azurerm_subnet delegation is to include "Microsoft.Network/virtualNetworks/subnets/prepareNetworkPolicies/action" but never gets maintained in state

[doug-netapp]

Is there an existing issue for this?

• [X] I have searched the existing issues

Community Note

• Please vote on this issue by adding a :thumbsup: reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform Version

1.3.0

AzureRM Provider Version

3.18.0

Affected Resource(s)/Data Source(s)

azurerm_subnet

Terraform Configuration Files

resource "azurerm_subnet" "default" {
  name                 = "${var.project}-${var.user}-anf-subnet-${local.vnet_number}"
  address_prefixes     = ["10.100.0.0/24"]
  resource_group_name  = var.primary_rg_name
  virtual_network_name = azurerm_virtual_network.network.name

  delegation {
    name = "delegation"

    service_delegation {
      name = "Microsoft.Netapp/volumes"
      actions = [
        "Microsoft.Network/networkinterfaces/*",
        "Microsoft.Network/virtualNetworks/subnets/join/action",
        "Microsoft.Network/virtualNetworks/subnets/prepareNetworkPolicies/action"
      ]
    }
  }
}

Debug Output/Panic Output

# module.cluster_networks["REDACTED"].azurerm_subnet.anf will be updated in-place
  ~ resource "azurerm_subnet" "default" {
        id                                             = "/subscriptions/REDACTED/resourceGroups/rg_astra-pipeline/providers/Microsoft.Network/virtualNetworks/REDACTED/subnets/REDACTED"
        name                                           = "REDACTED"
        # (9 unchanged attributes hidden)

      ~ delegation {
            name = "delegation"

          ~ service_delegation {
              ~ actions = [
                    # (1 unchanged element hidden)
                    "Microsoft.Network/virtualNetworks/subnets/join/action",
                  + "Microsoft.Network/virtualNetworks/subnets/prepareNetworkPolicies/action",
                ]
                name    = "Microsoft.Netapp/volumes"
            }
        }
    }

Plan: 0 to add, 6 to change, 0 to destroy.

Expected Behaviour

This change has been applied dozens of times on all of the AKS ANF subnets, yet every terraform run this change request continues to show up.

Actual Behaviour

No response

Steps to Reproduce

terraform apply

Important Factoids

No response

References

Possible regression? https://github.com/hashicorp/terraform-provider-azurerm/issues/4599