| layout | azurerm |
|---|---|
| page_title | Azure Resource Manager: 5.0 Upgrade Guide |
| description | |
| Azure Resource Manager | 5.0 Upgrade Guide |
Version 5.0 of the Azure Provider is a major release that includes breaking changes and behavioural differences. This guide covers the most significant changes and explains how to upgrade from v4.x to v5.0.
We recommend pinning the version of each Provider you use in Terraform. You can do this using the version attribute within the required_providers block:
terraform {
required_providers {
azurerm = {
source = "hashicorp/azurerm"
version = "=5.0.0"
}
}
}
provider "azurerm" {
features {}
}More information on how to pin the version of a Terraform Provider being used can be found on the Terraform Website.
- Resource Provider Registration Changes
- Migration Guide for
azurerm_ai_services - Removed Resources
- Removed Data Sources
- Breaking Changes in Resources
- Breaking Changes in Data Sources
In version 5.0, the default behaviour for Resource Provider registration has changed. The resource_provider_registrations property now defaults to none instead of legacy.
Previously, the provider would automatically attempt to register a large set of Azure Resource Providers (~60 RPs) when initializing. This could:
- Add delay to provider startup due to sequential RP registration checks
- Cause permission errors for users with restricted access to their subscription
- Register RPs that users may not need or want
In v5.0, no Resource Providers are registered by default. This gives users full control over RP registration and avoids potential permission issues.
The recommendation is to only register the specific Resource Providers that your configuration requires, using the resource_providers_to_register property:
provider "azurerm" {
resource_providers_to_register = [
"Microsoft.Compute",
"Microsoft.Network",
"Microsoft.Storage",
]
features {}
}If you want to maintain the v4.x behaviour and automatically register the same set of Resource Providers as before, explicitly set resource_provider_registrations to the legacy resource provider set in your provider block:
provider "azurerm" {
resource_provider_registrations = "legacy"
features {}
}For more information, see the Resource Provider Registrations section in the provider documentation.
The enhanced validation feature, which caches supported Azure regions and Resource Providers from the Azure MetaData Service to validate location and Resource Provider arguments, now defaults to disabled in version 5.0.
This is now controlled through the new enhanced_validation provider block:
provider "azurerm" {
enhanced_validation {
locations = true # Re-enable location validation at plan time
resource_providers = true # Re-enable resource provider validation at plan time
}
}Timing Impact: With enhanced validation enabled, invalid locations or resource providers are caught at terraform plan time. With it disabled (the new default in 5.0), these errors are caught at terraform apply time when Azure rejects the request.
This change was made because:
- A region may be functional even if not present in the ARM region list
- The MetaData Service call adds latency to provider initialization
The legacy ARM_PROVIDER_ENHANCED_VALIDATION environment variable, which previously controlled both location and resource provider validation, has been removed in version 5.0. Please migrate to either the enhanced_validation provider block or the specific environment variables: ARM_PROVIDER_ENHANCED_VALIDATION_LOCATIONS and ARM_PROVIDER_ENHANCED_VALIDATION_RESOURCE_PROVIDERS.
The azurerm_ai_services resource has been removed and replaced by azurerm_cognitive_account. The table below lists the attributes that have changed; all other attributes are carried over unchanged.
azurerm_ai_services |
azurerm_cognitive_account |
Notes |
|---|---|---|
| (not present) | kind |
Required. Set to "AIServices" to match the behaviour of azurerm_ai_services. |
local_authentication_enabled |
local_auth_enabled |
Renamed. Both default to true. |
public_network_access |
public_network_access_enabled |
Changed type. String ("Enabled" / "Disabled") → Boolean (true / false). Defaults to true. |
| (not present) | project_management_enabled |
Required. Set to true to match the behaviour of azurerm_ai_services. |
customer_managed_key.managed_hsm_key_id |
(not present) | Use customer_managed_key.key_vault_key_id property, it can accept both regular and HSM key id. |
~> Note: If your configuration included a storage block under azurerm_ai_services, terraform plan may show changes after migration even though the Azure resource itself has not changed. This occurs because azurerm_ai_services silently ignored the storage block and never sent those values to the API, so the imported state does not reflect them. Running terraform apply will reconcile the state by applying the storage configuration for the first time.
