We have some TF code which is not run very often which creates, among others, the following resources:
- azurerm_subnet_route_table_association
- azurerm_subnet_network_security_group_association
We’re trying to make changes to other resources in the same workspace state, but when we run a plan, it’s failing with this error:
Error: Failed to decode resource from state
│
│ Error decoding
│ "azurerm_subnet_network_security_group_association.nsg_assoc" from
│ previous state: unsupported attribute "update"
╵
Operation failed: failed running terraform plan (exit 1)
Similarly, when you try to examine the state for that resource:
% terraform state show "azurerm_subnet_network_security_group_association.nsg_assoc"
unsupported attribute "update"
# azurerm_subnet_network_security_group_association.nsg_assoc:
resource "azurerm_subnet_network_security_group_association" "nsg_assoc" {
And the same error is generated trying to show the state of the azurerm_subnet_route_table_association resource.
When I look in the state for that workspace in Terraform Cloud, I see that both have an attribute of “update” in the timeouts block. Looking at the provider documentation, neither of these resources have that attribute in the current version, but searching back through past versions, that attribute was there in v3.81.0 of the provider, and it appears it was removed starting with v3.82.0 for both resources.
Assuming this is what’s causing the error, I’m curious why newer versions of the provider don’t just remove that attribute when updating the resource. We’ve trying using “terraform state rm” to remove them from state (to be followed with a “terraform import” to reconstitute them), but the remove command fails with the same error.
Any suggestions on how to get around this?