Creation of azurerm_subnet_network_security_group_association hangs forever

[ak58588]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform (and AzureRM Provider) Version

terraform version: 0.11.11
azurerm version: 1.34.0 (similar behaviour also in 1.31.0, 1.32.1, 1.33.1, 1.34.0)

Affected Resource(s)

• azurerm_subnet
• azurerm_subnet_network_security_group_association

Terraform Configuration Files

provider "azurerm" {
  subscription_id = "<azure_subscription_id>"
  client_id = "<azure_client_id>"
  client_secret = "<azure_client_secret>"
  tenant_id = "<azure_tenant_id>"
  version = "<= 1.34.1"
}

resource "azurerm_resource_group" "rgp" {
  name = "rgp"
  location = "westeurope"
  tags {
    Name = "rgp"
  }
}

resource "azurerm_virtual_network" "vnetKara" {
  name = "vnet-kara"
  address_space = ["192.168.1.0/24", "10.1.0.0/16", "192.168.0.0/24", "10.0.5.0/28"]
  location = "westeurope"
  resource_group_name = "${azurerm_resource_group.rgp.name}"
  tags {
    Name = "vnet-kara"
  }
}

resource "azurerm_network_security_group" "nsgBleki" {
  name = "nsgBleki"
  location = "westeurope"
  resource_group_name = "${azurerm_resource_group.rgp.name}"
  tags {
      Name = "nsgBleki"
  }
}

resource "azurerm_subnet" "subnetKotik0" {
  name = "subnet-kotik0"
  resource_group_name = "${azurerm_resource_group.rgp.name}"
  address_prefix = "10.1.0.0/16"
  virtual_network_name = "${azurerm_virtual_network.vnetKara.name}"
  service_endpoints = [ "Microsoft.Storage" ]
  network_security_group_id = "${azurerm_network_security_group.nsgBleki.id}"
}

resource "azurerm_subnet" "subnetKotik1" {
  name = "subnet-kotik1"
  resource_group_name = "${azurerm_resource_group.rgp.name}"
  address_prefix = "192.168.1.0/24"
  virtual_network_name = "${azurerm_virtual_network.vnetKara.name}"
  service_endpoints = [ "Microsoft.Storage" ]
  network_security_group_id = "${azurerm_network_security_group.nsgBleki.id}"
}

resource "azurerm_subnet" "subnetKotik2" {
  name = "subnet-kotik2"
  resource_group_name = "${azurerm_resource_group.rgp.name}"
  address_prefix = "192.168.0.0/24"
  virtual_network_name = "${azurerm_virtual_network.vnetKara.name}"
  service_endpoints = [ "Microsoft.Storage" ]
  network_security_group_id = "${azurerm_network_security_group.nsgBleki.id}"
}

resource "azurerm_subnet" "subnetKotik3" {
  name = "subnet-kotik3"
  resource_group_name = "${azurerm_resource_group.rgp.name}"
  address_prefix = "10.0.5.0/28"
  virtual_network_name = "${azurerm_virtual_network.vnetKara.name}"
  service_endpoints = [ "Microsoft.Storage" ]
  network_security_group_id = "${azurerm_network_security_group.nsgBleki.id}"
}


resource "azurerm_subnet_network_security_group_association" "refKotyiISabaki0" {
  subnet_id                 = "${azurerm_subnet.subnetKotik0.id}"
  network_security_group_id = "${azurerm_network_security_group.nsgBleki.id}"
}

resource "azurerm_subnet_network_security_group_association" "refKotyiISabaki1" {
  subnet_id                 = "${azurerm_subnet.subnetKotik1.id}"
  network_security_group_id = "${azurerm_network_security_group.nsgBleki.id}"
}

resource "azurerm_subnet_network_security_group_association" "refKotyiISabaki2" {
  subnet_id                 = "${azurerm_subnet.subnetKotik2.id}"
  network_security_group_id = "${azurerm_network_security_group.nsgBleki.id}"
}

resource "azurerm_subnet_network_security_group_association" "refKotyiISabaki3" {
  subnet_id                 = "${azurerm_subnet.subnetKotik3.id}"
  network_security_group_id = "${azurerm_network_security_group.nsgBleki.id}"
}

Debug Output

https://gist.github.com/ak58588/ea0578b21ce36395dd035ce6e36c2763

Expected Behavior

The starting point: we have N subnets, which have already been created before.
We want to attach the network security group to each of these N subnets.
In order to do this, we are creating N azurerm_subnet_network_security_group_associations AND adding the network_security_group_id as a property to each subnet.

We expect the subnets to be successfully modified and associations to be successfully created. As a result we expect the subnets to be successfully attached to the network security group.

Actual Behavior

Several subnets (1-2) are hanging in status "Still modifying..." forever as well as several associations which are hanging in status "Still creating..." forever.

I tested it with several setups ( 1 association for 1 subnet) :
1 subnet modification + 1 association creation - Success
2 subnets modification + 2 associations creation - Success
3 subnets modification + 3 associations creation - Unstable success: some runs are stuck, some runs are successful.
4 subnets modification + 4 associations creation - is stuck, as described.
10 subnets modification + 10 association creation - is stuck, as described.

