Skip to content

azurerm_nat_gateway/azurerm_public_ip/azurerm_public_ip_prefix - support for new SKU StandardV2 #31197

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
sreallymatt merged 20 commits into from
Mar 27, 2026
Merged

azurerm_nat_gateway/azurerm_public_ip/azurerm_public_ip_prefix - support for new SKU StandardV2 #31197

Show file tree
Hide file tree
Changes from 9 commits
Commits
Show all changes
20 commits
Select commit Hold shift + click to select a range
5e0cac4
azurerm_nat_gateway/azurerm_public_ip/azurerm_public_ip_prefix - supp…
Nov 26, 2025
8669186
update md file
Nov 26, 2025
1ca4e10
update md
Dec 4, 2025
c1dcf3c
update md file
Dec 8, 2025
e882770
Add CustomizeDiff Validtor for new sku StandardV2
Dec 8, 2025
9cd164f
update tc
Dec 8, 2025
f5906bd
Merge remote-tracking branch 'upstream/main' into networkskuv2
Dec 8, 2025
66824ac
add computed for skuv2
Feb 3, 2026
69e74c7
Merge remote-tracking branch 'upstream/main' into networkskuv2
Feb 4, 2026
e3c8b25
update pr per comments
Feb 9, 2026
d8efc68
Merge branch 'main' of github.com:hashicorp/terraform-provider-azurer…
teowa Feb 25, 2026
574846b
add validation for zones
teowa Feb 25, 2026
d626e58
block creation of Basic SKU Public IP resources while allowing existi…
teowa Mar 4, 2026
348e749
update doc; fix code
teowa Mar 10, 2026
2de750c
fix doc
teowa Mar 11, 2026
79d6261
update sku validation
teowa Mar 13, 2026
d53603e
update allocation validation for public IP
teowa Mar 13, 2026
1c0a85c
fix basic sku public ip message
teowa Mar 16, 2026
aa8b5d5
fix lint
teowa Mar 16, 2026
a1c8270
disallow zones for StandardV2; update test
teowa Mar 23, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 14 additions & 7 deletions internal/services/network/nat_gateway_resource.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -74,15 +74,22 @@ func resourceNatGatewaySchema() map[string]*pluginsdk.Schema {
},

"sku_name": {
Type: pluginsdk.TypeString,
Optional: true,
Default: string(natgateways.NatGatewaySkuNameStandard),
ValidateFunc: validation.StringInSlice([]string{
string(natgateways.NatGatewaySkuNameStandard),
}, false),
Type: pluginsdk.TypeString,
Optional: true,
Default: string(natgateways.NatGatewaySkuNameStandard),
ValidateFunc: validation.StringInSlice(natgateways.PossibleValuesForNatGatewaySkuName(), false),
},

"zones": commonschema.ZonesMultipleOptionalForceNew(),
"zones": {
Type: schema.TypeSet,
Optional: true,
Computed: true,
Comment thread
WodansSon marked this conversation as resolved.
Outdated
Copy link
Copy Markdown
Collaborator

@sreallymatt sreallymatt Mar 20, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Making this O+C breaks the existing behaviour of replacing the resource when a user removes zones from their deployment (when sku is Standard). We should try to keep this behaviour intact and we could use a DiffSuppressFunc instead.

Additionally, O+C doesn't entirely resolve the zones diff, currently a user could specify zones for StandardV2 in config (e.g. zones = ["1"]) which would lead to a perpetual diff, we should prevent users from setting zones on StandardV2 with a CustomizeDiff

e.g.

DiffSuppress:

		DiffSuppressOnRefresh: true,
			DiffSuppressFunc: func(_, _, _ string, d *schema.ResourceData) bool {
				// when `sku_name` is `StandardV2`, Azure automatically spreads the deployment across all zones in the region
				return d.Get("sku_name").(string) == string(natgateways.NatGatewaySkuNameStandardVTwo)
			},

CustomizeDiff:

		CustomizeDiff: func(_ context.Context, diff *schema.ResourceDiff, _ interface{}) error {
			if diff.Get("sku_name").(string) == string(natgateways.NatGatewaySkuNameStandardVTwo) {
				if !diff.GetRawConfig().AsValueMap()["zones"].IsNull() {
					return fmt.Errorf("%s resources with `sku_name` set to `%s` are zone-redundant by default, Azure automatically deploys across all available zones. The `zones` argument must be omitted", natGatewayResourceName, natgateways.NatGatewaySkuNameStandardVTwo)
				}
			}

			return nil
		},

Copy link
Copy Markdown
Collaborator

@teowa teowa Mar 23, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Make sense, code updated.

