exported terraform configuration having ip_restriction_default_action and scm_ip_restriction_default_action with empty values

[SivakumarShan]

I'm exporting one of the existing linux based Azure Appservice and functionapp to terrafomr using aztfexport tool. But the generated terraform configuration is having

ip_restriction_default_action     = ""
    scm_ip_restriction_default_action = ""

I think these two properties are not mandatory and not adding default/actual values. The allowed values are "Allow or Deny". Hence when I execute terraform plan it's failing with

Error: expected site_config.0.ip_restriction_default_action to be one of ["Allow" "Deny"], got
│
│ with azurerm_linux_web_app.res-1,
│ on main.tf line 29, in resource "azurerm_linux_web_app" "res-1":
│ 29: ip_restriction_default_action = ""

Error: expected site_config.0.scm_ip_restriction_default_action to be one of ["Allow" "Deny"], got
│
│ with azurerm_linux_web_app.res-1,
│ on main.tf line 30, in resource "azurerm_linux_web_app" "res-1":
│ 30: scm_ip_restriction_default_action = ""

How to resolve/override this issue?

[magodo]

SivakumarShan Thanks for reaching out! If you look at the state file generated along the process for this resource, you'll find both attributes are imported as "". The logic of aztfexport when converting the state into config, is that if the state contains a non-null value different than the (optional) attribute's default value (i.e. Allow), it will keep that value.

The issue relates to the upstream provider's underlying SDK (terraform-plugin-sdk/v2), about the behavior when working with nested attributes, it will always set a default value for them, even if the provider code wants to set it as null. Since that SDK is not going to fix the issue in the near future, you have to modify the config yourselves, unfortunately.