chore(deps): update terraform azurerm to v4.61.0 by renovate[bot] · Pull Request #2197 · hmcts/azure-public-dns

renovate · 2025-09-22T07:00:23Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Type	Update	Change
azurerm (source)	required_provider	minor	`4.44.0` → `4.61.0`

Release Notes

hashicorp/terraform-provider-azurerm (azurerm)

`v4.61.0`

Compare Source

FEATURES:

New List Resource: azurerm_application_gateway (#31749)
New List Resource: azurerm_application_security_group (#31742)
New List Resource: azurerm_firewall and azurerm_firewall_policy (#31734)
New List Resource: azurerm_firewall_policy_rule_collection_group (#31741)
New List Resource: azurerm_ip_group (#31740)
New List Resource: azurerm_mssql_database (#31735)
New List Resource: azurerm_mssql_job_agent (#31738)
New List Resource: azurerm_mssql_server (#31650)
New List Resource: azurerm_nat_gatway (#31764)
New List Resource: azurerm_network_security_rule (#31748)
New List Resource: azurerm_public_ip (#31762)
New List Resource: azurerm_web_application_firewall_policy (#31758)

ENHANCEMENTS:

dependencies: go update to 1.25.5
dependencies: go-azure-sdk - update to v0.20260212.1143955
azurerm_managed_redis - sku_name can now be updated (#31203)
azurerm_managed_redis - default_database must be specified when creating a new resource (#31724)
azurerm_point_to_site_vpn_gateway - connection_configuration.x.internet_security_enabled can now be updated (#31733)
azurerm_security_center_storage_defender - update to API version 2025-06-01 (#31759)

BUG FIXES:

azurerm_managed_redis_geo_replication - fix an issue that prevented linking 3 or more clusters (#31385)
azurerm_signalr_service - fix setting default values into state, preventing diffs on import for connectivity_logs_enabled, http_request_logs_enabled, and messaging_logs_enabled (#31566)

`v4.60.0`

Compare Source

FEATURES:

New Data Source: azurerm_cognitive_account_project (#31605)
New Data Source: azurerm_managed_redis_access_policy_assignment (#30980)
New Data Source: azurerm_oracle_database_system_versions (#31001)
New Resource: azurerm_api_management_workspace_named_value (#31299)
New List Resource: azurerm_cognitive_account (#31624)
New Resource: azurerm_data_factory_linked_service_sql_managed_instance (#30896)
New Resource: azurerm_managed_redis_access_policy_assignment (#30980)
New List Resource: azurerm_mysql_flexible_database, azurerm_mysql_flexible_server_firewall_rule, azurerm_mysql_flexible_server_configuration - includes addition of Identity (#31646) (#31646)
New List Resource: azurerm_service_plan (#31610)

ENHANCEMENTS:

dependencies: containerinstance - update to API version 2025-09-01 (#31640)
dependencies: storagemover - update to API version 2025-07-01 (#31587)
Data Source: azurerm_container_app - add support for the read_secrets property allowing users to skip secret retrieval that may trigger authorization errors (#31199)
azurerm_application_gateway - add support for 2.2 to waf_configuration.rule_set_version (#31674)
azurerm_application_gateway - add support for MS-ThreatIntel-XSS to waf_configuration.disabled_rule_group.rule_group_name (#31674)
azurerm_express_route_port - add support for GcmAesXpn128 and GcmAesXpn256 ciphers to link*.macsec_cipher (#30240)
azurerm_postgresql_flexible_server - add support for cluster (#31315)
azurerm_web_application_firewall_policy - add support for 2.2 to managed_rules.managed_rule_set.version and managed_rules.exclusion.excluded_rule_set.version (#31674)
azurerm_web_application_firewall_policy - add support for MS-ThreatIntel-XSS to managed_rules.managed_rule_set.rule_group_override.rule_group_name and managed_rules.exclusion.excluded_rule_set.rule_group.rule_group_name (#31674)
provider: the subscription_id property can now be populated based on the az CLI (#30251)

BUG FIXES:

azurerm_express_route_port - fix an issue that caused identity to be removed when updating unrelated properties (#30240)
azurerm_federated_identity_credential - the id is now built using the resource group name segment from the parent_id preventing unexpected 404 statuses (#30860)
azurerm_kubernetes_cluster - fixed capacity_reservation_group_id loss during node pool cycling (#30654)
azurerm_monitor_aad_diagnostic_setting - add polling as a workaround to an eventual consistency issue (#31123)
list.azurerm_private_dns_zone - fix context handling resolving an issue where this list resources never returned results (#31719)

`v4.59.0`

Compare Source

ENHANCEMENTS:

dependencies: go-azure-sdk - update to v0.20260129.1200123 (#31621)
azurerm_automation_runbook - add support for the runtime_environment_name property (#30992)
azurerm_kusto_eventgrid_data_connection - update validation for eventhub_consumer_group_name to allow $Default as input (#31551)
azurerm_linux_function_app - add support for 3.14 to site_config.application_stack.python_version (#31195)
azurerm_linux_function_app_slot - add support for 3.14 to site_config.application_stack.python_version (#31195)
azurerm_netapp_volume_group_sap_hana_resource - add support for zone, encryption_key_source, key_vault_private_endpoint_id, and network_features (#31603)
azurerm_user_assigned_identity - add support for the isolation_scope property (#31216)

BUG FIXES:

azurerm_kubernetes_cluster - thenetwork_policy property now allows updating from calico to cilium (#31627)
azurerm_logic_app_trigger_http_request - fix an issue that prevented importing existing resources due to empty trigger inputs (#31433)
azurerm_mssql_database - fix validation for min_capacity and auto_pause_delay_in_minutes (#31690)

`v4.58.0`

Compare Source

FEATURES:

New Data Source: azurerm_network_security_perimeter (#31356)
New Data Source: azurerm_network_security_perimeter_profile (#31356)
New Resource: azurerm_network_security_perimeter (#31356)
New Resource: azurerm_network_security_perimeter_access_rule (#31356)
New Resource: azurerm_network_security_perimeter_association (#31356)
New Resource: azurerm_network_security_perimeter_profile (#31356)
New List Resource: azurerm_resource_group (#31270)

