Terraform crash on misconfigured signalr service

[archerpmorgan]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform (and AzureRM Provider) Version

Terraform v0.13.5

• provider registry.terraform.io/hashicorp/azurerm v2.38.0
• provider registry.terraform.io/hashicorp/random v3.0.0

Affected Resource(s)

• azurerm_signalr_service

Terraform Configuration Files

resource "random_integer" "rand" {
  min = 1000
  max = 9999
}

resource "azurerm_resource_group" "rg" {
  name     = "${var.resource_prefix}-rg-${random_integer.rand.result}"
  location = "westus2"
}

## Key Vault

data "azurerm_client_config" "current" {}

resource "azurerm_key_vault" "key-vault" {
  name                = "${var.resource_prefix}-sqldb-${random_integer.rand.result}"
  location            = var.location
  resource_group_name = azurerm_resource_group.rg.name

  enabled_for_deployment          = true
  enabled_for_disk_encryption     = true
  enabled_for_template_deployment = true

  tenant_id = data.azurerm_client_config.current.tenant_id
  sku_name  = var.kv_sku

  network_acls {
    default_action = "Allow"
    bypass         = "AzureServices"
  }
}

resource "azurerm_key_vault_access_policy" "default_policy" {
  key_vault_id = azurerm_key_vault.key-vault.id
  tenant_id    = data.azurerm_client_config.current.tenant_id
  object_id    = data.azurerm_client_config.current.object_id

  lifecycle {
    create_before_destroy = true
  }

  key_permissions         = var.kv-key-permissions-full
  secret_permissions      = var.kv-secret-permissions-full
  certificate_permissions = var.kv-certificate-permissions-full
  storage_permissions     = var.kv-storage-permissions-full
}

# Functions App

resource "azurerm_storage_account" "sharedstorage" {
  name                     = "sharedstorage${random_integer.rand.result}"
  resource_group_name      = azurerm_resource_group.rg.name
  location                 = azurerm_resource_group.rg.location
  account_tier             = "Standard"
  account_replication_type = "LRS"
}


# SignalR Platform Service

resource "azurerm_signalr_service" "signalr" {
  name                = "${var.resource_prefix}-signalr-${random_integer.rand.result}"
  location            = azurerm_resource_group.rg.location
  resource_group_name = azurerm_resource_group.rg.name

  sku {
    name     = "Free_F1"
    capacity = 1
  }

  cors {
    allowed_origins = []
  }

  features {
    flag  = "ServiceMode"
    value = "Default"
  }
}

# Kubernetes

resource "azurerm_kubernetes_cluster" "kube" {
  name                = "${var.resource_prefix}-kube-${random_integer.rand.result}"
  location            = azurerm_resource_group.rg.location
  resource_group_name = azurerm_resource_group.rg.name
  dns_prefix          = "${var.resource_prefix}kube${random_integer.rand.result}"

  default_node_pool {
    name       = "default"
    node_count = 1
    vm_size    = "Standard_D2_v2"
  }

   identity {
    type = "SystemAssigned"
  }

  tags = {
    Environment = "dev"
  }
}

provider "azurerm" {
  version = "~>2.30"
  features{}
}

terraform {
  backend "azurerm" {
    resource_group_name  = "practiceOpenHackState"
    storage_account_name = "practicestate"
    container_name       = "tfstate"
    key                  = "dev.terraform.tfsate"
  }
}

Debug Output

debug log gist

Panic Output

crash log gist

Expected Behaviour

The above configuration has an issue. The cors block on the azurerm_signalr_service should not have no an allowed_origins list with zero args. It should either be a "*" indicating all urls, or a nonempty list of URLs. However, when an nonempty list is provided, there should be no crash.

Actual Behaviour

The cors block with an allowed_origins list with zero args created a crash and an rpc error with no indication of the location of the config error.

Steps to Reproduce

Creating the same service (azurerm_signalr_service) with:

  cors {
    allowed_origins = []
  }

[ghost]

This has been released in version 2.40.0 of the provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading. As an example:

provider "azurerm" {
    version = "~> 2.40.0"
}
# ... other configuration ...

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. If you feel I made an error 🤖 🙉 , please reach out to my human friends 👉 [email protected]. Thanks!