ForceNew: true,
Elem: &schema.Schema{
Type: schema.TypeString,
ValidateFunc: validation.StringIsNotEmpty,
Comment thread
sreallymatt marked this conversation as resolved.
},
},

"resource_guid": {
Type: pluginsdk.TypeString,
Expand Down
36 changes: 36 additions & 0 deletions internal/services/network/nat_gateway_resource_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -75,6 +75,21 @@ func TestAccNatGateway_update(t *testing.T) {
})
}

func TestAccNatGateway_standardVTwo(t *testing.T) {
Comment thread
sreallymatt marked this conversation as resolved.
data := acceptance.BuildTestData(t, "azurerm_nat_gateway", "test")
r := NatGatewayResource{}

data.ResourceTest(t, r, []acceptance.TestStep{
{
Config: r.standardVTwo(data),
Check: acceptance.ComposeTestCheckFunc(
check.That(data.ResourceName).ExistsInAzure(r),
),
},
data.ImportStep(),
})
}

func (t NatGatewayResource) Exists(ctx context.Context, clients *clients.Client, state *pluginsdk.InstanceState) (*bool, error) {
id, err := natgateways.ParseNatGatewayID(state.ID)
if err != nil {
Expand Down Expand Up @@ -208,3 +223,24 @@ resource "azurerm_nat_gateway_public_ip_prefix_association" "test" {
}
`, data.RandomInteger, data.Locations.Primary, data.RandomInteger, data.RandomInteger, data.RandomInteger)
}

func (NatGatewayResource) standardVTwo(data acceptance.TestData) string {
return fmt.Sprintf(`
provider "azurerm" {
features {}
}

resource "azurerm_resource_group" "test" {
name = "acctestRG-network-%d"
location = "%s"
}

resource "azurerm_nat_gateway" "test" {
name = "acctestnatGateway-%d"
location = azurerm_resource_group.test.location
resource_group_name = azurerm_resource_group.test.name
sku_name = "StandardV2"
zones = ["1", "2", "3"]
Copy link
Copy Markdown
Collaborator

@gerrytan gerrytan Dec 3, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is specifying all zones required for StandardV2? If so please add a CustomizeDiff validator for this.

Refer to:

StandardV2 NAT Gateway is zone-redundant, meaning that it provides outbound connectivity from all zones in a region instead of a single zone like Standard NAT Gateway.

https://learn.microsoft.com/en-us/azure/nat-gateway/nat-overview

Copy link
Copy Markdown
Contributor Author

@neil-yechenwei neil-yechenwei Dec 4, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Reason1: I think we should not use a CustomizeDiff validator to force users to specify zones, because the API also allows it when users do not specify them.

Reason2: About ignoring zones, according to the previous recommendations provided by HC, when the configuration of property A affects other properties—for example, property B—the affected property B should be handled by the user in the Terraform configuration. This allows users to clearly understand that when property A is modified, property B will also be impacted, rather than suppressing the issue through changes in the provider, which could cause property B to change without the user being aware of it. This can prevent users from encountering unexpected behavior. So, I add the comment for it.

}
`, data.RandomInteger, data.Locations.Primary, data.RandomInteger)
}
Comment thread
sreallymatt marked this conversation as resolved.
12 changes: 5 additions & 7 deletions internal/services/network/public_ip_prefix_resource.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -65,13 +65,11 @@ func resourcePublicIpPrefix() *pluginsdk.Resource {
},

"sku": {
Type: pluginsdk.TypeString,
Optional: true,
ForceNew: true,
Default: string(publicipprefixes.PublicIPPrefixSkuNameStandard),
ValidateFunc: validation.StringInSlice([]string{
string(publicipprefixes.PublicIPPrefixSkuNameStandard),
}, false),
Type: pluginsdk.TypeString,
Optional: true,
ForceNew: true,
Default: string(publicipprefixes.PublicIPPrefixSkuNameStandard),
ValidateFunc: validation.StringInSlice(publicipprefixes.PossibleValuesForPublicIPPrefixSkuName(), false),
},