ENHANCEMENTS:

dependencies: go-azure-sdk - update to v0.20251219.1184026 (#31397)
azurerm_backup_policy_file_share - add support for backup_tier and snapshot_retention_in_days (#29243)
azurerm_cosmosdb_cassandra_cluster - version now supports 4.1 and 5.0 (#31424)
azurerm_function_app_flex_consumption - the maximum_instance_count property now allows values from 1 - 1000 (#31392)
azurerm_kubernetes_cluster - network_data_plane and network_policy now support updating to cilium (#30958)
azurerm_kusto_eventhub_data_connection - add support for retrieval_start_date (#31445)
azurerm_kusto_iothub_data_connection - add support for retrieval_start_date (#31413)
azurerm_kusto_script - add support for script_level and principal_permissions_action (#31403)
azurerm_linux_function_app - add support for 24 to site_config.application_stack.node_version (#31098)
azurerm_linux_function_app_slot - add support for 24 to site_config.application_stack.node_version (#31098)
azurerm_linux_web_app - add support for 24-lts to site_config.application_stack.node_version (#31098)
azurerm_linux_web_app_slot - add support for 24-lts to site_config.application_stack.node_version (#31098)
azurerm_mssql_managed_instance - increase storage_size_in_gb maximum to 32768 (#31387)
azurerm_netapp_volume_group_oracle - service_level now supports Flexible (#31508)
azurerm_netapp_volume_group_sap_hana - service_level now supports Flexible (#31508)
azurerm_network_manager_routing_configuration - add support for the route_table_usage_mode property (#31463)
azurerm_windows_function_app - add support for ~24 to site_config.application_stack.node_version (#31248)
azurerm_windows_function_app_slot - add support for ~24 to site_config.application_stack.node_version (#31248)
data.azurerm_container_registry - admin_password is now sensitive (#31428)

BUG FIXES:

azurerm_api_management - fix an issue that prevented updates to hostname_configuration.*.key_vault_certificate_id (#31534)
azurerm_api_management_custom_domain - fix an issue that prevented updates to [management|portal|developer_portal|scm|gateway].key_vault_certificate_id (#31534)
azurerm_container_app_custom_domain - no longer error during read when container app is deleted outside of Terraform (#31523)
azurerm_databricks_workspace - removed a legacy workaround that prevented apply operations from succeeding when managed_disk_cmk_rotation_to_latest_version_enabled and tags were updated simultaneously (#31509)
azurerm_storage_account - can now update a Storage Standard ZRS account (#31431)
clients - fix correlation id across many clients (#31368)

`v4.57.0`

Compare Source

NOTE: This release removes the Mobile Network (azurerm_mobile_network*) resources and data sources due to Azure having retired the service

FEATURES:

New Resource: azurerm_automation_runtime_environment (#30991)

ENHANCEMENTS:

azurerm_data_protection_backup_vault_customer_managed_key - the key_vault_key_id property now supports keys from a Managed HSM vault (#31365)
azurerm_kubernetes_cluster - support for the node_provisioning_profile block (#30517)
azurerm_log_analytics_cluster_customer_managed_key - the key_vault_key_id property now supports keys from a Managed HSM vault (#31375)
azurerm_mssql_database - the transparent_data_encryption_key_vault_key_id property now supports keys from a Managed HSM vault (#31373)

BUG FIXES:

azurerm_data_factory - fix ID parsing errors when customer_managed_key_identity_id is an empty string (#28621)
azurerm_eventhub - partition_count can now be updated for dedicated clusters (#30993)
azurerm_linux_function_app - fix panic when deployed without all required permissions (#31344)

`v4.56.0`

Compare Source

ENHANCEMENTS:

dependencies: healthbot - update to API version 2025-05-25 (#31328)
dependencies: terraform-plugin-testing - update to v1.14.0 (#31334)
Data Source: azurerm_cognitive_account - add support for new attributes (#30778)
azurerm_cognitive_account - add support for the kind property to rollback or upgrade from OpenAI to AIServices (#31063)
azurerm_databricks_workspace_root_dbfs_customer_managed_key - the key_vault_key_id property now supports keys from Managed HSM Vaults (#31336)
azurerm_databricks_workspace_root_dbfs_customer_managed_key - the key_vault_key_id property now supports versionless keys (#31336)
azurerm_healthbot - add support for the C1 and PES SKUs (#31328)
azurerm_lb fix ignore_changes behaviour in updatable properties (#31318)
azurerm_network_manager_network_group - add support for the member_type property [GH-30672
azurerm_network_manager_static_member - add support for using a subnet as the target resource (#30672)
azurerm_virtual_network_gateway - add support for the ErGwScale SKU (#31082)

BUG FIXES:

azurerm_container_app_environment_certificate - fix an issue that prevented creating the resource with an empty value for certificate_password (#31335)
azurerm_databricks_workspace_root_dbfs_customer_managed_key - fix a panic that occurred when the customer managed key was removed from the workspace outside of Terraform (#31336)
azurerm_databricks_workspace_root_dbfs_customer_managed_key - fix the timeout for the delete operation (#31336)
azurerm_storage_blob_inventory_policy - fix setting Resource Identity data (#31313)

`v4.55.0`

Compare Source

FEATURES:

New Data Source: azurerm_api_management_workspace (#30241)
New Resource: azurerm_cognitive_account_project (#30916)
New Resource: azurerm_log_analytics_workspace_table_custom_log (#30800)
New Resource: azurerm_mongo_cluster_user (#31205)
New Resource: azurerm_palo_alto_next_generation_firewall_virtual_hub_strata_cloud_manager (#30613)
New Resource: azurerm_palo_alto_next_generation_firewall_virtual_network_strata_cloud_manager (#30613)
New List Resource: azurerm_private_dns_zone (#31157)

