azurerm_static_web_app - Remove the default value of public_network_access_enabled (true) to honor null (the behavior before introducing this attribute)

[magodo]

Community Note

• Please vote on this PR by adding a 👍 reaction to the original PR to help the community and maintainers prioritize for review
• Please do not leave comments along the lines of "+1", "me too" or "any updates", they generate extra noise for PR followers and do not help prioritize for review

Description

This PR removes the default value of public_network_access_enabled (true) to honor null, which is the behavior before introducing this attribute.

From the API description for this property, it says:

State indicating whether public traffic are allowed or not for a static web app. Allowed Values: 'Enabled', 'Disabled' or an empty string.

From the report in #28226, the user explicitly mentioned the behavior when this property is left null:

The expected behavior, and the behavior that I believe the null value achieves, is that public network access is allowed in the absence of a private endpoint, and it is blocked when a private endpoint is configured. This lines up with the azure documentation about securing a static web app on a private subnet.

Among the provider, there are also resources have similar special handling for the similar attribute:

• azurerm_bot_channels_registration
• azurerm_app_configuration

But since this resource is based on the typed SDK, things become slightly different comparing to those based on native SDK.

There are two issues for this implementation though:

• Once the value is set from null to non-null, it can't be revert to null. See the limitation of the SDKv2 here: Diffs: going from zero value to nil terraform-plugin-sdk#102

• If the current value is null, the TF (v1.11.0) can't detect diff by setting it to false:

  2024-12-10T18:33:35.872+1100 [WARN]  Provider "registry.terraform.io/hashicorp/azurerm" produced an invalid plan for azurerm_static_web_app.test, but we are tolerating it because it is using the legacy plugin SDK.
    The following problems may be the cause of any confusing errors from downstream operations:                                                                                                                     
      - .public_network_access_enabled: planned value cty.NullVal(cty.Bool) does not match config value cty.False
  

  Therefore the test case order is designed.

PR Checklist

• I have followed the guidelines in our Contributing Documentation.
• I have checked to ensure there aren't other open Pull Requests for the same update/change.
• I have checked if my changes close any open issues. If so please include appropriate closing keywords below.
• I have updated/added Documentation as required written in a helpful and kind way to assist users that may be unfamiliar with the resource / data source.
• I have used a meaningful PR title to help maintainers and other users understand this change and help prevent duplicate work.
  For example: “resource_name_here - description of change e.g. adding property new_property_name_here”

Changes to existing Resource / Data Source

• I have added an explanation of what my changes do and why I'd like you to include them (This may be covered by linking to an issue above, but may benefit from additional explanation).
• I have written new tests for my resource or datasource changes & updated any relevent documentation.
• I have successfully run tests with my changes locally. If not, please provide details on testing challenges that prevented you running the tests.
• (For changes that include a state migration only). I have manually tested the migration path between relevant versions of the provider.

Testing

• My submission includes Test coverage as described in the Contribution Guide and the tests pass. (if this is not possible for any reason, please include details of why you did or could not add test coverage)

$ TF_ACC=1 go test -v -timeout=20h -run='TestAccAzureStaticWebApp_publicNetworkAccessUpdate' ./internal/services/appservice
=== RUN   TestAccAzureStaticWebApp_publicNetworkAccessUpdate
=== PAUSE TestAccAzureStaticWebApp_publicNetworkAccessUpdate
=== CONT  TestAccAzureStaticWebApp_publicNetworkAccessUpdate
--- PASS: TestAccAzureStaticWebApp_publicNetworkAccessUpdate (303.53s)
PASS
ok      github.com/hashicorp/terraform-provider-azurerm/internal/services/appservice    303.559s

Change Log

Below please provide what should go into the changelog (if anything) conforming to the Changelog Format documented here.

• azurerm_static_web_app - Remove the default value of public_network_access_enabled (true) to honor null (the behavior before introducing this attribute) [GH-00000]

This is a (please select all that apply):

• Bug Fix
• New Feature (ie adding a service, resource, or data source)
• Enhancement
• Breaking Change

Related Issue(s)

Fixes #28226

Note

If this PR changes meaningfully during the course of review please update the title and description as required.