Import of azurerm_static_web_app_custom_domain forces repacement

[sharebear]

Is there an existing issue for this?

• I have searched the existing issues

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment and review the contribution guide to help.

Terraform Version

1.7.4

AzureRM Provider Version

3.95.0

Affected Resource(s)/Data Source(s)

azurerm_static_web_app_custom_domain

Terraform Configuration Files

resource "azurerm_static_web_app_custom_domain" "example" {
  static_web_app_id = azurerm_static_web_app.example.id
  domain_name       = "example.com"
  validation_type   = "dns-txt-token"
}

removed {
  from = azurerm_static_site_custom_domain.example
  lifecycle {
    destroy = false
  }
}

import {
  id = "/subscriptions/[redacted]/resourceGroups/prod-norwayeast-rg/providers/Microsoft.Web/staticSites/example/customDomains/example.com"
  to = azurerm_static_web_app_custom_domain.example
}

Debug Output/Panic Output

# azurerm_static_web_app_custom_domain.iac_customerfront_doc must be replaced
  # (imported from "/subscriptions/[redacted]/resourceGroups/prod-norwayeast-rg/providers/Microsoft.Web/staticSites/example/customDomains/example.com")
  # Warning: this will destroy the imported resource
-/+ resource "azurerm_static_web_app_custom_domain" "example" {
        domain_name       = "example.com"
      ~ id                = "/subscriptions/[redacted]/resourceGroups/prod-norwayeast-rg/providers/Microsoft.Web/staticSites/example/customDomains/example.com" -> (known after apply)
        static_web_app_id = "/subscriptions/[redacted]/resourceGroups/prod-norwayeast-rg/providers/Microsoft.Web/staticSites/example"
      + validation_token  = (sensitive value)
      + validation_type   = "dns-txt-token" # forces replacement
    }

Expected Behaviour

Resource should be imported without recreation

Actual Behaviour

Terraform plan reveals that terraform wants to recreate the custom domain (which will then change the token that needs to be present in DNS for validation).

Steps to Reproduce

1. Have an existing azurerm_static_site_custom_domain resource
2. Make code changes as above in order to resolve deprecation warning from latest provider version
3. terraform plan

Important Factoids

No response

References

Trying to resolve the deprecation warning triggered by the following PR #25117

[dcarvalh04]

Same issue here with 2 existing azurerm_static_site and azurerm_static_site_custom_domain

[xiaxyi]

Thanks @sharebear for raising this issue, let me try transferring the id from static site domain to static web app domain. Just one detail that I'd like to confirm with you is: despite of the id transferring itself, were you trying to link the custom domain to a new static web app?

How did you deal with the static site and the static web app?

[sharebear]

were you trying to link the custom domain to a new static web app?

No this is an existing static web app, that I migrated with the steps below.

How did you deal with the static site and the static web app?

Migrating the static site to static web app worked fine by just changing the resource type and adding a pair of removed + import blocks

removed {
  from = azurerm_static_site.example
  lifecycle {
    destroy = false
  }
}

import {
  id = "/subscriptions/[redacted]/resourceGroups/prod-norwayeast-rg/providers/Microsoft.Web/staticSites/example"
  to = azurerm_static_web_app.example
}

[xiaxyi]

Thanks for the update, let me try the import of the custom domain.

[tombuildsstuff]

@sharebear in this case the field validation_type isn't returned from the Azure API so it's only available during creation - as such when importing this resource you'd need to use ignore_changes on this field (since we can't pull it from the config, and it's not returned from the API, which is why it's showing as going from null -> a value here).

Would you be able to take a look and see if using ignore_changes works for you here?

[audunsolemdal]

I faced this issue last week and can confirm that ignoring validation_type works as a workaround.

removed {
  from = azurerm_static_site_custom_domain.domain

  lifecycle { destroy = false }
}

import {
  to = azurerm_static_web_app_custom_domain.domain
  id = "/subscriptions/....."
}

resource "azurerm_static_web_app_custom_domain" "domain" {
  static_web_app_id = "yyyyy"
  domain_name       = "xxxx"
  validation_type   = "cname-delegation"

  lifecycle {
    ignore_changes = [validation_type]
  }
}

[rcskosir]

Thank you for taking the time to raise this! I am going to close this with tombuildsstuff response as an answer. If you have future questions, I suggest using the Community Resources, such as the Azure Provider forum.

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.