bug: resource providers are not unregistered when removed from LZ?

[kewalaka]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Versions

terraform 1.9.6

Please enter the module version that you are using:

4.1.3

Description

Resource providers are created via an azapi_resource_action:

https://github.com/Azure/terraform-azurerm-lz-vending/blob/main/modules/resourceprovider/main.tf

My understanding is when these are removed from state, they are not unregistered because the a delete operation for azapi_resource_action is a no-op.

Raising this bug to confirm my understanding and ask if there are any suggestions for a way to trigger an unregister if the RP is removed from the code?

[kewalaka]

wondering if this would work?

resource "azapi_resource_action" "resource_provider_deregistration" {
  type        = "Microsoft.Resources/subscriptions@2021-04-01"
  resource_id = "/subscriptions/${var.subscription_id}"
  action      = "providers/${var.resource_provider}/unregister"
  method      = "POST"
  when        = "destroy"
}

[matt-FFFFFF]

Hi,

What's the use case here for unregustering the RP?

[kewalaka]

What's the use case here for unregustering the RP?

Security recommendation to only have required RPs enabled.

I've tried the above and it does work but is brittle (even with delays to wait after dependent resources are gone).

I see a counter argument for this to be an app owner concern (subscription democratisation), and using Policy to manage undesirable RPs.