Cosmos SQL Container Excluded Path not Updating with new path

[Clockwork-Muse]

Is there an existing issue for this?

• [X] I have searched the existing issues

Community Note

• Please vote on this issue by adding a :thumbsup: reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment and review the contribution guide to help.

Terraform Version

1.6.2

AzureRM Provider Version

3.80.0

Affected Resource(s)/Data Source(s)

azurerm_cosmosdb_sql_container

Terraform Configuration Files

#===========================#
# Providers & Configuration #
#===========================#

terraform {
  required_version = "~>1.0"
  required_providers {
    azuread = {
      source  = "hashicorp/azuread"
      version = "~> 2.15.0"
    }
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "~>3.0"
    }
  }
  backend "azurerm" {}
}

provider "azurerm" {
  features {
    key_vault {
      purge_soft_delete_on_destroy = true
    }
  }
}

#===========#
# Resources #
#===========#

resource "azurerm_resource_group" "rg" {
  name     = "resource_group_name"
  location = "eastus"
}

# Database and database related settings
resource "azurerm_cosmosdb_account" "database" {
  name                = "database"
  resource_group_name = azurerm_resource_group.rg.name
  location            = azurerm_resource_group.rg.location
  offer_type          = "Standard"
  kind                = "GlobalDocumentDB"

  consistency_policy {
    consistency_level = "Session"
  }
  geo_location {
    failover_priority = 0
    location          = "westus"
  }
}

resource "azurerm_cosmosdb_sql_database" "db_database" {
  name                = "somedatabase"
  resource_group_name = azurerm_resource_group.rg.name
  account_name        = azurerm_cosmosdb_account.database.name
}

resource "azurerm_cosmosdb_sql_container" "db_container" {
  name                  = "somecontainer"
  resource_group_name   = azurerm_resource_group.rg.name
  account_name          = azurerm_cosmosdb_account.database.name
  database_name         = azurerm_cosmosdb_sql_database.db_database.name
  partition_key_path    = "/keyPath"
  partition_key_version = 1
  throughput            = 400

  indexing_policy {
    indexing_mode = "consistent"

    included_path {
      path = "/*"
    }

    excluded_path {
      path = "/\"_etag\"/?"
    }
  }
}

Debug Output/Panic Output

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  ~ update in-place

Terraform will perform the following actions:

  # azurerm_cosmosdb_sql_container.db_container will be updated in-place
  ~ resource "azurerm_cosmosdb_sql_container" "db_container" {
        id                    = "some resource id"
        name                  = "somecontainer"
        # (6 unchanged attributes hidden)

      ~ indexing_policy {
            # (1 unchanged attribute hidden)

          + excluded_path {
              + path = "/\"_etag\"/?"
            }

            # (1 unchanged block hidden)
        }

        # (1 unchanged block hidden)
    }

Plan: 0 to add, 1 to change, 0 to destroy.

Expected Behaviour

Container should have the added excluded_path

Actual Behaviour

Container has the excluded_path in the Azure portal, but every apply attempts to create the excluded_path again.

Steps to Reproduce

Use the container listed. I believe the issue is with the path "/\"_etag\"/?".

• terraform apply

Important Factoids

No response

References

13330 - issue was previously closed as being for "provider 2.0 only, reopen if it shows up for provider 3.0". So here we are....

[neil-yechenwei]

Thanks for raising this issue. I assume it's expected since "_etag" is automatically added by the server. So no need to explicitly to set "_etag" in tf config.

[Clockwork-Muse]

So no need to explicitly to set "_etag" in tf config.

Except if I do set it it shows up as a difference in the plan, and so my build process claims that there's a difference.