azurerm_app_service forces new resource when tags{} is modified - breaks import use case

[TheLinuxNinja]

Terraform Version

Terraform v0.10.6
plugin: terraform-provider-azurerm_v0.2.1_x4

Affected Resource(s)

azurerm_app_service

Terraform Configuration Files

resource "azurerm_app_service" "test-web-app" {
  name                = "test-web-app-${random_id.test-name-nonce.b64_url}-${var.environment}-${var.region}"
  location            = "${var.region_description}"
  resource_group_name = "${azurerm_resource_group.test-rg.name}"
  app_service_plan_id = "${azurerm_app_service_plan.test-service-plan.id}"

  site_config {
    always_on                = true
    dotnet_framework_version = "v4.0"

    default_documents = [
      "Default.htm",
      "Default.html",
      "Default.asp",
      "index.htm",
      "index.html",
      "iisstart.htm",
      "default.aspx",
      "index.php",
      "hostingstart.html",
    ]
  }

  app_settings {
    WEBSITE_NODE_DEFAULT_VERSION = "x.x.x"
  }

  client_affinity_enabled = true
  enabled                 = true

  tags {
    environment = "${var.environment}"
    region      = "${var.region}"
  }
}

Debug Output

Gist unnecessary

terraform plan wants to destroy and recreate resource when modifying a tag.

Panic Output

n/a

Expected Behavior

terraform plan and terraform apply should modify the tag in-place.

Actual Behavior

terraform apply destroys the app service and re-creates it, which means the application is down until re-deployed.

Steps to Reproduce

create or import an app service including specifying 'tags'.
change/add/remove a tag
terraform plan or terraform apply

Important Factoids

None.

References

Documentation DOES show that changing the tag will force a new resource, however, there is no obvious reason to do this. Changing the tag in the portal and in the .tf file, then doing a terraform refresh will work, UNLESS you imported the resource after creating it through the UI. In that case, there is a hidden tag that you cannot modify except through the API, and even having a tags{} section will force a new resource. This makes importing an existing resource impossible without a workaround that is non-obvious (manual surgery on the tfstate file to add the hidden tag or removing the hidden tag from Azure by other methods). Since importing is most commonly used for resources created outside of Terraform, this use case makes the azurerm_app_service not behave as expected when tags{} are specified.

[dominik-lekse]

Unfortunately this is related to a bug in the Azure API which is not yet fixed (Azure/azure-rest-api-specs#1697). In this case, the API fails to update tags properly.

[tombuildsstuff]

Fixed via #1125 which will ship as part of v1.4.0 of the AzureRM Provider.

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. If you feel I made an error 🤖 🙉 , please reach out to my human friends 👉 hashibot-feedback@hashicorp.com. Thanks!