ENHANCEMENTS:

dependencies: containerregistry - update to API version 2025-04-01 (#30205)
dependencies: go-azure-helpers - update to v0.75.1 (#31148)
dependencies: go-azure-sdk - update to v0.20251202.1181053 (#31253)
dependencies: managedidentity - upgrade API version to 2024-11-30 (#30535)
dependencies: postgres - update to API version 2025-08-01 (#31162)
azurerm_cognitive_account - update validation for customer_managed_key.key_vault_key_id to allow managed HSM keys as input (#31147)
azurerm_container_app_environment - extend validation for workload_profile_type for additional supported SKUs (#30738)
azurerm_container_app_environment_certificate - add support for the certificate_key_vault block (#30510)
azurerm_data_factory - update validation for customer_managed_key_id to allow managed HSM keys as input (#31146)
azurerm_mongo_cluster - support for new properties customer_managed_key, data_api_mode_enabled, identity, restore, authentication_methods and storage_type (#31100)
azurerm_mysql_flexible_server - add support for MySQL version 8.4 (#31099)
azurerm_oracle_autonomous_database - the admin_password property is no longer ForceNew (#30966)
azurerm_postgresql_flexible_server - update validation for customer_managed_key.key_vault_key_id and customer_managed_key.geo_backup_key_vault_key_id to allow managed HSM keys as input (#31148)
azurerm_postgresql_flexible_server - add support for PostgreSQL version 18 (#31162)
azurerm_storage_encryption_scope - update validation for key_vault_key_id to allow managed HSM keys as input (#31145)

BUG FIXES:

Data Source: azurerm_ssh_public_key - fix normalisation for public_key to avoid removing a literal EOT from the base64 encoded content (#31249)
azurerm_data_protection_backup_vault - poll delete request for completion (#31202)
azurerm_function_app_hybrid_connection - remove validation preventing resource import when using an elastic service plan SKU (#31134)
azurerm_key_vault_key - not_before_date and expiration_date are now set into state when empty, fixing an issue where drift was not detected (#31192)
azurerm_key_vault_secret - not_before_date and expiration_date are now set into state when empty, fixing an issue where drift was not detected (#31192)
azurerm_kubernetes_cluster - fix drift on azure_policy_enabled when updating cluster (#30917)
azurerm_kubernetes_fleet_update_run - fix a nil pointer dereference to prevent panics (#31213)
azurerm_lb_nat_rule - fix an issue that prevented changing floating_ip_enabled and tcp_reset_enabled from true to false (#31244)
azurerm_lb_outbound_rule - fix an issue that prevented changing tcp_reset_enabled from true to false (#31244)
azurerm_lb_rule - fix an issue that prevented changing floating_ip_enabled and tcp_reset_enabled from true to false (#31244)
azurerm_private_endpoint - ensure Resource Identity data is set on create to avoid Missing Resource Identity After Create errors (#31246)
azurerm_resource_group - fix poller for the prevent_deletion_if_contains_resources feature, resolving an Azure eventual consistency issue (#31253)
azurerm_storage_account - ensure Resource Identity data is set on create to avoid Missing Resource Identity After Create errors (#31246)
azurerm_traffic_manager_profile - fix an issue that prevented changing traffic_view_enabled from true to false (#31066)

`v4.54.0`

Compare Source

FEATURES:

New Action: azurerm_cdn_front_door_cache_purge (#30765)
New Action: azurerm_data_protection_backup_instance_protect (#31085)
New Action: azurerm_managed_redis_databases_flush (#31132)
New Action: azurerm_mssql_execute_job (#31095)
New List Resource: azurerm_network_interface (#31012)
New List Resource: azurerm_network_profile (#31127)
New List Resource: azurerm_network_security_group (#31014)
New List Resource: azurerm_route_table (#31015)

ENHANCEMENTS:

dependencies: go-azure-sdk - update to v0.20251107.1191907 (#31095)
Data Source: azurerm_container_app - add support for the template.cooldown_period_in_seconds and template.polling_interval_in_seconds properties (#29426)
azurerm_container_app - add support for the template.cooldown_period_in_seconds and template.polling_interval_in_seconds properties (#29426)
azurerm_linux_function_app - add support for dotnet_version 10.0 (#31007)
azurerm_linux_function_app_slot - add support for dotnet_version 10.0 (#31007)
azurerm_linux_web_app - add support for dotnet_version 10.0 (#31007)
azurerm_linux_web_app_slot - add support for dotnet_version 10.0 (#31007)
azurerm_managed_redis - add support for persistence_append_only_file_backup_frequency and persistence_redis_database_backup_frequency properties (#30964)
azurerm_resource_group - refactored from legacy SDK to use go-azure-sdk (#30616)
azurerm_service_plan - suppress casing difference on sku_name (#30907)
azurerm_storage_share_directory - Deprecate storage_share_id in favour of storage_share_url (#28457)
azurerm_storage_share_file - Deprecate storage_share_id in favour of storage_share_url (#28457)
azurerm_windows_function_app - add support for dotnet_version v10.0 (#31007)
azurerm_windows_function_app_slot - add support for dotnet_version v10.0 (#31007)
azurerm_windows_web_app - add support for dotnet_version v10.0 (#31007)
azurerm_windows_web_app_slot - add support for dotnet_version v10.0 (#31007)

BUG FIXES:

azurerm_orchestrated_virtual_machine_scale_set - Fix issue when using a specialized image (#30889)
azurerm_virtual_network - remove RO values from update to avoid issues with API payload size limitation (#30945)

`v4.53.0`

Compare Source

FEATURES:

New Resource: azurerm_api_management_workspace_certificate (#30628)
New Resource: azurerm_mongo_cluster_firewall_rule (#31062)