"sku_tier": {
Expand Down
1 change: 1 addition & 0 deletions internal/services/network/public_ip_prefix_resource_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -409,6 +409,7 @@ resource "azurerm_public_ip_prefix" "test" {
name = "acctestpublicipprefix-%d"
location = azurerm_resource_group.test.location
sku_tier = "%s"
sku = "StandardV2"
}
`, data.RandomInteger, data.Locations.Primary, data.RandomInteger, tier)
}
Expand Down
5 changes: 1 addition & 4 deletions internal/services/network/public_ip_resource.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -106,10 +106,7 @@ func resourcePublicIp() *pluginsdk.Resource {
ForceNew: true,
Default: string(publicipaddresses.PublicIPAddressSkuNameStandard),
// https://azure.microsoft.com/en-us/updates/upgrade-to-standard-sku-public-ip-addresses-in-azure-by-30-september-2025-basic-sku-will-be-retired/
Comment thread
sreallymatt marked this conversation as resolved.
ValidateFunc: validation.StringInSlice([]string{
string(publicipaddresses.PublicIPAddressSkuNameBasic),
string(publicipaddresses.PublicIPAddressSkuNameStandard),
}, false),
ValidateFunc: validation.StringInSlice(publicipaddresses.PossibleValuesForPublicIPAddressSkuName(), false),
Comment thread
sreallymatt marked this conversation as resolved.
},

"sku_tier": {
Expand Down
8 changes: 4 additions & 4 deletions internal/services/network/public_ip_resource_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -180,13 +180,13 @@ func TestAccPublicIpStatic_basic_withIPv4(t *testing.T) {
})
}

func TestAccPublicIpStatic_standard(t *testing.T) {
func TestAccPublicIpStatic_standardVTwo(t *testing.T) {
data := acceptance.BuildTestData(t, "azurerm_public_ip", "test")
r := PublicIPResource{}

data.ResourceTest(t, r, []acceptance.TestStep{
{
Config: r.standard(data),
Config: r.standardVTwo(data),
Check: acceptance.ComposeTestCheckFunc(
check.That(data.ResourceName).ExistsInAzure(r),
),
Expand Down Expand Up @@ -547,7 +547,7 @@ resource "azurerm_public_ip" "test" {
`, data.RandomInteger, data.Locations.Primary, data.RandomInteger, ipVersion)
}

func (PublicIPResource) standard(data acceptance.TestData) string {
func (PublicIPResource) standardVTwo(data acceptance.TestData) string {
return fmt.Sprintf(`
provider "azurerm" {
features {}
Expand All @@ -563,7 +563,7 @@ resource "azurerm_public_ip" "test" {
location = azurerm_resource_group.test.location
resource_group_name = azurerm_resource_group.test.name
allocation_method = "Static"
sku = "Standard"
sku = "StandardV2"
}
`, data.RandomInteger, data.Locations.Primary, data.RandomInteger)
}
Expand Down
4 changes: 3 additions & 1 deletion website/docs/r/nat_gateway.html.markdown
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,7 +41,9 @@ The following arguments are supported:

* `idle_timeout_in_minutes` - (Optional) The idle timeout which should be used in minutes. Defaults to `4`.

* `sku_name` - (Optional) The SKU which should be used. At this time the only supported value is `Standard`. Defaults to `Standard`.
* `sku_name` - (Optional) The SKU which should be used. Possible values are `Standard` and `StandardV2`. Defaults to `Standard`.

-> **Note:** `StandardV2` SKU requires `zones` to be set to `[1,2,3]`, see [MS learn documentation](https://learn.microsoft.com/en-us/azure/nat-gateway/nat-overview#standardv2-nat-gateway) for more info.

* `tags` - (Optional) A mapping of tags to assign to the resource.

Expand Down
4 changes: 3 additions & 1 deletion website/docs/r/public_ip.html.markdown
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -78,10 +78,12 @@ The following arguments are supported:

* `reverse_fqdn` - (Optional) A fully qualified domain name that resolves to this public IP address. If the reverseFqdn is specified, then a PTR DNS record is created pointing from the IP address in the in-addr.arpa domain to the reverse FQDN.

* `sku` - (Optional) The SKU of the Public IP. Accepted values are `Basic` and `Standard`. Defaults to `Standard`. Changing this forces a new resource to be created.
* `sku` - (Optional) The SKU of the Public IP. Possible values are `Basic`, `Standard` and `StandardV2`. Defaults to `Standard`. Changing this forces a new resource to be created.
Copy link
Copy Markdown
Collaborator

@WodansSon WodansSon Feb 6, 2026 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can we add the Oxford (serial) comma to the sku possible-values list to match documentation standards?