Please follow the format in the example below for adding removed resources:
### `azurerm_example_resource`
This deprecated resource has been superseded/retired and has been removed from the Azure Provider.- This deprecated resource has been superseded by
azurerm_cognitive_accountand has been removed from the Azure Provider.
- This deprecated resource has been retired and has been removed from the Azure Provider.
- This deprecated resource has been retired and has been removed from the Azure Provider.
- This deprecated resource has been retired and has been removed from the Azure Provider.
- This deprecated resource has been retired and has been removed from the Azure Provider.
- This deprecated resource has been retired and has been removed from the Azure Provider.
- This deprecated resource has been retired and has been removed from the Azure Provider.
- This deprecated resource has been retired and has been removed from the Azure Provider.
- This deprecated resource has been retired and has been removed from the Azure Provider.
- This deprecated resource has been retired and has been removed from the Azure Provider.
- The
client_certificate_modeproperty now defaults toRequiredaligning with the service default for this value.
- This deprecated resource has been removed from the Azure Provider. Please see the documentation for more details.
- This deprecated resource has been superseded by
azurerm_virtual_machine_packet_captureandazurerm_virtual_machine_scale_set_packet_captureand has been removed from the Azure Provider.
- This deprecated resource has been retired and has been removed from the Azure Provider.
- This deprecated resource has been retired and has been removed from the Azure Provider.
- This deprecated resource has been retired and has been removed from the Azure Provider.
- This deprecated resource has been retired and has been removed from the Azure Provider.
- This deprecated resource has been retired and has been removed from the Azure Provider.
- This deprecated resource has been retired and has been removed from the Azure Provider.
- This deprecated resource has been retired and has been removed from the Azure Provider.
- This deprecated resource has been retired and has been removed from the Azure Provider.
- This deprecated resource has been retired and has been removed from the Azure Provider.
- This deprecated resource has been retired and has been removed from the Azure Provider.
- The property
minimum_tls_versionproperty no longer accepts1.0or1.1as a value. Please see the documentation for more details.
- This deprecated resource has been removed from the Azure Provider. Please see the documentation for more details.
- This deprecated resource has been retired and has been removed from the Azure Provider.
Please follow the format in the example below for adding removed data sources:
### `azurerm_example_resource`
This deprecated data source has been superseded/retired and has been removed from the Azure Provider.- This deprecated data source has been retired and has been removed from the Azure Provider.
- This deprecated data source has been retired and has been removed from the Azure Provider.
- This deprecated data source has been retired and has been removed from the Azure Provider.
Please follow the format in the example below for listing breaking changes in resources:
### `azurerm_example_resource`
* The deprecated `example_old_property` property has been removed in favour of the `example_new_property` property.
* The deprecated `example_property_with_no_replacement` property has been removed.