Steps to Reproduce

1. Create minimum 4 subnets

resource "azurerm_subnet" "subnetKotik0" {
  name = "subnet-kotik0"
  resource_group_name = "${azurerm_resource_group.rgp.name}"
  address_prefix = "10.1.0.0/16"
  virtual_network_name = "${azurerm_virtual_network.vnetKara.name}"
  service_endpoints = [ "Microsoft.Storage" ]
  #network_security_group_id = "${azurerm_network_security_group.nsgBleki.id}"
}

resource "azurerm_subnet" "subnetKotik1" {
  name = "subnet-kotik1"
  resource_group_name = "${azurerm_resource_group.rgp.name}"
  address_prefix = "192.168.1.0/24"
  virtual_network_name = "${azurerm_virtual_network.vnetKara.name}"
  service_endpoints = [ "Microsoft.Storage" ]
  #network_security_group_id = "${azurerm_network_security_group.nsgBleki.id}"
}

resource "azurerm_subnet" "subnetKotik2" {
  name = "subnet-kotik2"
  resource_group_name = "${azurerm_resource_group.rgp.name}"
  address_prefix = "192.168.0.0/24"
  virtual_network_name = "${azurerm_virtual_network.vnetKara.name}"
  service_endpoints = [ "Microsoft.Storage" ]
  #network_security_group_id = "${azurerm_network_security_group.nsgBleki.id}"
}

resource "azurerm_subnet" "subnetKotik3" {
  name = "subnet-kotik3"
  resource_group_name = "${azurerm_resource_group.rgp.name}"
  address_prefix = "10.0.5.0/28"
  virtual_network_name = "${azurerm_virtual_network.vnetKara.name}"
  service_endpoints = [ "Microsoft.Storage" ]
  #network_security_group_id = "${azurerm_network_security_group.nsgBleki.id}"
}

2. terraform apply - this must run successfully
3. Add associations and network_security_group_id properties to each subnet:

resource "azurerm_subnet" "subnetKotik0" {
  name = "subnet-kotik0"
  resource_group_name = "${azurerm_resource_group.rgp.name}"
  address_prefix = "10.1.0.0/16"
  virtual_network_name = "${azurerm_virtual_network.vnetKara.name}"
  service_endpoints = [ "Microsoft.Storage" ]
  network_security_group_id = "${azurerm_network_security_group.nsgBleki.id}"
}

resource "azurerm_subnet" "subnetKotik1" {
  name = "subnet-kotik1"
  resource_group_name = "${azurerm_resource_group.rgp.name}"
  address_prefix = "192.168.1.0/24"
  virtual_network_name = "${azurerm_virtual_network.vnetKara.name}"
  service_endpoints = [ "Microsoft.Storage" ]
  network_security_group_id = "${azurerm_network_security_group.nsgBleki.id}"
}

resource "azurerm_subnet" "subnetKotik2" {
  name = "subnet-kotik2"
  resource_group_name = "${azurerm_resource_group.rgp.name}"
  address_prefix = "192.168.0.0/24"
  virtual_network_name = "${azurerm_virtual_network.vnetKara.name}"
  service_endpoints = [ "Microsoft.Storage" ]
  network_security_group_id = "${azurerm_network_security_group.nsgBleki.id}"
}

resource "azurerm_subnet" "subnetKotik3" {
  name = "subnet-kotik3"
  resource_group_name = "${azurerm_resource_group.rgp.name}"
  address_prefix = "10.0.5.0/28"
  virtual_network_name = "${azurerm_virtual_network.vnetKara.name}"
  service_endpoints = [ "Microsoft.Storage" ]
  network_security_group_id = "${azurerm_network_security_group.nsgBleki.id}"
}


resource "azurerm_subnet_network_security_group_association" "refKotyiISabaki0" {
  subnet_id                 = "${azurerm_subnet.subnetKotik0.id}"
  network_security_group_id = "${azurerm_network_security_group.nsgBleki.id}"
}

resource "azurerm_subnet_network_security_group_association" "refKotyiISabaki1" {
  subnet_id                 = "${azurerm_subnet.subnetKotik1.id}"
  network_security_group_id = "${azurerm_network_security_group.nsgBleki.id}"
}

resource "azurerm_subnet_network_security_group_association" "refKotyiISabaki2" {
  subnet_id                 = "${azurerm_subnet.subnetKotik2.id}"
  network_security_group_id = "${azurerm_network_security_group.nsgBleki.id}"
}

resource "azurerm_subnet_network_security_group_association" "refKotyiISabaki3" {
  subnet_id                 = "${azurerm_subnet.subnetKotik3.id}"
  network_security_group_id = "${azurerm_network_security_group.nsgBleki.id}"
}

4. terraform apply

Important Factoids

References

[tombuildsstuff]

hi @ak58588

Thanks for opening this issue :)

Taking a look through this appears to be a duplicate of #2489 - rather than having multiple issues open tracking the same thing I'm going to close this issue in favour of that one; would you mind subscribing to #2489 for updates?

Thanks!

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. If you feel I made an error 🤖 🙉 , please reach out to my human friends 👉 [email protected]. Thanks!