bug: resource providers are not unregistered when removed from LZ?

kewalaka commented 3 weeks ago

Community Note

Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
If you are interested in working on this issue or have submitted a pull request, please leave a comment

Versions

terraform 1.9.6

Please enter the module version that you are using:

4.1.3

Description

Resource providers are created via an azapi_resource_action:

https://github.com/Azure/terraform-azurerm-lz-vending/blob/main/modules/resourceprovider/main.tf

My understanding is when these are removed from state, they are not unregistered because the a delete operation for azapi_resource_action is a no-op.

Raising this bug to confirm my understanding and ask if there are any suggestions for a way to trigger an unregister if the RP is removed from the code?

kewalaka commented 3 weeks ago

wondering if this would work?

resource "azapi_resource_action" "resource_provider_deregistration" {
  type        = "Microsoft.Resources/subscriptions@2021-04-01"
  resource_id = "/subscriptions/${var.subscription_id}"
  action      = "providers/${var.resource_provider}/unregister"
  method      = "POST"
  when        = "destroy"
}

matt-FFFFFF commented 2 weeks ago

Hi,

What's the use case here for unregustering the RP?

kewalaka commented 2 weeks ago

What's the use case here for unregustering the RP?

Security recommendation to only have required RPs enabled.

I've tried the above and it does work but is brittle (even with delays to wait after dependent resources are gone).

I see a counter argument for this to be an app owner concern (subscription democratisation), and using Policy to manage undesirable RPs.

Azure / terraform-azurerm-lz-vending