azurerm_netapp_volume: Unable to update snapshot policy

[Lunik]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform (and AzureRM Provider) Version

Affected Resource(s)

• azurerm_netapp_volume

Terraform Configuration Files

resource "azurerm_netapp_snapshot_policy" "netapp" {
  for_each = var.snapshot_policies

  name = each.key

  account_name        = azurerm_netapp_account.netapp[each.value.account_name].name
  location            = azurerm_netapp_account.netapp[each.value.account_name].location
  resource_group_name = azurerm_netapp_account.netapp[each.value.account_name].resource_group_name

  enabled = true

...

}

resource "azurerm_netapp_volume" "netapp" {
  for_each = var.volumes

...

  data_protection_snapshot_policy {
    snapshot_policy_id = azurerm_netapp_snapshot_policy.netapp[each.value.snapshot_policy].id
  }
}

Debug Output

13:02:09  │ Error: creating Volume: (Name "volume-XXXX" / Capacity Pool Name "pool-XXXX" / Net App Account Name "account-XXXX" / Resource Group "rg-XXXX"): netapp.VolumesClient#CreateOrUpdate: Failure sending request: StatusCode=400 -- Original Error: Code="VolumeReadOnlyPropertyCanNotBeChanged" Message="The volume's snapshotId property is not allowed to be updated. Please check that snapshotId is not part of the update request or isn't being changed from the current value."
13:02:09  │ 
13:02:09  │   with module.azure-netapp.azurerm_netapp_volume.netapp["volume-XXXX"],
13:02:09  │   on modules/azure-netapp/azure_netapp_volume.tf line 2, in resource "azurerm_netapp_volume" "netapp":
13:02:09  │    2: resource "azurerm_netapp_volume" "netapp" {

Panic Output

Expected Behaviour

The volume snapshot policy should be updated

Actual Behaviour

The volume snapshot policy is not updated and Terraform throw an error

Steps to Reproduce

1. Create a volume
2. Apply a snapshot policy
3. Change to another policy
4. Apply the new snapshot policy

Important Factoids

References

#14230

[Lunik]

cc @paulomarquesc

[neil-yechenwei]

@Lunik , thanks for raising this issue. After tested, seems I cannot repro this issue with below tf config. The azurerm_netapp_volume.data_protection_snapshot_policy.snapshot_policy_id can be updated successfully from my side. Could you try below tf config to see if the issue still exists? Thanks.

Step1 to create one azurerm_netapp_snapshot_policy.test and apply it to azurerm_netapp_volume.test:

provider "azurerm" {
  features {}
}

resource "azurerm_resource_group" "test" {
  name     = "acctestRG-netapp-test01"
  location = "eastus"
}

resource "azurerm_virtual_network" "test" {
  name                = "acctest-VirtualNetwork-test01"
  location            = azurerm_resource_group.test.location
  resource_group_name = azurerm_resource_group.test.name
  address_space       = ["10.6.0.0/16"]
}

resource "azurerm_subnet" "test" {
  name                 = "acctest-Subnet-test01"
  resource_group_name  = azurerm_resource_group.test.name
  virtual_network_name = azurerm_virtual_network.test.name
  address_prefix       = "10.6.2.0/24"

  delegation {
    name = "testdelegation"

    service_delegation {
      name    = "Microsoft.Netapp/volumes"
      actions = ["Microsoft.Network/networkinterfaces/*", "Microsoft.Network/virtualNetworks/subnets/join/action"]
    }
  }
}

resource "azurerm_netapp_account" "test" {
  name                = "acctest-NetAppAccount-test01"
  location            = azurerm_resource_group.test.location
  resource_group_name = azurerm_resource_group.test.name
}

resource "azurerm_netapp_pool" "test" {
  name                = "acctest-NetAppPool-test01"
  location            = azurerm_resource_group.test.location
  resource_group_name = azurerm_resource_group.test.name
  account_name        = azurerm_netapp_account.test.name
  service_level       = "Standard"
  size_in_tb          = 4
}

resource "azurerm_netapp_snapshot_policy" "test" {
  name                = "acctest-NetAppSnapshotPolicy-test01"
  location            = azurerm_resource_group.test.location
  resource_group_name = azurerm_resource_group.test.name
  account_name        = azurerm_netapp_account.test.name
  enabled             = true

  monthly_schedule {
    snapshots_to_keep = 1
    days_of_month     = [15, 30]
    hour              = 23
    minute            = 30
  }
}

resource "azurerm_netapp_volume" "test" {
  name                = "acctest-NetAppVolume-WithSnapshotPolicy-test01"
  location            = azurerm_resource_group.test.location
  resource_group_name = azurerm_resource_group.test.name
  account_name        = azurerm_netapp_account.test.name
  pool_name           = azurerm_netapp_pool.test.name
  volume_path         = "my-unique-file-path-test01"
  service_level       = "Standard"
  subnet_id           = azurerm_subnet.test.id
  protocols           = ["NFSv3"]
  security_style      = "Unix"
  storage_quota_in_gb = 100

  data_protection_snapshot_policy {
    snapshot_policy_id = azurerm_netapp_snapshot_policy.test.id
  }
}