* The `example_property_with_changed_default` property now defaults to `NewDefault`.- The deprecated
hostname_configuration.developer_portal.key_vault_idproperty has been removed in favour of thehostname_configuration.developer_portal.key_vault_certificate_idproperty. - The deprecated
hostname_configuration.management.key_vault_idproperty has been removed in favour of thehostname_configuration.management.key_vault_certificate_idproperty. - The deprecated
hostname_configuration.portal.key_vault_idproperty has been removed in favour of thehostname_configuration.portal.key_vault_certificate_idproperty. - The deprecated
hostname_configuration.proxy.key_vault_idproperty has been removed in favour of thehostname_configuration.proxy.key_vault_certificate_idproperty. - The deprecated
hostname_configuration.scm.key_vault_idproperty has been removed in favour of thehostname_configuration.scm.key_vault_certificate_idproperty. - The deprecated
protocols.enable_http2property has been removed in favour of theprotocols.http2_enabledproperty. - The deprecated
security.enable_backend_ssl30property has been removed in favour of thesecurity.backend_ssl30_enabledproperty. - The deprecated
security.enable_backend_tls10property has been removed in favour of thesecurity.backend_tls10_enabledproperty. - The deprecated
security.enable_backend_tls11property has been removed in favour of thesecurity.backend_tls11_enabledproperty. - The deprecated
security.enable_frontend_ssl30property has been removed in favour of thesecurity.frontend_ssl30_enabledproperty. - The deprecated
security.enable_frontend_tls10property has been removed in favour of thesecurity.frontend_tls10_enabledproperty. - The deprecated
security.enable_frontend_tls11property has been removed in favour of thesecurity.frontend_tls11_enabledproperty.
- The deprecated
developer_portal.key_vault_idproperty has been removed in favour of thedeveloper_portal.key_vault_certificate_idproperty. - The deprecated
gateway.key_vault_idproperty has been removed in favour of thegateway.key_vault_certificate_idproperty. - The deprecated
management.key_vault_idproperty has been removed in favour of themanagement.key_vault_certificate_idproperty. - The deprecated
portal.key_vault_idproperty has been removed in favour of theportal.key_vault_certificate_idproperty. - The deprecated
scm.key_vault_idproperty has been removed in favour of thescm.key_vault_certificate_idproperty.
- The
remote_debugging_versionproperty no longer acceptsVS2017andVS2019as a value.
- The
remote_debugging_versionproperty no longer acceptsVS2017andVS2019as a value.
- The deprecated
ssl_profile.verify_client_cert_issuer_dnproperty has been removed in favour of thessl_profile.verify_client_certificate_issuer_dnproperty. - The deprecated
enable_http2property has been removed in favour of thehttp2_enabledproperty.
- The
encryption.key_sourceproperty has been removed.
- The deprecated
certificateproperty has been removed.
- The deprecated
enable_callingproperty has been removed in favour of thecalling_enabledproperty.
- The
cdn_managed_https.tls_versionproperty no longer acceptsNoneorTLS10as a value. - The
user_managed_https.tls_versionproperty no longer acceptsNoneorTLS10as a value.
- The
tls.minimum_tls_versionproperty no longer acceptsTLS10as a value.
- The deprecated
template.container.liveness_probe.termination_grace_period_secondsproperty has been removed. - The deprecated
template.container.startup_probe.termination_grace_period_secondsproperty has been removed.
- The deprecated
template.container.liveness_probe.termination_grace_period_secondsproperty has been removed. - The deprecated
template.container.startup_probe.termination_grace_period_secondsproperty has been removed.
- The
encryptionblock is no longer Computed. It now defaults to empty, meaning encryption will be disabled.
- The
minimal_tls_versionproperty no longer acceptsTlsorTls11as a value.
- The
logs_destinationproperty is no longer Computed and now must be set tolog-analyticsto be able to specify a value forlog_analytics_workspace_id. It will now default to empty, meaning Streaming Only in the Azure Portal.
- The deprecated
single_sign_on_enabledproperty has been removed in favour of thesingle_sign_onproperty.
- The deprecated
key_vault_sas_tokenblock has been removed in favour of thesas_token_linked_key_vault_keyblock.
- The deprecated
msi_work_space_resource_idproperty has been removed in favour of themsi_workspace_idproperty.
- Validation for
rbac_authorization.resource_idhas been changed to validate for an integration runtime resource ID (case-sensitive) rather than validating for a non-empty string.
- Validation for
azure_function.function_idhas been changed to validate for an Azure Function resource ID (case-sensitive) rather than validating for an Azure resource ID.
- The deprecated
source_arm_resource_idproperty has been removed in favour of thesource_resource_idproperty. - The deprecated
metric_arm_resource_idproperty has been removed in favour of themetric_resource_idproperty.