ENHANCEMENTS:

dependencies: automation - update to API version 2024-10-23 (#30890)
dependencies: go-azure-sdk - update to v0.20251029.1173336 (#31051)
dependencies: managedredis - update to API Version 2025-07-01 (#31051)
dependencies: mongocluster - update to API version 2025-09-01 (#30982)
azurerm_api_management_backend - add support for the circuit_breaker_rule block (#30471)
azurerm_dynatrace_monitor - support for the YEARLY value in the billing_cycle property (#31078)
azurerm_kubernetes_cluster_node_pool - support for the undrainable_node_behavior and max_unavailable properties (#30563)
azurerm_managed_disk - support expanding Ultra Disks and Premium SSD v2 disk without downtime (#30593)
azurerm_managed_redis - add support for public_network_access (#31051)
azurerm_storage_table_entity - resource is now removed from state if it no longer exists in Azure (#31064)
azurerm_synapse_spark_pool - add support for spark_version 3.5 (#30900)
data.azurerm_postgresql_flexible_server - add support for zone and high_availability (#31034)

BUG FIXES:

azurerm_dynatrace_monitor - the phone_number and country properties are no longer Required (#31077)
azurerm_dynatrace_tag_rules - the log_rule.filtering_tag property is no longer required (#31065)
azurerm_dynatrace_tag_rules - the metric_rule.filtering_tag property is no longer required (#31065)
azurerm_kubernetes_cluster - fix crash in use of azure_active_directory_role_based_access_control (#31101)
azurerm_logic_app_workflow - fix inaccurate error messages (#30963)
azurerm_virtual_network_gateway - fix validation for policy_group.name and vpn_client_configuration.virtual_network_gateway_client_connection.policy_group_names (#30454)

`v4.52.0`

Compare Source

NOTE: This release removes the azurerm_spatial_anchors_account resource and data source due to Azure having retired the service

FEATURES:

New Resource: azurerm_api_management_workspace_api_version_set (#30498)

ENHANCEMENTS:

dependencies: Go updated to v1.25.3 (#31020)
Data Source: azurerm_application_gateway - add support for the backend_http_settings.dedicated_backend_connection_enabled property (#31033)
azurerm_application_gateway - add support for the backend_http_settings.dedicated_backend_connection_enabled property (#31033)
azurerm_machine_learning_datastore_blobstorage - improve validation for storage_container_id (#31002)
azurerm_machine_learning_datastore_datalake_gen2 - improve validation for storage_container_id (#31002)
azurerm_windows_web_app - add support for the virtual_network_image_pull_enabled property (#30920)
azurerm_windows_web_app_slot - add support for the virtual_network_image_pull_enabled property (#30920)

BUG FIXES:

azurerm_container_registry_task - prevent a panic by adding a nil check (#31043)

`v4.51.0`

Compare Source

FEATURES:

New Data Source: azurerm_oracle_resource_anchor (#30823)
New Resource: azurerm_network_manager_routing_rule (#30439)
New Resource: azurerm_oracle_resource_anchor (#30823)

ENHANCEMENTS:

dependencies: dashboard - update to API version 2025-08-01 (#30972)
dependencies: go-azure-sdk - update to v0.20251024.1223440 (#30952)
dependencies: network - update to API version 2025-01-01 (#30904)
azurerm_cognitive_account - add TextAnalytics to allowed kind validation for network_acls.bypass (#30887)
azurerm_subnet_service_endpoint_storage_policy - add support for the /services/Azure/Databricks value in the definition.service_resources property (#30762)

BUG FIXES:

Data Source: azurerm_managed_redis - fix a panic caused by a nested field access on a pointer without nil checking (#30978)

`v4.50.0`

Compare Source

FEATURES:

New Data Source: azurerm_managed_redis (#30060)
New Resource: azurerm_managed_redis (#30060)
New Resource: azurerm_managed_redis_geo_replication (#30060)

ENHANCEMENTS:

dependencies: go-azure-sdk update to v0.20251016.1163854 (#30883)
dependencies: oracle - update to API version 2025-09-01 (#30796)
Data Source: azurerm_container_app_environment - add support for the public_network_access property (#30817)
azurerm_container_app_environment - add support for the public_network_access property (#30817)
azurerm_mssql_job_target_group - the job_target.job_credential_id property is no longer required when database_name is not set to allow for authentication using a managed identity (#30898)
azurerm_netapp_volume_resource - support for Cross Zone Region replication through the data_protection_replication block (#30872)
azurerm_search_service - implement plan time error when local_authentication_enabled = false and authentication_failure_mode is set (#30882)

BUG FIXES:

azurerm_mssql_database - allow existing zero or null value for auto_pause_delay_in_minutes and min_capacity of non-serverless database (#30924)

`v4.49.0`

Compare Source

FEATURES:

New Data Source: azurerm_graph_services_account (#30697)
New Data Source: azurerm_oracle_exascale_database_storage_vault (#30043)
New Resource: azurerm_api_management_workspace_policy_fragment (#30678)
New Resource: azurerm_oracle_exascale_database_storage_vault (#30043)

ENHANCEMENTS:

Data Source: azurerm_data_protection_backup_vault - add support for the identity.identity_ids property (#29061)
azurerm_consumption_budget_management_group - remove the maximum count validation for the notification block (#29200)
azurerm_consumption_budget_resource_group - remove the maximum count validation for the notification block (#29200)
azurerm_consumption_budget_subscription - remove the maximum count validation for the notification block (#29200)
azurerm_data_protection_backup_vault - add support for the identity.identity_ids property (#29061)
azurerm_data_protection_backup_vault - add support for UserAssigned and SystemAssigned, UserAssigned values to the identity.type property (#29061)
azurerm_monitor_data_collection_rule - improve validation for data_sources.*.name (#30851)
azurerm_search_service - support upgrading the sku based on tier (#30842)
azurerm_storage_queue - support migrating from storage_account_name to storage_account_id (#30836)

