The API returns a readonly `location` field which triggers the replacement

Behavior

Take Microsoft.Web/staticSites/linkedBackends resource as an example, in the configuration, there's no location field defined and the schema validation also fails if the location is defined.

After the resource is created, the location field was set automatically by Azure and terraform wants to recreate the resource on every plan and apply. The configuration:

resource "azapi_resource" "webapp_linked_backend" {
  type      = "Microsoft.Web/staticSites/linkedBackends@2022-09-01"
  name      = "webapp-${var.env}-${var.location}"
  parent_id = azurerm_static_web_app.web_app.id

  body = {
    kind = "Container App"
    properties = {
      backendResourceId = var.web_backend_id
      region            = var.location
    }
  }
}

The terraform output:

  # module.web_app.azapi_resource.webapp_linked_backend must be replaced
-/+ resource "azapi_resource" "webapp_linked_backend" {
      ~ id                        = "/subscriptions/<SUBSCRIPTON>/resourceGroups/<RG>/providers/Microsoft.Web/staticSites/<STATIC_WEB>/linkedBackends/<NAME>" -> (known after apply)
      - location                  = "East US 2" -> null # forces replacement
        name                      = "webapp-dev-eastus2"
      ~ output                    = {} -> (known after apply)
        # (6 unchanged attributes hidden)
    }

Workaround

Step 1. Add the location field to the configuration to make the configuration match with the remote state. It's okay to use lifecycle.ignore_changes to suppress the difference too.

lifecycle {
    ignore_changes = [
      location,
    ]
  }

Disable the scheme validation by adding the below configuration

schema_validation_enabled = false

Known resource types

It also happens to other resource types, listed as the following:

Microsoft.Web/staticSites/linkedBackends
Microsoft.Web/sites/siteextensions
Microsoft.KeyVault/vaults/secrets
Microsoft.Relay/namespaces/wcfRelays/authorizationRules 
Microsoft.ServiceBus/namespaces/topics/subscriptions
Microsoft.KeyVault/vaults/keys
Microsoft.Storage/storageAccounts/blobServices/containers
Microsoft.Insights/diagnosticSettings
Microsoft.Web/staticSites/customDomains

Azure / terraform-provider-azapi