're using it in a module.

[SietseT]

This is also a problem with the azurerm_windows_function_app resource. Using ignore_changes doesn't work -- Terraform keeps seeing it as a change.

[matt-byrne]

Also seeing this issue. Even when I ignore site_config[0].cors[0].support_credentials, the change is re-planned every time.

[xiaxyi]

@matt-byrne ,Thanks for adding feedbacks, you can track the fix via #20251

[SietseT]

Can someone be assigned to that PR? It's been open for a month now, and this issue can be confusing when reviewing plans.

[desolat]

Also with the supposed fix in azurerm 3.49.0 we are still seeing support_credentials showing up in the plan output continuously when site_config.cors is configured like this:

"cors": {
  "allowedOrigins": [],
  "supportCredentials": false
},

It's not showing up when the cors block is not configured at all.

Is that the desired state?

[matt-byrne]

Confirming I'm still seeing this issue in 3.49.0 also.

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.