BUG FIXES:

azurerm_application_insights - fix an issue that caused tags to be removed when other properties were updated (#30758)
azurerm_container_registry - fix the name length validation to allow 50 rather than 49 (#30858)
azurerm_function_app_flex_consumption - the auth_settings block contents are now set into state when auth_settings.enabled is set to false (#30781)
azurerm_linux_function_app - the auth_settings block contents are now set into state when auth_settings.enabled is set to false (#30781)
azurerm_linux_function_app_slot - the auth_settings block contents are now set into state when auth_settings.enabled is set to false (#30781)
azurerm_linux_web_app - the auth_settings block contents are now set into state when auth_settings.enabled is set to false (#30781)
azurerm_linux_web_app_slot - the auth_settings block contents are now set into state when auth_settings.enabled is set to false (#30781)
azurerm_mssql_database - fix validation for min_capacity and auto_pause_delay_in_minutes being set on non-serverless SKUs (#30856)
azurerm_signalr_service_custom_certificate - remove unnecessary API requests and checks that could lead to a panic (#30412)
azurerm_windows_function_app - the auth_settings block contents are now set into state when auth_settings.enabled is set to false (#30781)
azurerm_windows_function_app_slot - the auth_settings block contents are now set into state when auth_settings.enabled is set to false (#30781)
azurerm_windows_web_app - the auth_settings block contents are now set into state when auth_settings.enabled is set to false (#30781)
azurerm_windows_web_app_slot - the auth_settings block contents are now set into state when auth_settings.enabled is set to false (#30781)

`v4.48.0`

Compare Source

FEATURES:

New Data Source: azurerm_oracle_autonomous_database_clone_from_backup (#29633)
New Data Source: azurerm_oracle_autonomous_database_clone_from_database (#29633)
New Resource: azurerm_oracle_autonomous_database_clone_from_backup (#29633)
New Resource: azurerm_oracle_autonomous_database_clone_from_database (#29633)

ENHANCEMENTS:

dependencies: containerapps - update to API version 2025-07-01 (#30801)
dependencies: containerservice - update to API version 2025-07-01 (#30719)
dependencies: go-azure-sdk - update to v0.20251007.1195632 (#30799)
dependencies: guestconfiguration - update to API version 2024-04-05 (#30642)
dependencies: search - update to API version 2025-05-01 (#30314)
azurerm_kubernetes_cluster - add support for AzureLinux3 and Ubuntu2204 to the default_node_pool.os_sku property (#30719)
azurerm_kubernetes_cluster - add support for the ai_toolchain_operator_enabled property (#30713)
azurerm_kubernetes_cluster_node_pool - add support for AzureLinux3 and Ubuntu2204 to the os_sku property (#30719)
azurerm_linux_virtual_machine_scale_set - add support for the resilient_vm_creation_enabled and resilient_vm_deletion_enabled properties (#30204)
azurerm_network_watcher_flow_log - changing the target_resource_id property no longer forces the resource to be replaced (#30776)
azurerm_notification_hub_namespace - add support for replication_region and zone_redundancy_enabled (#30531)
azurerm_windows_virtual_machine_scale_set - add support for the resilient_vm_creation_enabled and resilient_vm_deletion_enabled properties (#30204)

BUG FIXES:

azurerm_eventhub_namespace - maximum_throughput_units can be set to 0 when auto_inflate_enabled is disabled (#30777)
azurerm_log_analytics_workspace - fix the default value for local_authentication_enabled (#30759)
azurerm_mssql_database - add validation to ensure that min_capacity and auto_pause_delay_in_minutes can only be set on serverless dbs (#30790)
azurerm_mssql_server - the azuread_administrator block now updates in place rather than being deleted/recreated (#30742)
azurerm_network_watcher_flow_log - the target_resource_id property is now included in the update request payload resolving an issue where changing it failed to recreate or update the resource (#30776)
azurerm_pim_eligible_role_assignment - improve filter used during List requests to prevent timeouts (#30705)
azurerm_postgresql_flexible_server_virtual_endpoint - fix read error when in replica set in failover state (#30789)

`v4.47.0`

Compare Source

FEATURES:

New Resource: azurerm_api_management_workspace_policy (#30547)

ENHANCEMENTS:

dependencies: go-azure-sdk - update to v0.20250924.1155608 (#30693)
azurerm_cognitive_account - add support for value AIServices to kind property ([#30423](https://redirect.github.com/hashicorp/

Configuration

📅 Schedule: Branch creation - "after 7am and before 11am every weekday" in timezone Europe/London, Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

hmcts-platform-operations · 2025-09-22T07:03:15Z

Plan Result (278: Sandbox - TerraformPlanApply)

⚠️ Resource Deletion will happen

This plan contains resource delete operation. Please check the plan result very carefully!

Plan: 4 to add, 0 to change, 4 to destroy.

Replace
- module.public-dns.azurerm_dns_zone.zone
- module.public-dns.azurerm_role_assignment.dnszonecontributer
- module.sandbox-apps-hmcts.azurerm_dns_zone.zone
- module.sandbox-apps-hmcts.azurerm_role_assignment.dnszonecontributer

Change Result (Click me)

  # module.public-dns.azurerm_dns_zone.zone must be replaced
-/+ resource "azurerm_dns_zone" "zone" {
      ~ id                        = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/resourceGroups/reformMgmtRG/providers/Microsoft.Network/dnsZones/sandbox.platform.hmcts.net" -> (known after apply)
      ~ max_number_of_record_sets = 10000 -> (known after apply)
        name                      = "sandbox.platform.hmcts.net"
      ~ name_servers              = [
          - "ns1-05.azure-dns.com.",
          - "ns2-05.azure-dns.net.",
          - "ns3-05.azure-dns.org.",
          - "ns4-05.azure-dns.info.",
        ] -> (known after apply)
      ~ number_of_record_sets     = 130 -> (known after apply)
      ~ resource_group_name       = "reformMgmtRG" -> "reformmgmtrg" # forces replacement
      - tags                      = {} -> null

      ~ soa_record (known after apply)
      - soa_record {
          - email         = "azuredns-hostmaster.microsoft.com" -> null
          - expire_time   = 2419200 -> null
          - fqdn          = "sandbox.platform.hmcts.net." -> null
          - host_name     = "ns1-05.azure-dns.com." -> null
          - minimum_ttl   = 300 -> null
          - refresh_time  = 3600 -> null
          - retry_time    = 300 -> null
          - serial_number = 1 -> null
          - tags          = {} -> null
          - ttl           = 3600 -> null
        }
    }

