Terraform fails on updating virtual_network_gateway public IP

[krukowskid]

Is there an existing issue for this?

• I have searched the existing issues

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave comments along the lines of "+1", "me too" or "any updates", they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment and review the contribution guide to help.

Terraform Version

1.9.3

AzureRM Provider Version

4.4.0

Affected Resource(s)/Data Source(s)

azurerm_virtual_network_gateway

Terraform Configuration Files

resource "azurerm_public_ip" "this" {
  for_each = toset([for x in range(1, var.public_ip.number + 1) : tostring(x)])

  name                = format("%s%s", data.azurecaf_name.public_ip.result, each.key)
  location            = var.location
  resource_group_name = var.resource_group_name
  tags                = var.tags
  sku                 = "Standard"
  allocation_method   = "Static"
  zones               = var.public_ip.zones
  lifecycle {
    create_before_destroy = true
  }
}

resource "azurerm_virtual_network_gateway" "this" {
  name                = data.azurecaf_name.virtual_network_gateway.result
  location            = var.location
  resource_group_name = var.resource_group_name
  tags                = var.tags

  type          = "Vpn"
  generation    = var.gateway_options.generation
  sku           = var.gateway_options.sku
  vpn_type      = var.gateway_options.routing_type
  active_active = var.gateway_options.active_active
  enable_bgp    = var.gateway_options.enable_bgp

  dynamic "ip_configuration" {
    for_each = toset([for x in range(1, var.public_ip.number + 1) : tostring(x)])

    content {
      name                 = azurerm_public_ip.this[ip_configuration.key].name
      public_ip_address_id = azurerm_public_ip.this[ip_configuration.key].id
      subnet_id            = var.network.create_subnet ? try(azurerm_subnet.this[0].id, null) : var.network.gateway_subnet_id
    }
  }

...
}

Debug Output/Panic Output

performing CreateOrUpdate: unexpected status 400 (400 Bad Request) with error: GatewayIpConfigurationCannotBeChangedOrOverwritten: Existing gateway IP configuraitons cannot be removed or overwrittenThe The gateway IP configuration /subscriptions/xxx/resourceGroups/yyy/providers/Microsoft.Network/virtualNetworkGateways/zzz/ipConfigurations/qqq cannot be added
│
│   with module.vpn.azurerm_virtual_network_gateway.this,
│   on .terraform\modules\vpn\main.tf line 35, in resource "azurerm_virtual_network_gateway" "this":
│   35: resource "azurerm_virtual_network_gateway" "this" {
│

Expected Behaviour

As far as I know, changing vgw public IP is impossible so terraform should delete and create resource when changing public IP resource.

Actual Behaviour

Terraform throws error that IP configuration cannot be changes when

 lifecycle {
   create_before_destroy = true
 }

or that cannot remove IP address if there is no create_before_destroy

Steps to Reproduce

No response

Important Factoids

No response

References

No response

[ziyeqf]

Hi @krukowskid , thanks for reporting.

I have submitted a PR(#27828) for it, once it merged & released it should be fixed, you can subscribe the PR to keep track.

For any further questions please leave comments.

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.