Skip to content

azurerm_firewall_policy_rule_collection_group - fix timeout expiring while waiting for policy lock #32081

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
sanderaernouts wants to merge 1 commit into from
Closed

azurerm_firewall_policy_rule_collection_group - fix timeout expiring while waiting for policy lock #32081

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 17 additions & 7 deletions internal/services/firewall/firewall_policy_rule_collection_group_resource.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -460,8 +460,6 @@ func resourceFirewallPolicyRuleCollectionGroup() *pluginsdk.Resource {

func resourceFirewallPolicyRuleCollectionGroupCreateUpdate(d *pluginsdk.ResourceData, meta interface{}) error {
client := meta.(*clients.Client).Network.FirewallPolicyRuleCollectionGroups
ctx, cancel := timeouts.ForCreateUpdate(meta.(*clients.Client).StopContext, d)
defer cancel()

policyId, err := firewallpolicies.ParseFirewallPolicyID(d.Get("firewall_policy_id").(string))
if err != nil {
Expand All @@ -470,6 +468,16 @@ func resourceFirewallPolicyRuleCollectionGroupCreateUpdate(d *pluginsdk.Resource

id := firewallpolicyrulecollectiongroups.NewRuleCollectionGroupID(policyId.SubscriptionId, policyId.ResourceGroupName, policyId.FirewallPolicyName, d.Get("name").(string))

// NOTE: Acquire the lock before creating the timeout context. Azure enforces serial processing
// on firewall policy rule collection groups within the same policy, responding with 409
// AnotherOperationInProgress for concurrent requests. The timeout context must be created after
// the lock is acquired so that time spent waiting for the lock does not consume the timeout budget.
locks.ByName(policyId.FirewallPolicyName, AzureFirewallPolicyResourceName)
defer locks.UnlockByName(policyId.FirewallPolicyName, AzureFirewallPolicyResourceName)

ctx, cancel := timeouts.ForCreateUpdate(meta.(*clients.Client).StopContext, d)
defer cancel()

if d.IsNewResource() {
resp, err := client.Get(ctx, id)
if err != nil {
Expand All @@ -483,9 +491,6 @@ func resourceFirewallPolicyRuleCollectionGroupCreateUpdate(d *pluginsdk.Resource
}
}

locks.ByName(policyId.FirewallPolicyName, AzureFirewallPolicyResourceName)
defer locks.UnlockByName(policyId.FirewallPolicyName, AzureFirewallPolicyResourceName)

param := firewallpolicyrulecollectiongroups.FirewallPolicyRuleCollectionGroup{
Properties: &firewallpolicyrulecollectiongroups.FirewallPolicyRuleCollectionGroupProperties{
Priority: pointer.To(int64(d.Get("priority").(int))),
Expand Down Expand Up @@ -568,17 +573,22 @@ func resourceFirewallPolicyRuleCollectionGroupSetFlatten(d *pluginsdk.ResourceDa

func resourceFirewallPolicyRuleCollectionGroupDelete(d *pluginsdk.ResourceData, meta interface{}) error {
client := meta.(*clients.Client).Network.FirewallPolicyRuleCollectionGroups
ctx, cancel := timeouts.ForDelete(meta.(*clients.Client).StopContext, d)
defer cancel()

id, err := firewallpolicyrulecollectiongroups.ParseRuleCollectionGroupID(d.Id())
if err != nil {
return err
}

// NOTE: Acquire the lock before creating the timeout context. Azure enforces serial processing
// on firewall policy rule collection groups within the same policy, responding with 409
// AnotherOperationInProgress for concurrent requests. The timeout context must be created after
// the lock is acquired so that time spent waiting for the lock does not consume the timeout budget.
locks.ByName(id.FirewallPolicyName, AzureFirewallPolicyResourceName)
defer locks.UnlockByName(id.FirewallPolicyName, AzureFirewallPolicyResourceName)

ctx, cancel := timeouts.ForDelete(meta.(*clients.Client).StopContext, d)
defer cancel()

if err = client.DeleteThenPoll(ctx, *id); err != nil {
return fmt.Errorf("deleting %s: %+v", id, err)
}
Expand Down
Loading