- The deprecated
source_arm_resource_idproperty has been removed in favour of thesource_resource_idproperty. - Validation for
azure_function.function_idhas been changed to validate for an Azure Function resource ID (case-sensitive) rather than validating for an Azure resource ID.
- The deprecated
namespace_nameproperty has been removed in favour of thenamespace_idproperty. - The deprecated
resource_group_nameproperty has been removed in favour of thenamespace_idproperty.
- The
minimum_tls_versionproperty no longer accepts1.0and1.1as a value.
- The deprecated
private_link_fast_path_enabledproperty has been removed as it is no longer supported by the resource. - The deprecated
enable_internet_securityproperty has been removed in favour of theinternet_security_enabledproperty.
- The deprecated
contactproperty has been removed as it is no longer supported by the resource. - The deprecated
enable_rbac_authorizationproperty has been removed in favour of therbac_authorization_enabledproperty.
- The deprecated
default_node_pool.linux_os_config.transparent_huge_page_enabledproperty has been removed in favour of thedefault_node_pool.linux_os_config.transparent_huge_pageproperty. - The
node_provisioning_profileblock is now required.
- The deprecated
linux_os_config.transparent_huge_page_enabledproperty has been removed in favour of thelinux_os_config.transparent_huge_pageproperty.
- The deprecated
cluster_resource_idproperty has been removed in favour of thecluster_idproperty.
- The deprecated
language_extensionsproperty has been removed in favour of thelanguage_extensionproperty. - The deprecated
virtual_network_configurationblock has been removed as it is no longer supported by the resource.
- The deprecated
eventgrid_resource_idproperty has been removed in favour of theeventgrid_event_subscription_idproperty. - The deprecated
managed_identity_resource_idproperty has been removed in favour of themanaged_identity_idproperty.
- The following properties are no longer Computed:
subnet_id,public_ip_address_id
- The deprecated
enable_floating_ipproperty has been removed in favour of thefloating_ip_enabledproperty. - The deprecated
enable_tcp_resetproperty has been removed in favour of thetcp_reset_enabledproperty.
- The deprecated
enable_tcp_resetproperty has been removed in favour of thetcp_reset_enabledproperty.
- The
remote_debugging_versionproperty no longer acceptsVS2017andVS2019as a value.
- The
remote_debugging_versionproperty no longer acceptsVS2017andVS2019as a value.
- The
remote_debugging_versionproperty no longer acceptsVS2017andVS2019as a value.
- The
remote_debugging_versionproperty no longer acceptsVS2017andVS2019as a value.
- The deprecated
workspace_resource_idproperty has been removed and superseded by theworkspace_idproperty.
- The
storage_account_idproperty is marked asForceNew.
- The deprecated
local_authentication_disabledproperty has been removed in favour of thelocal_authentication_enabledproperty.
- The deprecated
site_config.public_network_access_enabledproperty has been removed and superseded by thepublic_network_accessproperty. - The
client_certificate_modeproperty now defaults toRequiredto match API default value. - The
site_config.min_tls_versionproperty no longer accepts1.0or1.1as a value. - The
site_config.scm_min_tls_versionproperty no longer accepts1.0or1.1as a value.
- The deprecated
enabled_log.retention_policyblock has been removed.
- The deprecated
metric.retention_policyblock has been removed. - The deprecated
metricblock has been removed in favour of theenabled_metricblock. - The deprecated
enabled_log.retention_policyblock has been removed.
- The properties
weekly_retention,monthly_retentionandyearly_retentionnow default toPT0S.
- The properties
weekly_retention,monthly_retentionandyearly_retentionnow default toPT0S.
- The property
minimum_tls_versionno longer accepts1.0or1.1as a value. - The property
proxy_overridenow defaults toRedirect. - The property
proxy_overrideno longer acceptsDefaultas a value.
- The deprecated
managed_hsm_key_idproperty has been removed in favour of thekey_vault_key_idproperty.
