Terraform部署Application Gateway端口变更引发资源重建问题求助

通过Terraform部署了一台Application Gateway，尝试为前端和后端添加443端口时，Terraform plan显示会先删除80端口的前端与后端配置，随后重新创建80端口配置并新增443端口配置，具体plan输出如下：

~ resource "azurerm_application_gateway" "xyz" {
        id                                = "xyz"
        name                              = "xyz"
        tags                              = {
            "BusinessUnit"   = "ehs"
            "LineOfBusiness" = "corp"
        }
        # (8 unchanged attributes hidden)

      - backend_http_settings {
          - cookie_based_affinity               = "Disabled" -> null
          - id                                  = "xyz" -> null
          - name                                = "xyz" -> null
          - path                                = "/path1/" -> null
          - pick_host_name_from_backend_address = false -> null
          - port                                = 80 -> null
          - protocol                            = "Http" -> null
          - request_timeout                     = 60 -> null
          - trusted_root_certificate_names      = [] -> null
        }
      + backend_http_settings {
          + cookie_based_affinity               = "Disabled"
          + host_name                           = "xyz"
          + id                                  = (known after apply)
          + name                                = "xyz"
          + path                                = "/path1/"
          + pick_host_name_from_backend_address = false
          + port                                = 443
          + probe_id                            = (known after apply)
          + protocol                            = "Https"
          + request_timeout                     = 60
          + trusted_root_certificate_names      = [
              + "irmscer",
            ]
        }
      + backend_http_settings {
          + cookie_based_affinity               = "Disabled"
          + id                                  = "xyz"
          + name                                = "xyz"
          + path                                = "/path1/"
          + pick_host_name_from_backend_address = false
          + port                                = 80
          + protocol                            = "Http"
          + request_timeout                     = 60
          + trusted_root_certificate_names      = []
        }

      + frontend_port {
          + id   = (known after apply)
          + name = "xyz"
          + port = 443
        }

Terraform后端配置如下：

terraform {
  backend "azurerm" {
    storage_account_name = "xyz"
    resource_group_name  = "xyz"
    container_name       = "appgw"
    tenant_id            = "xyz"
    subscription_id      = "xyz"
    key                  = "xyz"
  }
}

provider "azurerm" {
  features {}
}

目前未指定Terraform具体版本，请问该如何解决此问题？

• 锁定Terraform和AzureRM Provider版本：未指定版本会导致依赖浮动，新旧版本对嵌套资源的处理逻辑存在差异。在配置中明确锁定稳定版本，示例配置如下：

  terraform {
    required_version = ">= 1.5.0"
    required_providers {
      azurerm = {
        source  = "hashicorp/azurerm"
        version = ">= 3.0.0, < 4.0.0"
      }
    }
    backend "azurerm" {
      storage_account_name = "xyz"
      resource_group_name  = "xyz"
      container_name       = "appgw"
      tenant_id            = "xyz"
      subscription_id      = "xyz"
      key                  = "xyz"
    }
  }
  
  provider "azurerm" {
    features {}
  }
  

  选择3.x系列AzureRM Provider，它对Application Gateway嵌套资源的处理更稳定，可避免不必要的销毁重建操作。

• 确保嵌套资源名称唯一：Terraform通过name字段识别嵌套资源，若新增的443端口配置与原有80端口配置名称重复，会被判定为修改原有资源而非新增，进而触发销毁重建。检查并修改重复的name值，保证每个backend_http_settings和frontend_port的名称唯一。

• 同步并校准Terraform状态：如果当前状态与实际部署资源存在差异，先执行terraform refresh同步状态。若问题仍存在，手动导入现有80端口的backend_http_settings资源，确保状态与配置匹配：

  terraform import azurerm_application_gateway.xyz.backend_http_settings[0] /subscriptions/<subscription-id>/resourceGroups/<rg-name>/providers/Microsoft.Network/applicationGateways/<appgw-name>/backendHttpSettingsCollection/<settings-name>
  

  替换命令中的占位符为实际资源信息，确保索引和名称对应正确。

• 分步更新配置：不要一次性添加所有443端口配置，先单独新增frontend_port，执行terraform apply确认无销毁操作后，再添加backend_http_settings配置，逐步验证每一步的plan结果，缩小问题范围。

内容的提问来源于stack exchange，提问作者Sagar Hiremath