error when using both methods to associate a RT / NSG with a subnet

[Turil]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform (and AzureRM Provider) Version

Terraform v0.11.13
provider.azurerm v1.23.0

Affected Resource(s)

• azurerm_subnet

Terraform Configuration Files

resource "azurerm_subnet" "managed-sql" {
  name                 = "${local.name_prefix}mssql${local.name_postfix}"
  resource_group_name  = "${var.resource_group_name}"
  virtual_network_name = "${var.vnet_name}"
  address_prefix       = "${cidrsubnet(local.private_address_spaces[1], 3, 1)}"
  network_security_group_id = "${azurerm_network_security_group.managed-sql-nsg.id}"
  route_table_id            = "${azurerm_route_table.managed-sql-rt.id}"
}

resource "azurerm_route_table" "managed-sql-rt" {
  name                          = "${azurerm_subnet.managed-sql.name}-rt"
  resource_group_name           = "${var.resource_group_name}"
  location                      = "${var.region}"
  disable_bgp_route_propagation = false

  route {
    name           = "prepare-default"
    address_prefix = "0.0.0.0/0"
    next_hop_type  = "Internet"
  }
}

resource "azurerm_network_security_group" "managed-sql-nsg" {
  location            = "${var.region}"
  name                = "${azurerm_subnet.managed-sql.name}-nsg"
  resource_group_name = "${var.resource_group_name}"

  security_rule {
    name                       = "AllowManagementInBound"
    access                     = "Allow"
    direction                  = "Inbound"
    priority                   = 100
    protocol                   = "TCP"
    source_port_range          = "*"
    source_address_prefix      = "*"
    destination_address_prefix = "*"
    destination_port_ranges    = [9000, 9003, 1438, 1440, 1452]
  }

  security_rule {
    name                       = "AllowMISubnetInBound"
    description                = "Allow inbound inter-node traffic"
    access                     = "Allow"
    direction                  = "Inbound"
    priority                   = 110
    protocol                   = "*"
    source_port_range          = "*"
    source_address_prefix      = "${azurerm_subnet.managed-sql.address_prefix}"
    destination_address_prefix = "*"
    destination_port_range     = "*"
  }

  security_rule {
    name                       = "AllowHealthProbeInBound"
    description                = "Allow inbound health probe"
    access                     = "Allow"
    direction                  = "Inbound"
    priority                   = 120
    protocol                   = "*"
    source_port_range          = "*"
    source_address_prefix      = "AzureLoadBalancer"
    destination_address_prefix = "*"
    destination_port_range     = "*"
  }

  security_rule {
    name                       = "management-out"
    access                     = "Allow"
    direction                  = "Outbound"
    priority                   = 100
    protocol                   = "TCP"
    source_port_range          = "*"
    source_address_prefix      = "*"
    destination_address_prefix = "*"
    destination_port_ranges    = [80, 443, 12000]
  }

  security_rule {
    name                       = "AllowMISubnetOutBound"
    access                     = "Allow"
    direction                  = "Outbound"
    priority                   = 110
    protocol                   = "*"
    source_port_range          = "*"
    source_address_prefix      = "*"
    destination_address_prefix = "${azurerm_subnet.managed-sql.address_prefix}"
    destination_port_range     = "*"
  }
}

resource "azurerm_subnet_route_table_association" "managed-sql-rt-assoc" {
  subnet_id      = "${azurerm_subnet.managed-sql.id}"
  route_table_id = "${azurerm_route_table.managed-sql-rt.id}"
}

resource "azurerm_subnet_network_security_group_association" "managed-sql-sg-assoc" {
  subnet_id                 = "${azurerm_subnet.managed-sql.id}"
  network_security_group_id = "${azurerm_network_security_group.managed-sql-nsg.id}"
}

Expected Behavior

As recommended in issue #3077 I am using both the old and new way to associate a NSG and RT to the subnet, but this returns an error on terraform plan / apply.

Actual Behavior

terraform plan returns error

Error: Error asking for user input: 1 error(s) occurred:

* Cycle: azurerm_route_table.managed-sql-rt, azurerm_subnet.managed-sql, azurerm_network_security_group.managed-sql-nsg

Steps to Reproduce

1. terraform plan

Important Factoids

References

• azurerm_subnet : nsg and rt associations destroyed on reapply #3077

[ghost]

This has been released in version 2.0.0 of the provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading. As an example:

provider "azurerm" {
    version = "~> 2.0.0"
}
# ... other configuration ...

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. If you feel I made an error 🤖 🙉 , please reach out to my human friends 👉 [email protected]. Thanks!