- The property
minimum_tls_versionno longer acceptsDisabled,1.0or1.1as a value.
- The deprecated
managed_hsm_key_idproperty has been removed in favour of thekey_vault_key_idproperty.
- The deprecated
public_network_access_enabledproperty has been removed in favour of thepublic_network_accessproperty.
- The deprecated
export_policy_rule.protocols_enabledproperty has been removed in favour of theexport_policy_rule.protocolproperty.
- The deprecated
network_security_group_idproperty has been removed in favour of thetarget_resource_idproperty.
- The deprecated
logging_storage_accountblock has been removed in favour of theazurerm_monitor_diagnostic_settingresource. - The deprecated
managed_resource_groupproperty has been removed.
- The
plan_idproperty now defaults topanw-cngfw-payg.
- The
plan_idproperty now defaults topanw-cngfw-payg.
- The
plan_idproperty now defaults topanw-cngfw-payg.
- The
plan_idproperty now defaults topanw-cngfw-payg.
- The
management_group_idproperty has been removed in favour of theazurerm_management_group_policy_set_definitionresource.
- The
modeproperty now defaults toGen2.
- The deprecated
enable_proxy_protocolproperty has been removed in favour of theproxy_protocol_enabledproperty.
- The property
minimum_tls_versionno longer accepts1.0or1.1as a value.
- The property
minimum_tls_versionproperty no longer accepts1.0or1.1as a value.
- Valid values for
action.typehave changed fromlogicapp,eventhub, andloganalyticstoLogicApp,EventHub, andWorkspace.
- The deprecated
nameproperty has been removed.
- The property
minimum_tls_versionno longer accepts1.0or1.1as a value.
- The deprecated
customer_managed_key.managed_hsm_key_idhas been removed in favour of thecustomer_managed_key.key_vault_key_idproperty. - The property
min_tls_versionno longer acceptsTLS1_0orTLS1_1as a value. - The deprecated
queue_propertiesblock has been removed and superseded by theazurerm_storage_account_queue_propertiesresource. - The deprecated
static_websiteblock has been removed and superseded by theazurerm_storage_account_static_websiteresource. - The property
allow_nested_items_to_be_publicnow defaults tofalse.
- The deprecated
key_vault_uriproperty has been removed in favour of thekey_vault_key_idproperty. - The deprecated
key_nameproperty has been removed in favour of thekey_vault_key_idproperty. - The deprecated
key_versionproperty has been removed in favour of thekey_vault_key_idproperty. - The deprecated
managed_hsm_key_idproperty has been removed in favour of thekey_vault_key_idproperty. - The deprecated
key_vault_idproperty has been removed in favour of thekey_vault_key_idproperty.
- The
spark_versionproperty no longer accepts3.2or3.3as a value.
- The deprecated
storage_account_nameproperty has been removed in favour of thestorage_account_idproperty. - The deprecated
resource_manager_idproperty has been removed in favour of theidproperty.
- The deprecated
storage_account_nameproperty has been removed in favor of thestorage_account_idproperty. - The deprecated
resource_manager_idproperty has been removed in favour of theidproperty.
- The deprecated
storage_account_nameproperty has been removed in favour of thestorage_account_idproperty. - The deprecated
resource_manager_idproperty has been removed in favour of theidproperty.
- The deprecated
storage_share_idproperty has been removed in favor of thestorage_share_urlproperty.
- The deprecated
storage_share_idproperty has been removed in favor of thestorage_share_urlproperty.
- The deprecated
auto_backup.encryption_enabledproperty has been removed.
- The
remote_debugging_versionproperty no longer acceptsVS2017andVS2019as a value.
- The
remote_debugging_versionproperty no longer acceptsVS2017andVS2019as a value.
- The
enable_automatic_updatesproperty has been removed in favour of theautomatic_updates_enabledproperty.