Suggested change
* `sku` - (Optional) The SKU of the Public IP. Possible values are `Basic`, `Standard` and `StandardV2`. Defaults to `Standard`. Changing this forces a new resource to be created.
* `sku` - (Optional) The SKU of the Public IP. Possible values are `Basic`, `Standard`, and `StandardV2`. Defaults to `Standard`. Changing this forces a new Public IP to be created.

NOTE: On line 3 of website/docs/r/public_ip_prefix.html.markdown can we make the documentation consistent by updating the note to reflect the newly-documented possible values? For example, replace the contradictory note line with one that includes StandardV2 so the docs don't contradict the argument's possible values(e.g., update **Note:** Public IP Prefix can only be created with Standard SKUs at this time. to be **Note:** Public IP Prefix can be created with the StandardandStandardV2 SKUs.)?

Reference: reference-documentation-standards

Copy link
Copy Markdown
Contributor Author

@neil-yechenwei neil-yechenwei Feb 9, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Updated


-> **Note:** Public IP Standard SKUs require `allocation_method` to be set to `Static`.

-> **Note:** `Basic` will be deprecated. [Read more](https://azure.microsoft.com/en-us/updates/upgrade-to-standard-sku-public-ip-addresses-in-azure-by-30-september-2025-basic-sku-will-be-retired/).
Copy link
Copy Markdown
Collaborator

@WodansSon WodansSon Feb 6, 2026 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can we update this to be more descriptive and correct the note format per the contributor guidelines?

Suggested change
-> **Note:** `Basic` will be deprecated. [Read more](https://azure.microsoft.com/en-us/updates/upgrade-to-standard-sku-public-ip-addresses-in-azure-by-30-september-2025-basic-sku-will-be-retired/).
!> **Note:** **On 30 September 2025, `Basic` SKU public IP addresses will be retired in Azure.** You can continue to use your existing `Basic` SKU public IP addresses until then, however, you will no longer be able to create new ones after 31 March 2025. Please see the Azure Update [retirement notification](https://azure.microsoft.com/updates/upgrade-to-standard-sku-public-ip-addresses-in-azure-by-30-september-2025-basic-sku-will-be-retired/) for more information.

Follow up question: Do we currently have acceptance test that currently use the Basic SKU? If so we should update those as well since they will begin to fail once the SKU is retired for creation (follow the pattern in the PR I referenced above which already accounts for this).

Reference: reference-documentation-standards

Copy link
Copy Markdown
Contributor Author

@neil-yechenwei neil-yechenwei Feb 9, 2026 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Updated. As the resource with Basic can still be created successfully, I didn't change the test case.

Copy link
Copy Markdown
Collaborator

@WodansSon WodansSon Feb 25, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That is fine that Basic will continue to work for existing resources, but we need to gate this correctly as I suggested.

Copy link
Copy Markdown
Collaborator

@teowa teowa Feb 25, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Will submit a follow-up PR that will prevent the creation of the basic SKU and either skip or migrate the acctests, since many other resource tests are also impacted.

Copy link
Copy Markdown
Collaborator

@teowa teowa Mar 4, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hi @WodansSon , PR #31885 was submitted to block creation of Basic sku public IP


* `sku_tier` - (Optional) The SKU Tier that should be used for the Public IP. Possible values are `Regional` and `Global`. Defaults to `Regional`. Changing this forces a new resource to be created.

-> **Note:** When `sku_tier` is set to `Global`, `sku` must be set to `Standard`.
Expand Down
2 changes: 1 addition & 1 deletion website/docs/r/public_ip_prefix.html.markdown
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,7 +45,7 @@ The following arguments are supported:

-> **Note:** When `ip_version` is set to `IPv6`, `custom_ip_prefix_id` must reference a regional (child) range rather than a global (parent) range. For more details on creating a Public IP Prefix from a custom IP prefix, see [here](https://learn.microsoft.com/en-us/azure/virtual-network/ip-services/manage-custom-ip-address-prefix#create-a-public-ip-prefix-from-a-custom-ip-prefix).

* `sku` - (Optional) The SKU of the Public IP Prefix. Accepted values are `Standard`. Defaults to `Standard`. Changing this forces a new resource to be created.
* `sku` - (Optional) The SKU of the Public IP Prefix. Possible values are `Standard` and `StandardV2`. Defaults to `Standard`. Changing this forces a new resource to be created.

-> **Note:** Public IP Prefix can only be created with Standard SKUs at this time.

Expand Down
Loading