`azapi_update_resource` - ProviderError

[eberkut]

I have a terraform module which tags multiple resources at once passed as a list of resource ids. The main part of the code is:

locals {
  standard_tags = {
    "${var.tag_prefix}-deployedby"  = var.deployedby
  }

  # Static count-based keys for resource IDs
  resource_count = length(var.resource_ids)
  resource_keys  = toset([for i in range(local.resource_count) : tostring(i)])
}

# Merging Tags Logic
resource "azapi_update_resource" "merge_tags" {
  for_each = var.merge_tags ? { for idx in local.resource_keys : idx => var.resource_ids[idx] } : {}

  type      = "Microsoft.Resources/tags@2022-09-01"
  name      = "default"
  parent_id = each.value

  body = jsonencode({
    properties = {
      tags = local.standard_tags
    }
  })
}

This is inspired by https://github.com/Azure/terraform-provider-azapi/issues/365 and is in line with Microsoft documentation in https://learn.microsoft.com/en-us/azure/templates/microsoft.resources/tags?pivots=deployment-language-terraform.

It works flawlessly on all my resources except OpenAI were I'm getting a ProviderError during apply:

  # module.tagging.azapi_update_resource.merge_tags["4"] will be created
  + resource "azapi_update_resource" "merge_tags" {
      + body                    = jsonencode(
            {
              + properties = {
                  + tags = {
                      + ait-deployedby  = "Terraform"
                    }
                }
            }
        )
      + id                      = (known after apply)
      + ignore_casing           = false
      + ignore_missing_property = true
      + name                    = "default"
      + output                  = (known after apply)
      + parent_id               = "/subscriptions/REDACTED_SUBSCRIPTION_ID/resourceGroups/rg-experimentation-01/providers/Microsoft.CognitiveServices/accounts/myopenai-dev-01"
      + resource_id             = (known after apply)
      + type                    = "Microsoft.Resources/tags@2022-09-01"
    }


Plan: 1 to add, 0 to change, 0 to destroy.

─────────────────────────────────────────────────────────────────────────────

Saved the plan to: tfplan

To perform exactly these actions, run the following command to apply:
    terraform apply "tfplan"
Run if [ -n "" ]; then
🌋 Terraform apply 🌋
module.tagging.azapi_update_resource.merge_tags["4"]: Creating...
module.tagging.azapi_update_resource.merge_tags["4"]: Still creating... [10s elapsed]
module.tagging.azapi_update_resource.merge_tags["4"]: Still creating... [20s elapsed]
╷
│ Error: creating/updating "Resource: (ResourceId \"/subscriptions/REDACTED_SUBSCRIPTION_ID/resourceGroups/rg-experimentation-01/providers/Microsoft.CognitiveServices/accounts/myopenai-dev-01/providers/Microsoft.Resources/tags/default\" / Api Version \"2022-09-01\")": GET https://management.azure.com/subscriptions/REDACTED_SUBSCRIPTION_ID/tagsoperationresults
│ --------------------------------------------------------------------------------
│ RESPONSE 500: 500 Internal Server Error
│ ERROR CODE: ProviderError
│ --------------------------------------------------------------------------------
│ {
│   "error": {
│     "code": "ProviderError",
│     "message": "Resource provider 'Microsoft.CognitiveServices' did not respond with a valid resource definition when polling operation results for subscription 'REDACTED_SUBSCRIPTION_ID'."
│   }
│ }
│ --------------------------------------------------------------------------------
│ 
│ 
│   with module.tagging.azapi_update_resource.merge_tags["4"],
│   on .terraform/modules/tagging/modules/tagging/main.tf line 54, in resource "azapi_update_resource" "merge_tags":
│   54: resource "azapi_update_resource" "merge_tags" {
│ 
╵
Error: Process completed with exit code 1.