  # module.public-dns.azurerm_role_assignment.dnszonecontributer must be replaced
-/+ resource "azurerm_role_assignment" "dnszonecontributer" {
      + condition_version                      = (known after apply)
      ~ id                                     = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/resourceGroups/reformMgmtRG/providers/Microsoft.Network/dnsZones/sandbox.platform.hmcts.net/providers/Microsoft.Authorization/roleAssignments/3e38b707-4fc2-2aa8-3646-660f5a2a7c3c" -> (known after apply)
      ~ name                                   = "3e38b707-4fc2-2aa8-3646-660f5a2a7c3c" -> (known after apply)
      ~ principal_type                         = "Group" -> (known after apply)
      ~ role_definition_id                     = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/providers/Microsoft.Authorization/roleDefinitions/befefa01-2a29-4197-83a8-272ff33ce314" -> (known after apply)
      ~ scope                                  = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/resourceGroups/reformMgmtRG/providers/Microsoft.Network/dnsZones/sandbox.platform.hmcts.net" -> (known after apply) # forces replacement
      + skip_service_principal_aad_check       = (known after apply)
        # (5 unchanged attributes hidden)
    }

  # module.sandbox-apps-hmcts.azurerm_dns_zone.zone must be replaced
-/+ resource "azurerm_dns_zone" "zone" {
      ~ id                        = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/resourceGroups/reformMgmtRG/providers/Microsoft.Network/dnsZones/sandbox.apps.hmcts.net" -> (known after apply)
      ~ max_number_of_record_sets = 10000 -> (known after apply)
        name                      = "sandbox.apps.hmcts.net"
      ~ name_servers              = [
          - "ns1-07.azure-dns.com.",
          - "ns2-07.azure-dns.net.",
          - "ns3-07.azure-dns.org.",
          - "ns4-07.azure-dns.info.",
        ] -> (known after apply)
      ~ number_of_record_sets     = 11 -> (known after apply)
      ~ resource_group_name       = "reformMgmtRG" -> "reformmgmtrg" # forces replacement
      - tags                      = {} -> null

      ~ soa_record (known after apply)
      - soa_record {
          - email         = "azuredns-hostmaster.microsoft.com" -> null
          - expire_time   = 2419200 -> null
          - fqdn          = "sandbox.apps.hmcts.net." -> null
          - host_name     = "ns1-07.azure-dns.com." -> null
          - minimum_ttl   = 300 -> null
          - refresh_time  = 3600 -> null
          - retry_time    = 300 -> null
          - serial_number = 1 -> null
          - tags          = {} -> null
          - ttl           = 3600 -> null
        }
    }

  # module.sandbox-apps-hmcts.azurerm_role_assignment.dnszonecontributer must be replaced
-/+ resource "azurerm_role_assignment" "dnszonecontributer" {
      + condition_version                      = (known after apply)
      ~ id                                     = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/resourceGroups/reformMgmtRG/providers/Microsoft.Network/dnsZones/sandbox.apps.hmcts.net/providers/Microsoft.Authorization/roleAssignments/9474c9c0-3ebd-bc97-1752-29bcf6fb83a6" -> (known after apply)
      ~ name                                   = "9474c9c0-3ebd-bc97-1752-29bcf6fb83a6" -> (known after apply)
      ~ principal_type                         = "Group" -> (known after apply)
      ~ role_definition_id                     = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/providers/Microsoft.Authorization/roleDefinitions/befefa01-2a29-4197-83a8-272ff33ce314" -> (known after apply)
      ~ scope                                  = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/resourceGroups/reformMgmtRG/providers/Microsoft.Network/dnsZones/sandbox.apps.hmcts.net" -> (known after apply) # forces replacement
      + skip_service_principal_aad_check       = (known after apply)
        # (5 unchanged attributes hidden)
    }

Plan: 4 to add, 0 to change, 4 to destroy.

hmcts-platform-operations · 2025-09-22T07:03:24Z

Plan Result (278: Staging - TerraformPlanApply)

⚠️ Resource Deletion will happen

This plan contains resource delete operation. Please check the plan result very carefully!

Plan: 22 to add, 0 to change, 22 to destroy.

Replace
- module.casetracker.azurerm_dns_zone.zone
- module.casetracker.azurerm_role_assignment.dnszonecontributer
- module.certificatedbailiffs.azurerm_dns_zone.zone
- module.certificatedbailiffs.azurerm_role_assignment.dnszonecontributer
- module.courtfines.azurerm_dns_zone.zone
- module.courtfines.azurerm_role_assignment.dnszonecontributer
- module.hearings.azurerm_dns_zone.zone
- module.hearings.azurerm_role_assignment.dnszonecontributer
- module.hearings-reform.azurerm_dns_zone.zone
- module.hearings-reform.azurerm_role_assignment.dnszonecontributer
- module.immigrationappealsonline.azurerm_dns_zone.zone
- module.immigrationappealsonline.azurerm_role_assignment.dnszonecontributer
- module.public-dns.azurerm_dns_zone.zone
- module.public-dns.azurerm_role_assignment.dnszonecontributer
- module.staging.azurerm_dns_zone.zone
- module.staging.azurerm_role_assignment.dnszonecontributer
- module.staging-apps-public-dns.azurerm_dns_zone.zone
- module.staging-apps-public-dns.azurerm_role_assignment.dnszonecontributer
- module.staging-internal.azurerm_dns_zone.zone
- module.staging-internal.azurerm_role_assignment.dnszonecontributer
- module.tribunalsdecisions.azurerm_dns_zone.zone
- module.tribunalsdecisions.azurerm_role_assignment.dnszonecontributer

Change Result (Click me)

