[RecoveryServiceBackup] ProtectedItemResource/AzureIaaSComputeVMProtectedItem sometimes returns the `SourceResourceID` with the resource group name in UPPER CASE

[ArcturusZhang]

Original reported: https://github.com/terraform-providers/terraform-provider-azurerm/issues/8009

The SourceResourceID was assigned to /subscriptions/xxxxxxxxx-xxxx-xxxxxxx-xxxxxxxx/resourceGroups/abc123-rg/providers/Microsoft.Compute/virtualMachines/abc123-vm0f11 but returned with the value of /subscriptions/xxxxxxxxx-xxxx-xxxxxxx-xxxxxxxx/resourceGroups/ABC123-RG/providers/Microsoft.Compute/virtualMachines/abc123-vm0f11

 # module.core.module.server1.azurerm_backup_protected_vm.main[0] must be replaced
-/+ resource "azurerm_backup_protected_vm" "main" {
        backup_policy_id    = "/subscriptions/xxxxxxxxx-xxxx-xxxxxxx-xxxxxxxx/resourceGroups/abc123-rg/providers/Microsoft.RecoveryServices/vaults/abc123rv/backupPolicies/abc123-rp"
      ~ id                  = "/subscriptions/xxxxxxxxx-xxxx-xxxxxxx-xxxxxxxx/resourceGroups/abc123-rg/providers/Microsoft.RecoveryServices/vaults/abc123rv/backupFabrics/Azure/protectionContainers/IaasVMContainer;iaasvmcontainerv2;abc123-rg;abc123-vm0f11/protectedItems/VM;iaasvmcontainerv2;abc123-rg;abc123-vm0f11" -> (known after apply)
        recovery_vault_name = "abc123rv"
        resource_group_name = "abc123-rg"
      ~ source_vm_id        = "/subscriptions/xxxxxxxxx-xxxx-xxxxxxx-xxxxxxxx/resourceGroups/ABC123-RG/providers/Microsoft.Compute/virtualMachines/abc123-vm0f11" -> "/subscriptions/xxxxxxxxx-xxxx-xxxxxxx-xxxxxxxx/resourceGroups/abc123-rg/providers/Microsoft.Compute/virtualMachines/abc123-vm0f11" # forces replacement
      - tags                = {} -> null
    }

[yungezz]

hi @ArcturusZhang do you mean the case of resource group name changed? From what I know it's a known issue since resource group name isn't case sensitive, https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/resource-name-rules. while add 'service attention' label for service awareness.

[ghost]

Thanks for the feedback! We are routing this to the appropriate team for follow-up. cc @armleads-azure.

[tombuildsstuff]

@yungezz the ARM Specification states that these should be treated as Case Sensitive in responses (insofar as they should match user input) - so whilst the API can opt to be case-insensitive during a Request, URI's in the Response must always be case-sensitive.

Is there a timeline for fixing this API bug?

[myc2h6o]

I'd like to share my test result with the REST API.

Test detail:

Preparation (Created on Portal):
Resource Group: yicma-TEST-RG
Virtual Machine: yicma-TEST-VM
Recovery Services Vault: yicma-test-vault

PUT https://management.azure.com/subscriptions/85b3dbca-5974-4067-9669-67a141095a76/resourceGroups/YICMA-TEST-RG/providers/Microsoft.RecoveryServices/vaults/yicma-test-vault/backupFabrics/Azure/protectionContainers/IaasVMContainer;iaasvmcontainerv2;yicma-test-RG;yicma-test-VM/protectedItems/vm;iaasvmcontainerv2;yicma-test-RG;yicma-test-VM?api-version=2021-07-01
{
  "properties": {
    "protectedItemType": "Microsoft.Compute/virtualMachines",
    "sourceResourceId": "/subscriptions/85b3dbca-5974-4067-9669-67a141095a76/resourceGroups/yicma-test-rg/providers/Microsoft.Compute/virtualMachines/yicma-test-vm",
    "policyId": "/subscriptions/85b3dbca-5974-4067-9669-67a141095a76/resourceGroups/yicma-test-rg/providers/microsoft.recoveryservices/vaults/testVault/backupPolicies/DefaultPolicy"
  }
}

Service returns "202 Accepted" with empty response body

GET with same URI

Response body:
{
    "id": "/subscriptions/85b3dbca-5974-4067-9669-67a141095a76/resourceGroups/YICMA-TEST-RG/providers/Microsoft.RecoveryServices/vaults/yicma-test-vault/backupFabrics/Azure/protectionContainers/IaasVMContainer;iaasvmcontainerv2;yicma-test-RG;yicma-test-VM/protectedItems/VM;iaasvmcontainerv2;yicma-test-RG;yicma-test-VM",
    "name": "VM;iaasvmcontainerv2;yicma-test-RG;yicma-test-VM",
    "type": "Microsoft.RecoveryServices/vaults/backupFabrics/protectionContainers/protectedItems",
    "properties": {
        "kpisHealths": {},
        "friendlyName": "yicma-TEST-VM",
        "virtualMachineId": "/subscriptions/85b3dbca-5974-4067-9669-67a141095a76/resourceGroups/yicma-TEST-RG/providers/Microsoft.Compute/virtualMachines/yicma-TEST-VM",
        "protectionStatus": "Healthy",
        "protectionState": "IRPending",
        "healthStatus": "Passed",
        "lastBackupStatus": "",
        "lastBackupTime": "2001-01-01T00:00:00Z",
        "protectedItemDataId": "933283062048136095",
        "protectedItemType": "Microsoft.Compute/virtualMachines",
        "backupManagementType": "AzureIaasVM",
        "workloadType": "VM",
        "containerName": "iaasvmcontainerv2;yicma-test-RG;yicma-test-VM",
        "sourceResourceId": "/subscriptions/85b3dbca-5974-4067-9669-67a141095a76/resourceGroups/yicma-TEST-RG/providers/Microsoft.Compute/virtualMachines/yicma-TEST-VM",
        "policyId": "/subscriptions/85b3dbca-5974-4067-9669-67a141095a76/resourceGroups/YICMA-TEST-RG/providers/Microsoft.RecoveryServices/vaults/yicma-test-vault/backupPolicies/DefaultPolicy",
        "policyName": "DefaultPolicy",
        "isArchiveEnabled": false
    }
}

sourceResourceId in request body of the PUT request: /subscriptions/85b3dbca-5974-4067-9669-67a141095a76/resourceGroups/yicma-test-rg/providers/Microsoft.Compute/virtualMachines/yicma-test-vm sourceResourceId in response body of the GET request: /subscriptions/85b3dbca-5974-4067-9669-67a141095a76/resourceGroups/yicma-TEST-RG/providers/Microsoft.Compute/virtualMachines/yicma-TEST-VM

This doesn't seem to be a transient issue. sourceResourceId doesn't take the name or Resource Group and Virtual Machine from request body, but from the value when creating them

[bhperry]

And same problem with listing disks https://github.com/MicrosoftDocs/azure-docs/issues/36222

[eehret]

The fact that resource IDs are sometimes mixed case and sometimes not is also causing problems in Azure portal in the Log Analytics Workspace custom table view. If you click on 'Manage table' there to view your custom DCR-based table, Azure Portal fails to locate the associated DCR when the LAW resource ID in the DCR is mixed case, and ends up displaying "N/A" instead of showing you a link to the DCR.

Microsoft's resource graph query is expecting an exact match on the resource ID but depending on which method was used to create the resources, they don't always exactly match.

I can provide more details on this aspect of the problem if someone needs it.