[Bug]: allow_extension_operations Does Not Properly Control Creation of Extensions

[neonwhiskers]

Bug Description

There appears to be an issue with how the allow_extension_operations variable is controlling the creation of virtual machine extensions in the module. Despite setting allow_extension_operations to false, the extensions are still being created, which leads to Terraform applying the extensions even when the user explicitly intends to prevent them.

Steps to Reproduce:

• Set allow_extension_operations to false in the module configuration.
• Apply the Terraform plan.
• Observe that the extensions defined in the extensions list are still being created despite the false setting.

Expected Behavior:

When allow_extension_operations is set to false, no virtual machine extensions should be created.

Actual Behavior:

Extensions are still created even when allow_extension_operations is set to false.

Terraform-Version

Terraform v1.9.3

Relevant log output

No response

Relevant Error Messages

No response

Additional Information

resource "azurerm_virtual_machine_extension" "this" {
  for_each = var.allow_extension_operations ? {
    for element in concat(local.common_extensions, local.additional_extensions) :
    element.name => element if contains(var.extensions, element.name)
  } : {}

  virtual_machine_id = module.azurerm_virtual_machine.id

  auto_upgrade_minor_version    = lookup([for ext in module.azurerm_virtual_machine.virtual_machine_extensions : ext if ext["name"] == each.key][0], "auto_upgrade_minor_version", false)
  automatic_upgrade_enabled     = lookup([for ext in module.azurerm_virtual_machine.virtual_machine_extensions : ext if ext["name"] == each.key][0], "automatic_upgrade_enabled", false)
  name                          = lookup([for ext in module.azurerm_virtual_machine.virtual_machine_extensions : ext if ext["name"] == each.key][0], "name", each.key)
  publisher                     = lookup([for ext in module.azurerm_virtual_machine.virtual_machine_extensions : ext if ext["name"] == each.key][0], "publisher", each.value.publisher)
  type                          = lookup([for ext in module.azurerm_virtual_machine.virtual_machine_extensions : ext if ext["name"] == each.key][0], "type", each.value.type)
  type_handler_version          = lookup([for ext in module.azurerm_virtual_machine.virtual_machine_extensions : ext if ext["name"] == each.key][0], "type_handler_version", each.value.type_handler_version)
}

Possible Root Cause:

It appears that the for_each logic does not properly respect the condition tied to allow_extension_operations. The current approach should be revisited to ensure that the extensions are only created when allow_extension_operations is set to true.

Potential Fix:

One approach could be restructuring the conditional logic around for_each or ensuring that the var.allow_extension_operations variable is respected within the resource definition.

Privacy Statement

• I agree

Code of Conduct

• I agree to follow this repository's Code of Conduct