Step2 to create another new one azurerm_netapp_snapshot_policy.test2 and apply it to existing azurerm_netapp_volume.test:

provider "azurerm" {
  features {}
}

resource "azurerm_resource_group" "test" {
  name     = "acctestRG-netapp-test01"
  location = "eastus"
}

resource "azurerm_virtual_network" "test" {
  name                = "acctest-VirtualNetwork-test01"
  location            = azurerm_resource_group.test.location
  resource_group_name = azurerm_resource_group.test.name
  address_space       = ["10.6.0.0/16"]
}

resource "azurerm_subnet" "test" {
  name                 = "acctest-Subnet-test01"
  resource_group_name  = azurerm_resource_group.test.name
  virtual_network_name = azurerm_virtual_network.test.name
  address_prefix       = "10.6.2.0/24"

  delegation {
    name = "testdelegation"

    service_delegation {
      name    = "Microsoft.Netapp/volumes"
      actions = ["Microsoft.Network/networkinterfaces/*", "Microsoft.Network/virtualNetworks/subnets/join/action"]
    }
  }
}

resource "azurerm_netapp_account" "test" {
  name                = "acctest-NetAppAccount-test01"
  location            = azurerm_resource_group.test.location
  resource_group_name = azurerm_resource_group.test.name
}

resource "azurerm_netapp_pool" "test" {
  name                = "acctest-NetAppPool-test01"
  location            = azurerm_resource_group.test.location
  resource_group_name = azurerm_resource_group.test.name
  account_name        = azurerm_netapp_account.test.name
  service_level       = "Standard"
  size_in_tb          = 4
}

resource "azurerm_netapp_snapshot_policy" "test" {
  name                = "acctest-NetAppSnapshotPolicy-test01"
  location            = azurerm_resource_group.test.location
  resource_group_name = azurerm_resource_group.test.name
  account_name        = azurerm_netapp_account.test.name
  enabled             = true

  monthly_schedule {
    snapshots_to_keep = 1
    days_of_month     = [15, 30]
    hour              = 23
    minute            = 30
  }
}

resource "azurerm_netapp_snapshot_policy" "test2" {
  name                = "acctest-NetAppSnapshotPolicy2-test01"
  location            = azurerm_resource_group.test.location
  resource_group_name = azurerm_resource_group.test.name
  account_name        = azurerm_netapp_account.test.name
  enabled             = true

  monthly_schedule {
    snapshots_to_keep = 1
    days_of_month     = [15, 30]
    hour              = 23
    minute            = 30
  }
}

resource "azurerm_netapp_volume" "test" {
  name                = "acctest-NetAppVolume-WithSnapshotPolicy-test01"
  location            = azurerm_resource_group.test.location
  resource_group_name = azurerm_resource_group.test.name
  account_name        = azurerm_netapp_account.test.name
  pool_name           = azurerm_netapp_pool.test.name
  volume_path         = "my-unique-file-path-test01"
  service_level       = "Standard"
  subnet_id           = azurerm_subnet.test.id
  protocols           = ["NFSv3"]
  security_style      = "Unix"
  storage_quota_in_gb = 100

  data_protection_snapshot_policy {
    snapshot_policy_id = azurerm_netapp_snapshot_policy.test2.id
  }
}

[f35f0ef9d0e827dae86552d3899f78fc]

I am running into the same error, but don't even have a data_protection_snapshot_policy defined in my case. The only thing changing in my terraform plan are tags, yet I get the same error. So, I think the cause of the error could be the fact that you're making a change at all. I have not solved it for myself.

[neil-yechenwei]

@f35f0ef9d0e827dae86552d3899f78fc , thanks. I can repro it now. After checked, seems the root cause is service api doesn't identify what we set in previous run for the create_from_snapshot_resource_id property. So filed an issue on Azure/azure-rest-api-specs/issues/17834 for tracking.

[longkb]

I am running into the same error, but don't even have a data_protection_snapshot_policy defined in my case. The only thing changing in my terraform plan are tags, yet I get the same error. So, I think the cause of the error could be the fact that you're making a change at all. I have not solved it for myself.

I got the same error with @f35f0ef9d0e827dae86552d3899f78fc . The changed from terraform plan is only tags. Hope that this issues is fixed soon :)

[paulomarquesc]

I'm looking into this.

[paulomarquesc]

Issue identified and I'm working on the fixes.

What is happening here is that the ANF module is using CreateOrUpdate method from ANF Go SDK instead of using the individual methods (Create and Update), translating to PUT requests being sent to ARM instead of PATCH with the potential to overwrite properties not yet supported by ANF terraform module or edge cases like the one described here.

I'm testing a few scenarios including the one described in this thread and will be placing the PR with the fixes soon.

[paulomarquesc]

Placed the following PR that fixes this issue: #15491

[github-actions]

This functionality has been released in v2.97.0 of the Terraform Provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template. Thank you!

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.