azurerm_cosmosdb_account with zone_redundant = true errors on minor updates (e.g. change tags)

[mnjhey]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform (and AzureRM Provider) Version

Terraform v0.13.5

• provider registry.terraform.io/hashicorp/azurerm v2.37.0

Affected Resource(s)

• "azurerm_cosmosdb_account"

Terraform Configuration Files

resource "azurerm_resource_group" "debug_resource_group" {
  name     = "rg-debug"
  location = var.location
}

resource "azurerm_cosmosdb_account" "debug" {
  name                = "mn-cosmos-debug"
  location            = azurerm_resource_group.debug_resource_group.location
  resource_group_name = azurerm_resource_group.debug_resource_group.name
  offer_type          = "Standard"
  kind                = "MongoDB"

  enable_automatic_failover = false

  capabilities {
    name = "EnableMongo"
  }

  consistency_policy {
    consistency_level       = "BoundedStaleness"
    max_interval_in_seconds = 300
    max_staleness_prefix    = 100000
  }

  geo_location {
    location          = azurerm_resource_group.debug_resource_group.location
    zone_redundant = true  
    failover_priority = 0
  }

  tags = {
      Role      = "ChangedToNewValue"
  }

}

Debug Output

https://gist.github.com/mnjhey/01ac1b8b629cd26f0bd6280ae634265e

Panic Output

Expected Behaviour

The value of the "Role" tag should have been changed to "ChangedToNewValue". This does not error if you update the tag value through the console.

Actual Behaviour

Looking at the debug log, Terraform is calling a PUT against /subscriptions/cc40dd1c-a034-4332-b88b-40d9131cb5db/resourceGroups/rg-debug/providers/Microsoft.DocumentDB/databaseAccounts/mn-cosmos-debug?api-version=2020-04-01 with {"kind":"MongoDB","location":"westeurope","properties":{"consistencyPolicy":{"defaultConsistencyLevel":"BoundedStaleness","maxStalenessPrefix":100000,"maxIntervalInSeconds":300},"locations":[{"failoverPriority":0,"locationName":"West Europe"}],"databaseAccountOfferType":"Standard","ipRules":[],"isVirtualNetworkFilterEnabled":false,"enableAutomaticFailover":false,"capabilities":[{"name":"EnableMongo"}],"virtualNetworkRules":[],"enableMultipleWriteLocations":false,"publicNetworkAccess":"Enabled","enableFreeTier":false},"tags":{"Project":"DebugProject","Role":"ChangedToNewValue1"}}

This returns a 400 error with {"code":"BadRequest","message":"Zone redundancy cannot be changed for existing region West Europe. Please remove and re add the region, to change Zone redundancy on the region.\r\nActivityId: a1fd9772-1c32-40a4-b972-4923a234a4aa, Microsoft.Azure.Documents.Common/2.11.0"}

The non-debug Terraform error is.

Error: Error updating CosmosDB Account "mn-cosmos-debug" properties (Resource Group "rg-debug"): Error creating/updating CosmosDB Account "mn-cosmos-debug" (Resource Group "rg-debug"): documentdb.DatabaseAccountsClient#CreateOrUpdate: Failure sending request: StatusCode=400 -- Original Error: Code="BadRequest" Message="Zone redundancy cannot be changed for existing region West Europe. Please remove and re add the region, to change Zone redundancy on the region.\r\nActivityId: a1fd9772-1c32-40a4-b972-4923a234a4aa, Microsoft.Azure.Documents.Common/2.11.0"

Steps to Reproduce

1. terraform apply
2. Change the value of the tag
3. terraform apply

Important Factoids

References

• https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/cosmosdb_account

[mnjhey]

Attempting to debug this further, I wonder if the issue is that "PUT" request contains
"locations":[{"failoverPriority":0,"locationName":"West Europe"}]
ie. it's missing the "isZoneRedundant": "boolean" so, assuming the default is false, Azure thinks TF is asking to turn off zone redundancy
https://docs.microsoft.com/en-us/azure/templates/microsoft.documentdb/2020-04-01/databaseaccounts

[mnjhey]

I've not done any Go development but I wonder if it might be that oldLocations doesn't seem to read the Zone Redundancy setting https://github.com/terraform-providers/terraform-provider-azurerm/blob/master/azurerm/internal/services/cosmos/cosmosdb_account_resource.go#L499-L502 which is then passed in at L526 ?

[kvendingoldo]

I'm trying to fix it in my fork, but it's difficult to test :(
kvendingoldo@365274a

[kvendingoldo]

MR is here #9485

[mnjhey]

Thanks kvendingoldo. That's quick work!

[ghost]

This has been released in version 2.38.0 of the provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading. As an example:

provider "azurerm" {
    version = "~> 2.38.0"
}
# ... other configuration ...

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. If you feel I made an error 🤖 🙉 , please reach out to my human friends 👉 [email protected]. Thanks!