azurerm_firewall disables Network.DNS.EnableProxy flag when it runs

[dragos-stan-absa]

Is there an existing issue for this?

• I have searched the existing issues

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform Version

1.3.8

AzureRM Provider Version

3.43.0

Affected Resource(s)/Data Source(s)

azurerm_firewall

Terraform Configuration Files

resource "azurerm_firewall" "my-azure-fw" {
  name                = "my-azure-fw"
  location            = "southafricanorth"
  resource_group_name = "my-azure-rgp"
  sku_name            = "AZFW_VNet"
  sku_tier            = "Standard"
  threat_intel_mode   = "Alert"
  private_ip_ranges   = ["IANAPrivateRanges"]

  ip_configuration {
    name                 = "azfipconfig"
    subnet_id            = azurerm_subnet.my-azure-fw-subnet["AzureFirewallSubnet"].id
    public_ip_address_id = azurerm_public_ip.my-azure-fw-public-ip.id
  }
}

Debug Output/Panic Output

There's no explicit error or output. Running this code against a resource that has the Network.DNS.EnableProxy flag set does not detect any changes in the config but unsets the flag because the backend Azure API call expects all parameters to be set otherwise the params which are not set are explicitly disabled.

Expected Behaviour

Another flag added to the firewall config which can set/unset that Network.DNS.EnableProxy flag

resource "azurerm_firewall" "my-azure-fw" {
  name                = "my-azure-fw"
  location            = "southafricanorth"
  resource_group_name = "my-azure-rgp"
  sku_name            = "AZFW_VNet"
  sku_tier            = "Standard"
  threat_intel_mode   = "Alert"
  private_ip_ranges   = ["IANAPrivateRanges"]

  network_dns_proxy_enable = true/false

  ip_configuration {
    name                 = "azfipconfig"
    subnet_id            = azurerm_subnet.my-azure-fw-subnet["AzureFirewallSubnet"].id
    public_ip_address_id = azurerm_public_ip.my-azure-fw-public-ip.id
  }
}

Actual Behaviour

When an Azure firewall (with DNS proxy enabled) is imported into the resource and the code is re-run, Terraform doesn't detect any changes but in the background it disables the Network.DNS.EnableProxy flag

Steps to Reproduce

No response

Important Factoids

No

References

azurerm_firewall: Enable DNS Proxy + Azure provided DNS · Issue #9184 · hashicorp/terraform-provider-azurerm · GitHub

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.