# Recreate Azure resources without changing the code. Why?

**URL:** <https://discuss.hashicorp.com/t/recreate-azure-resources-without-changing-the-code-why/59444>\
**Category:** Azure\
**Tags:** azure\
**Created:** [October 24, 2023, 3:09pm UTC](https://discuss.hashicorp.com/t/recreate-azure-resources-without-changing-the-code-why/59444 "2023-10-24T15:09:07Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![gabor.varga](https://avatars.discourse-cdn.com/v4/letter/g/3e96dc/32.png) [@gabor.varga](https://discuss.hashicorp.com/u/gabor.varga)\
**Post date:** [October 24, 2023, 3:09pm UTC](https://discuss.hashicorp.com/t/recreate-azure-resources-without-changing-the-code-why/59444/1 "2023-10-24T15:09:07Z")

</div>

Hi,

Can someone please explain me the following behavior from terraform. Output of plan:

```auto
> -/+ resource "azurerm_firewall" "AZFW" {
> - dns_servers = [] -> null
> ~ firewall_policy_id = "/subscriptions/xxxxxxxx-e960-4d2a-878c-xxxxxxxxxxxx/resourceGroups/XXXX-Connectivity-WEU-NETWORK/providers/Microsoft.Network/firewallPolicies/afwp-afw-XXXX-Connectivity-WEU" -> (known after apply)
> ~ id = "/subscriptions/xxxxxxxx-e960-4d2a-878c-xxxxxxxxxxxx/resourceGroups/XXXX-Connectivity-WEU-NETWORK/providers/Microsoft.Network/azureFirewalls/afw-XXXX-Connectivity-WEU" -> (known after apply)
> ~ location = "westeurope" # forces replacement -> (known after apply) # forces replacement
> name = "afw-XXXX-Connectivity-WEU"
> - private_ip_ranges = [] -> null
> - tags = {} -> null
> ~ threat_intel_mode = "Alert" -> (known after apply)
> - zones = [] -> null
> # (3 unchanged attributes hidden)
> 
> ~ ip_configuration {
> name = "Private_IP_configuration"
> ~ private_ip_address = "10.130.238.68" -> (known after apply)
> # (2 unchanged attributes hidden)
> }
> }
> 
> # module.firewall-policy.data.azurerm_resource_group.rg will be read during apply
> # (depends on a resource or a module with changes pending)
> <= data "azurerm_resource_group" "rg" {
> + id = (known after apply)
> + location = (known after apply)
> + managed_by = (known after apply)
> + name = "XXXX-Connectivity-WEU-NETWORK"
> + tags = (known after apply)
> }
> 
> # module.firewall-policy.azurerm_firewall_policy.fwpolicy must be replaced
> -/+ resource "azurerm_firewall_policy" "fwpolicy" {
> ~ child_policies = [] -> (known after apply)
> ~ firewalls = [
> - "/subscriptions/xxxxxxxx-e960-4d2a-878c-xxxxxxxxxxxx/resourceGroups/XXXX-Connectivity-WEU-NETWORK/providers/Microsoft.Network/azureFirewalls/afw-XXXX-Connectivity-WEU",
> ] -> (known after apply)
> ~ id = "/subscriptions/xxxxxxxx-e960-4d2a-878c-xxxxxxxxxxxx/resourceGroups/XXXX-Connectivity-WEU-NETWORK/providers/Microsoft.Network/firewallPolicies/afwp-afw-XXXX-Connectivity-WEU" -> (known after apply)
> ~ location = "westeurope" # forces replacement -> (known after apply) # forces replacement
> name = "afwp-afw-XXXX-Connectivity-WEU"
> - private_ip_ranges = [] -> null
> ~ rule_collection_groups = [
> - "/subscriptions/xxxxxxxx-e960-4d2a-878c-xxxxxxxxxxxx/resourceGroups/XXXX-Connectivity-WEU-NETWORK/providers/Microsoft.Network/firewallPolicies/afwp-afw-XXXX-Connectivity-WEU/ruleCollectionGroups/XXXX-MGMT-AVD-FW-Rules",
> ] -> (known after apply)
> ~ sku = "Standard" -> (known after apply)
> - tags = {} -> null
> # (3 unchanged attributes hidden)
> 
> # (1 unchanged block hidden)
> }

```

For me it is really not understandable that nothing got changed to the related resources. But it wants to recreate the resources and changing the [] with null. After deployment it wants doing again.

If I add the [] into the code, then it is crying that it must have at least one value added into the brackets.

Anyone any idea?

Thanks!  
G

---

<div class="post-metadata">

**Author:** ![jbardin](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/jbardin/32/3325_2.png) [@jbardin](https://discuss.hashicorp.com/u/jbardin)\
**Post date:** [October 24, 2023, 3:39pm UTC](https://discuss.hashicorp.com/t/recreate-azure-resources-without-changing-the-code-why/59444/2 "2023-10-24T15:39:25Z")

</div>

Hi @gabor.varga,

The changes between `[]` to `null` are not relevant to the resource replacement, the reason for replacement will be marked with `# forces replacement` by the provider (it will help others read this to format the output as code to prevent markdown formatting).

So the problem here is the `location` attribute is not known during the plan, and the provider indicates that the resource needs to be replaced because the location may change. You need to determine why the `location` value is not known during plan, which I assume is related to `data.azurerm_resource_group.rg` being deferred to apply. Since that says it `"depends on a resource or a module with changes pending"`, it usually means you have an incorrect or unnecessary `depends_on` preventing the data source from being read during the plan.

---

<div class="post-metadata">

**Author:** ![gabor.varga](https://avatars.discourse-cdn.com/v4/letter/g/3e96dc/32.png) [@gabor.varga](https://discuss.hashicorp.com/u/gabor.varga)\
**Post date:** [October 24, 2023, 3:55pm UTC](https://discuss.hashicorp.com/t/recreate-azure-resources-without-changing-the-code-why/59444/3 "2023-10-24T15:55:13Z")

</div>

Thanks a lot!

Yes, because I used data, to retrieve the current resource group’s details (location), and it is a dynamic object for terraform therefore it did not know the location during the run.

Now I fixed, and it is fine.