Azure NSG in-line dynamic security rule block show inconsistent output

Terraform Providers Azure
1

Hello,

Here is my code, each time after apply i still see 1 to change message with -/+ sign even the change is already applied.

resource “azurerm_network_security_group” “nsgs_poc” {

for_each = var.nsgs != “” ? var.nsgs : {}

provider = azurerm.spoke

name = each.key

location = “eastus2”

resource_group_name = “XXXX”

dynamic “security_rule” {

for_each                   = toset (each.value.security_rule)

content {

  name                       = security_rule.value.name

  priority                   = security_rule.value.priority

  direction                  = security_rule.value.direction

  access                     = security_rule.value.access

  protocol                   = security_rule.value.protocol

  source_port_range          = security_rule.value.source_port_range

  source_port_ranges         = security_rule.value.source_port_ranges

  destination_port_range     = security_rule.value.destination_port_range

  destination_port_ranges    = security_rule.value.destination_port_ranges

  source_address_prefix      = security_rule.value.source_address_prefix

  source_address_prefixes    = security_rule.value.source_address_prefixes

  destination_address_prefix = security_rule.value.destination_address_prefix

  destination_address_prefixes = security_rule.value.destination_address_prefixes

  description                = security_rule.value.description

}

}

tags = var.tags

}

terraform plan output

azurerm_network_security_group.nsgs_poc[“nsg-app”] will be updated in-place

~ resource “azurerm_network_security_group” “nsgs_poc” {
id = “/subscriptions/XXXX/resourceGroups/XXX/providers/Microsoft.Network/networkSecurityGroups/nsg-app”
location = “eastus2”
name = “nsg-app”
resource_group_name = “XXX”
~ security_rule = [
- {
- access = “Deny”
- description = “standard rule”
- destination_address_prefix = “"
- destination_address_prefixes = []
- destination_application_security_group_ids = []
- destination_port_range = "”
- destination_port_ranges =
- direction = “Inbound”
- name = “bloc-traffic”
- priority = 2501
- protocol = “"
- source_address_prefix = "”
- source_address_prefixes =
- source_application_security_group_ids =
- source_port_range = “"
- source_port_ranges = []
},
- {
- access = “Deny”
- description = “standard rule”
- destination_address_prefix = “Internet”
- destination_address_prefixes = []
- destination_application_security_group_ids = []
- destination_port_range = "”
- destination_port_ranges =
- direction = “Outbound”
- name = “block-internet”
- priority = 2500
- protocol = “"
- source_address_prefix = "”
- source_address_prefixes =
- source_application_security_group_ids =
- source_port_range = “"
- source_port_ranges = []
},
+ {
+ access = “deny”
+ description = “standard rule”
+ destination_address_prefix = "”
+ destination_address_prefixes =
+ destination_application_security_group_ids =
+ destination_port_range = “"
+ destination_port_ranges = []
+ direction = “inbound”
+ name = “block-traffic”
+ priority = 2501
+ protocol = "”
+ source_address_prefix = “"
+ source_address_prefixes = []
+ source_application_security_group_ids = []
+ source_port_range = "”
+ source_port_ranges =
},
+ {
+ access = “deny”
+ description = “standard rule”
+ destination_address_prefix = “Internet”
+ destination_address_prefixes =
+ destination_application_security_group_ids =
+ destination_port_range = “"
+ destination_port_ranges = []
+ direction = “outbound”
+ name = “block-internet”
+ priority = 2500
+ protocol = "”
+ source_address_prefix = “"
+ source_address_prefixes = []
+ source_application_security_group_ids = []
+ source_port_range = "”
+ source_port_ranges =
},
]
tags = {}
}
}

Plan: 0 to add, 1 to change, 0 to destroy.

2

I’m am also having this issue.

I have an “azurerm_network_security_group” resource using a “for_each”.

Inside the resource is a Dynamic “security_rule” block.

Each time I do a plan it wants to remove all inline blocks for “security_rule” and replace them with the same exact values. The values being passed to the dynamic block for_each statement does NOT change between plans.

Why would it be doing that?