However, the tags are still properly applied. And if I try with az rest, there's no error so we can rule out an issue with Azure API itself.

az rest --method put \
  --uri "https://management.azure.com/subscriptions/REDACTED_SUBSCRIPTION_ID/resourceGroups/rg-experimentation-01/providers/Microsoft.CognitiveServices/accounts/myopenai-dev-01/providers/Microsoft.Resources/tags/default?api-version=2022-09-01" \
  --body '{
    "properties": {
      "tags": {
        "ait-deployedby": "azure-cli"
      }
    }
  }'

With TF_LOG set to DEBUG, this is apparently the request/response that fails:

2024-03-11T20:06:25.547+0100 [DEBUG] provider.terraform-provider-azapi_v1.12.1: Mar 11 20:06:25.547278 Retry: =====> Try=2: timestamp=2024-03-11T20:06:25.547+0100
2024-03-11T20:06:25.547+0100 [DEBUG] provider.terraform-provider-azapi_v1.12.1: Mar 11 20:06:25.547411 Request: ==> OUTGOING REQUEST (Try=1)
   GET https://management.azure.com/subscriptions/REDACTED_SUBSCRIPTION_ID/tagsoperationresults?%24ol=REDACTED&api-version=2022-09-01
   Authorization: REDACTED
   User-Agent: HashiCorp Terraform/1.5.7 (+https://www.terraform.io) Terraform Plugin SDK/2.8.0 terraform-provider-azapi/vv1.12.1 pid-222c6c49-1b0a-5959-a213-6608f9eb8820
   X-Ms-Correlation-Request-Id: 4101ff56-564e-db99-7799-12d64a06cbad
   Request contained no body: timestamp=2024-03-11T20:06:25.547+0100
2024-03-11T20:06:25.620+0100 [DEBUG] provider.terraform-provider-azapi_v1.12.1: Mar 11 20:06:25.620551 Response: ==> REQUEST/RESPONSE (Try=1/73.066047ms, OpTime=73.122744ms) -- RESPONSE RECEIVED
   GET https://management.azure.com/subscriptions/REDACTED_SUBSCRIPTION_ID/tagsoperationresults?%24ol=REDACTED&api-version=2022-09-01
   Authorization: REDACTED
   User-Agent: HashiCorp Terraform/1.5.7 (+https://www.terraform.io) Terraform Plugin SDK/2.8.0 terraform-provider-azapi/vv1.12.1 pid-222c6c49-1b0a-5959-a213-6608f9eb8820
   X-Ms-Correlation-Request-Id: 4101ff56-564e-db99-7799-12d64a06cbad
   --------------------------------------------------------------------------------
   RESPONSE Status: 500 Internal Server Error
   Cache-Control: no-cache
   Content-Length: 231
   Content-Type: application/json; charset=utf-8
   Date: Mon, 11 Mar 2024 19:06:25 GMT
   Expires: -1
   Pragma: no-cache
   Strict-Transport-Security: max-age=31536000; includeSubDomains
   X-Content-Type-Options: nosniff
   X-Ms-Correlation-Request-Id: 4101ff56-564e-db99-7799-12d64a06cbad
   X-Ms-Failure-Cause: gateway
   X-Ms-Ratelimit-Remaining-Subscription-Reads: 11980
   X-Ms-Request-Id: b326e3fe-be0c-4333-90cb-1ee50fcc36a9
   X-Ms-Routing-Request-Id: FRANCECENTRAL:20240311T190625Z:b326e3fe-be0c-4333-90cb-1ee50fcc36a9
   --------------------------------------------------------------------------------
{"error":{"code":"ProviderError","message":"Resource provider 'Microsoft.CognitiveServices' did not respond with a valid resource definition when polling operation results for subscription 'REDACTED_SUBSCRIPTION_ID'."}}
   --------------------------------------------------------------------------------

As can be seen in the logs, using Terraform 1.5.7 and terraform-provider-azapi 1.12.1.

[ms-henglu]

Hi @eberkut ,

Thank you for taking time to report this issue!

I believe this is an upstream-api issue, I've created an issue to track it: https://github.com/Azure/azure-rest-api-specs/issues/28209