  # module.casetracker.azurerm_dns_zone.zone must be replaced
-/+ resource "azurerm_dns_zone" "zone" {
      ~ id                        = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/resourceGroups/reformMgmtRG/providers/Microsoft.Network/dnsZones/staging.casetracker.justice.gov.uk" -> (known after apply)
      ~ max_number_of_record_sets = 10000 -> (known after apply)
        name                      = "staging.casetracker.justice.gov.uk"
      ~ name_servers              = [
          - "ns1-09.azure-dns.com.",
          - "ns2-09.azure-dns.net.",
          - "ns3-09.azure-dns.org.",
          - "ns4-09.azure-dns.info.",
        ] -> (known after apply)
      ~ number_of_record_sets     = 4 -> (known after apply)
      ~ resource_group_name       = "reformMgmtRG" -> "reformmgmtrg" # forces replacement
      - tags                      = {} -> null

      ~ soa_record (known after apply)
      - soa_record {
          - email         = "azuredns-hostmaster.microsoft.com" -> null
          - expire_time   = 2419200 -> null
          - fqdn          = "staging.casetracker.justice.gov.uk." -> null
          - host_name     = "ns1-09.azure-dns.com." -> null
          - minimum_ttl   = 300 -> null
          - refresh_time  = 3600 -> null
          - retry_time    = 300 -> null
          - serial_number = 1 -> null
          - tags          = {} -> null
          - ttl           = 3600 -> null
        }
    }

  # module.casetracker.azurerm_role_assignment.dnszonecontributer must be replaced
-/+ resource "azurerm_role_assignment" "dnszonecontributer" {
      + condition_version                      = (known after apply)
      ~ id                                     = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/resourceGroups/reformMgmtRG/providers/Microsoft.Network/dnsZones/staging.casetracker.justice.gov.uk/providers/Microsoft.Authorization/roleAssignments/71c1c121-80a5-b61e-3769-d95f182bdc73" -> (known after apply)
      ~ name                                   = "71c1c121-80a5-b61e-3769-d95f182bdc73" -> (known after apply)
      ~ principal_type                         = "Group" -> (known after apply)
      ~ role_definition_id                     = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/providers/Microsoft.Authorization/roleDefinitions/befefa01-2a29-4197-83a8-272ff33ce314" -> (known after apply)
      ~ scope                                  = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/resourceGroups/reformMgmtRG/providers/Microsoft.Network/dnsZones/staging.casetracker.justice.gov.uk" -> (known after apply) # forces replacement
      + skip_service_principal_aad_check       = (known after apply)
        # (5 unchanged attributes hidden)
    }

  # module.certificatedbailiffs.azurerm_dns_zone.zone must be replaced
-/+ resource "azurerm_dns_zone" "zone" {
      ~ id                        = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/resourceGroups/reformMgmtRG/providers/Microsoft.Network/dnsZones/staging.certificatedbailiffs.justice.gov.uk" -> (known after apply)
      ~ max_number_of_record_sets = 10000 -> (known after apply)
        name                      = "staging.certificatedbailiffs.justice.gov.uk"
      ~ name_servers              = [
          - "ns1-09.azure-dns.com.",
          - "ns2-09.azure-dns.net.",
          - "ns3-09.azure-dns.org.",
          - "ns4-09.azure-dns.info.",
        ] -> (known after apply)
      ~ number_of_record_sets     = 4 -> (known after apply)
      ~ resource_group_name       = "reformMgmtRG" -> "reformmgmtrg" # forces replacement
      - tags                      = {} -> null

      ~ soa_record (known after apply)
      - soa_record {
          - email         = "azuredns-hostmaster.microsoft.com" -> null
          - expire_time   = 2419200 -> null
          - fqdn          = "staging.certificatedbailiffs.justice.gov.uk." -> null
          - host_name     = "ns1-09.azure-dns.com." -> null
          - minimum_ttl   = 300 -> null
          - refresh_time  = 3600 -> null
          - retry_time    = 300 -> null
          - serial_number = 1 -> null
          - tags          = {} -> null
          - ttl           = 3600 -> null
        }
    }

  # module.certificatedbailiffs.azurerm_role_assignment.dnszonecontributer must be replaced
-/+ resource "azurerm_role_assignment" "dnszonecontributer" {
      + condition_version                      = (known after apply)
      ~ id                                     = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/resourceGroups/reformMgmtRG/providers/Microsoft.Network/dnsZones/staging.certificatedbailiffs.justice.gov.uk/providers/Microsoft.Authorization/roleAssignments/ab4537ce-aea8-f711-1fcc-c850022af050" -> (known after apply)
      ~ name                                   = "ab4537ce-aea8-f711-1fcc-c850022af050" -> (known after apply)
      ~ principal_type                         = "Group" -> (known after apply)
      ~ role_definition_id                     = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/providers/Microsoft.Authorization/roleDefinitions/befefa01-2a29-4197-83a8-272ff33ce314" -> (known after apply)
      ~ scope                                  = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/resourceGroups/reformMgmtRG/providers/Microsoft.Network/dnsZones/staging.certificatedbailiffs.justice.gov.uk" -> (known after apply) # forces replacement
      + skip_service_principal_aad_check       = (known after apply)
        # (5 unchanged attributes hidden)
    }

  # module.courtfines.azurerm_dns_zone.zone must be replaced
-/+ resource "azurerm_dns_zone" "zone" {
      ~ id                        = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/resourceGroups/reformMgmtRG/providers/Microsoft.Network/dnsZones/staging.courtfines.direct.gov.uk" -> (known after apply)
      ~ max_number_of_record_sets = 10000 -> (known after apply)
        name                      = "staging.courtfines.direct.gov.uk"
      ~ name_servers              = [
          - "ns1-02.azure-dns.com.",
          - "ns2-02.azure-dns.net.",
          - "ns3-02.azure-dns.org.",
          - "ns4-02.azure-dns.info.",
        ] -> (known after apply)
      ~ number_of_record_sets     = 4 -> (known after apply)
      ~ resource_group_name       = "reformMgmtRG" -> "reformmgmtrg" # forces replacement
      - tags                      = {} -> null