- The
remote_debugging_versionproperty no longer acceptsVS2017andVS2019as a value. - The
virtual_network_image_pull_enabledproperty now defaults tofalse.
- The
remote_debugging_versionproperty no longer acceptsVS2017andVS2019as a value. - The
virtual_network_image_pull_enabledproperty now defaults tofalse.
Please follow the format in the example below for listing breaking changes in data sources:
### `azurerm_example_resource`
* The deprecated `example_old_property` property has been removed in favour of the `example_new_property` property.
* The deprecated `example_property_with_no_replacement` property has been removed.- The deprecated
hostname_configuration.developer_portal.key_vault_idproperty has been removed in favour of thehostname_configuration.developer_portal.key_vault_certificate_idproperty. - The deprecated
hostname_configuration.management.key_vault_idproperty has been removed in favour of thehostname_configuration.management.key_vault_certificate_idproperty. - The deprecated
hostname_configuration.portal.key_vault_idproperty has been removed in favour of thehostname_configuration.portal.key_vault_certificate_idproperty. - The deprecated
hostname_configuration.proxy.key_vault_idproperty has been removed in favour of thehostname_configuration.proxy.key_vault_certificate_idproperty. - The deprecated
hostname_configuration.scm.key_vault_idproperty has been removed in favour of thehostname_configuration.scm.key_vault_certificate_idproperty.
- The deprecated
certificateproperty has been removed.
- The deprecated
template.container.liveness_probe.termination_grace_period_secondsproperty has been removed. - The deprecated
template.container.startup_probe.termination_grace_period_secondsproperty has been removed.
- The deprecated
source_arm_resource_idproperty has been removed in favour of thesource_resource_idproperty. - The deprecated
metric_arm_resource_idproperty has been removed in favour of themetric_resource_idproperty.
- The deprecated
enable_rbac_authorizationproperty has been removed in favour of therbac_authorization_enabledproperty.
- The deprecated
enable_tcp_resetproperty has been removed in favour of thetcp_reset_enabledproperty.
- The deprecated
enable_floating_ipproperty has been removed in favour of thefloating_ip_enabledproperty. - The deprecated
enable_tcp_resetproperty has been removed in favour of thetcp_reset_enabledproperty.
- The deprecated
site_config.public_network_access_enabledproperty has been removed and superseded by thepublic_network_accessproperty.
- The deprecated
protected_file.contentproperty has been removed.
- The deprecated
logging_storage_accountblock has been removed. - The deprecated
managed_resource_groupproperty has been removed.
- The deprecated
namespace_nameproperty has been removed. - The deprecated
resource_group_nameproperty has been removed.
- The deprecated
namespace_nameproperty has been removed. - The deprecated
resource_group_nameproperty has been removed. - The deprecated
enable_batched_operationsproperty has been removed in favour of thebatched_operations_enabledproperty. - The deprecated
enable_expressproperty has been removed in favour of theexpress_enabledproperty. - The deprecated
enable_partitioningproperty has been removed in favour of thepartitioning_enabledproperty.
- The deprecated
namespace_nameproperty has been removed. - The deprecated
resource_group_nameproperty has been removed. - The deprecated
topic_nameproperty has been removed. - The deprecated
enable_batched_operationsproperty has been removed in favour of thebatched_operations_enabledproperty.
- The deprecated
storage_account_nameproperty has been removed in favour of thestorage_account_idproperty. - The deprecated
resource_manager_idproperty has been removed in favour of theidproperty.
- The deprecated
storage_account_nameproperty has been removed in favour of thestorage_account_idproperty. - The deprecated
resource_manager_idproperty has been removed in favour of theidproperty.
- The deprecated
storage_account_nameproperty has been removed in favour of thestorage_account_idproperty. - The deprecated
resource_manager_idproperty has been removed in favour of theidproperty.
- The deprecated
enable_bgpproperty has been removed in favour of thebgp_enabledproperty.
- The deprecated
enable_bgpproperty has been removed in favour of thebgp_enabledproperty.