Azure Question posted in
The official documentation to get you started can be found here.

Terraform and Azure: Problems with association between NetworkSecurityGroups and Subnets

While applying my terraform script, I’m getting the following error:

╷
│ Error: A resource with the ID "/subscriptions/***/resourceGroups/rg-subnet-test/providers/Microsoft.Network/virtualNetworks/subnet-test-vnet/subnets/subnet-test-subnet" already exists - to be managed via Terraform this resource needs to be imported into the State. Please see the resource documentation for "azurerm_subnet_network_security_group_association" for more information.
│
│   with azurerm_subnet_network_security_group_association.association1,
│   on main.tf line 47, in resource "azurerm_subnet_network_security_group_association" "association1":
│   47: resource "azurerm_subnet_network_security_group_association" "association1" {
│
╵

This is my script:

# Resource Group
resource "azurerm_resource_group" "rg_subnet_test" {
  location = "germanywestcentral"
  name     = "rg-subnet-test"
}

# VNET
resource "azurerm_virtual_network" "vnet_subnet_test" {
  address_space       = ["10.100.2.0/24"]
  location            = azurerm_resource_group.rg_subnet_test.location
  name                = "subnet-test-vnet"
  resource_group_name = azurerm_resource_group.rg_subnet_test.name
}

# Subnet
resource "azurerm_subnet" "subnet_germany" {
  name                 = "subnet-test-subnet"
  address_prefixes     = ["10.100.2.0/24"]
  resource_group_name  = azurerm_virtual_network.vnet_subnet_test.resource_group_name
  virtual_network_name = azurerm_virtual_network.vnet_subnet_test.name
}

# First Network Security Group
resource "azurerm_network_security_group" "app_server_nsg_1" {
  name                = "subnet-test-nsg-1"
  location            = azurerm_resource_group.rg_subnet_test.location
  resource_group_name = azurerm_resource_group.rg_subnet_test.name
}

# Second Network Security Group
resource "azurerm_network_security_group" "app_server_nsg_2" {
  name                = "subnet-test-nsg-2"
  location            = azurerm_resource_group.rg_subnet_test.location
  resource_group_name = azurerm_resource_group.rg_subnet_test.name
}

# Association between first NSG to subnet
resource "azurerm_subnet_network_security_group_association" "association1" {
  subnet_id                 = azurerm_subnet.subnet_germany.id
  network_security_group_id = azurerm_network_security_group.app_server_nsg_1.id
}

# Association between second NSG to subnet
resource "azurerm_subnet_network_security_group_association" "association2" {
  subnet_id                 = azurerm_subnet.subnet_germany.id
  network_security_group_id = azurerm_network_security_group.app_server_nsg_2.id
}

I don’t understand the error, because I only create the subnet once. Why is the second association trying to create the subnet again? What am I doing wrong here?

Tags:

2

Answers


  1. 0

    Terraform and Azure: Problems with association between NetworkSecurityGroups and Subnets

    As mentioned in the error we need to import the subnet resource as per the requirement as this only the approach which works. When I test this configuration, I face the similar issue you mentioned

    enter image description here

    terraform_move command was wont work here as we need move the configuration changes as per the resource we need to move in the state file as Rui Jarimba mentioned it better remove the resource info from the state and reimport it as per the requirement only works as expected.

    The error we are faced only due to miss match of configuration with the state which we tried not with the way the resources are provisioned.

    configuration goes as per the repo you shared in github i only shared the part of the configuration where we import the resource.

    configuration:

    modules/german/main.tf

    variable "region" {}
variable "resource_group_name" {}

module "network" {
  source = "../network"
  region = var.region
  resource_group_name = var.resource_group_name
}

module "appserver" {
  source = "../vm/app"
  region = var.region
  resource_group_name = var.resource_group_name
  subnet_id = module.network.subnet_id
}

module "dbserver" {
  source = "../vm/db"
  region = var.region
  resource_group_name = var.resource_group_name
  subnet_id = module.network.subnet_id
}

    modules/network/main.tf:

    variable "region" {}
variable "resource_group_name" {}

resource "azurerm_virtual_network" "vnet" {
  name                = "subnet-test-de-vnet"
  address_space       = ["10.0.0.0/16"]
  location            = var.region
  resource_group_name = var.resource_group_name
}

resource "azurerm_subnet" "subnet" {
  name                 = "subnet-test-de-subnet"
  resource_group_name  = var.resource_group_name
  virtual_network_name = azurerm_virtual_network.vnet.name
  address_prefixes     = ["10.0.1.0/24"]
}

output "subnet_id" {
  value = azurerm_subnet.subnet.id
}

    continue with the rest of the configuration

    Deployment:

    run the command terraform state list

    enter image description here

    remove the resource

    enter image description here

    this resource was imported into different module as per the requirement

    terraform import 'module.german_region.module.dbserver.azurerm_subnet_network_security_gassociation.association_subnet_db

    enter image description here

    enter image description here

    enter image description here

    Refer:

    https://github.com/azurerm/terraform-azure-resources/tree/v1.0.10/modules/subnet_network_security_group_association

    https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/subnet_network_security_group_association

    https://github.com/Azure/terraform-azurerm-network-security-group

    Login or Signup to reply.
  2. 0

    Error: A resource with the ID xxxxxx already exists – to be managed via Terraform this resource needs to be imported into the State.

    There are several possible scenarios that can lead to this error:

    • Resource was created manually and was later added to Terraform configuration: Since Terraform’s state does not include this resource, Terraform attempts to create it.
    • Resource was moved between modules: Terraform loses track of the resource’s state because its address has changed and consequently tries to create a new resource with the same ID.
    • Resource was renamed: Renaming a resource in the configuration without updating the state state will make Terraform think it needs to create a new resource. The old resource still exists in the infrastructure, causing a conflict.

    Please refer to Vinay B’s answer or Moving resources for details on how to fix this issue.

    Login or Signup to reply.
Please signup or login to give your own answer.

Back To Top
Search