      ~ soa_record (known after apply)
      - soa_record {
          - email         = "azuredns-hostmaster.microsoft.com" -> null
          - expire_time   = 2419200 -> null
          - fqdn          = "staging.courtfines.direct.gov.uk." -> null
          - host_name     = "ns1-02.azure-dns.com." -> null
          - minimum_ttl   = 300 -> null
          - refresh_time  = 3600 -> null
          - retry_time    = 300 -> null
          - serial_number = 1 -> null
          - tags          = {} -> null
          - ttl           = 3600 -> null
        }
    }

  # module.courtfines.azurerm_role_assignment.dnszonecontributer must be replaced
-/+ resource "azurerm_role_assignment" "dnszonecontributer" {
      + condition_version                      = (known after apply)
      ~ id                                     = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/resourceGroups/reformMgmtRG/providers/Microsoft.Network/dnsZones/staging.courtfines.direct.gov.uk/providers/Microsoft.Authorization/roleAssignments/9ac8fea7-c2cd-ff41-2dd0-a8005fa701ff" -> (known after apply)
      ~ name                                   = "9ac8fea7-c2cd-ff41-2dd0-a8005fa701ff" -> (known after apply)
      ~ principal_type                         = "Group" -> (known after apply)
      ~ role_definition_id                     = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/providers/Microsoft.Authorization/roleDefinitions/befefa01-2a29-4197-83a8-272ff33ce314" -> (known after apply)
      ~ scope                                  = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/resourceGroups/reformMgmtRG/providers/Microsoft.Network/dnsZones/staging.courtfines.direct.gov.uk" -> (known after apply) # forces replacement
      + skip_service_principal_aad_check       = (known after apply)
        # (5 unchanged attributes hidden)
    }

  # module.hearings.azurerm_dns_zone.zone must be replaced
-/+ resource "azurerm_dns_zone" "zone" {
      ~ id                        = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/resourceGroups/reformMgmtRG/providers/Microsoft.Network/dnsZones/staging.hearings.hmcts.net" -> (known after apply)
      ~ max_number_of_record_sets = 10000 -> (known after apply)
        name                      = "staging.hearings.hmcts.net"
      ~ name_servers              = [
          - "ns1-05.azure-dns.com.",
          - "ns2-05.azure-dns.net.",
          - "ns3-05.azure-dns.org.",
          - "ns4-05.azure-dns.info.",
        ] -> (known after apply)
      ~ number_of_record_sets     = 8 -> (known after apply)
      ~ resource_group_name       = "reformMgmtRG" -> "reformmgmtrg" # forces replacement
      - tags                      = {} -> null

      ~ soa_record (known after apply)
      - soa_record {
          - email         = "azuredns-hostmaster.microsoft.com" -> null
          - expire_time   = 2419200 -> null
          - fqdn          = "staging.hearings.hmcts.net." -> null
          - host_name     = "ns1-05.azure-dns.com." -> null
          - minimum_ttl   = 300 -> null
          - refresh_time  = 3600 -> null
          - retry_time    = 300 -> null
          - serial_number = 1 -> null
          - tags          = {} -> null
          - ttl           = 3600 -> null
        }
    }

  # module.hearings.azurerm_role_assignment.dnszonecontributer must be replaced
-/+ resource "azurerm_role_assignment" "dnszonecontributer" {
      + condition_version                      = (known after apply)
      ~ id                                     = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/resourceGroups/reformMgmtRG/providers/Microsoft.Network/dnsZones/staging.hearings.hmcts.net/providers/Microsoft.Authorization/roleAssignments/bcf9fffc-6722-eef5-2faa-f3cf308155dd" -> (known after apply)
      ~ name                                   = "bcf9fffc-6722-eef5-2faa-f3cf308155dd" -> (known after apply)
      ~ principal_type                         = "Group" -> (known after apply)
      ~ role_definition_id                     = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/providers/Microsoft.Authorization/roleDefinitions/befefa01-2a29-4197-83a8-272ff33ce314" -> (known after apply)
      ~ scope                                  = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/resourceGroups/reformMgmtRG/providers/Microsoft.Network/dnsZones/staging.hearings.hmcts.net" -> (known after apply) # forces replacement
      + skip_service_principal_aad_check       = (known after apply)
        # (5 unchanged attributes hidden)
    }

  # module.hearings-reform.azurerm_dns_zone.zone must be replaced
-/+ resource "azurerm_dns_zone" "zone" {
      ~ id                        = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/resourceGroups/reformMgmtRG/providers/Microsoft.Network/dnsZones/staging.hearings.reform.hmcts.net" -> (known after apply)
      ~ max_number_of_record_sets = 10000 -> (known after apply)
        name                      = "staging.hearings.reform.hmcts.net"
      ~ name_servers              = [
          - "ns1-06.azure-dns.com.",
          - "ns2-06.azure-dns.net.",
          - "ns3-06.azure-dns.org.",
          - "ns4-06.azure-dns.info.",
        ] -> (known after apply)
      ~ number_of_record_sets     = 8 -> (known after apply)
      ~ resource_group_name       = "reformMgmtRG" -> "reformmgmtrg" # forces replacement
      - tags                      = {} -> null

      ~ soa_record (known after apply)
      - soa_record {
          - email         = "azuredns-hostmaster.microsoft.com" -> null
          - expire_time   = 2419200 -> null
          - fqdn          = "staging.hearings.reform.hmcts.net." -> null
          - host_name     = "ns1-06.azure-dns.com." -> null
          - minimum_ttl   = 300 -> null
          - refresh_time  = 3600 -> null
          - retry_time    = 300 -> null
          - serial_number = 1 -> null
          - tags          = {} -> null
          - ttl           = 3600 -> null
        }
    }

  # module.hearings-reform.azurerm_role_assignment.dnszonecontributer must be replaced
-/+ resource "azurerm_role_assignment" "dnszonecontributer" {
      + condition_version                      = (known after apply)
      ~ id                                     = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/resourceGroups/reformMgmtRG/providers/Microsoft.Network/dnsZones/staging.hearings.reform.hmcts.net/providers/Microsoft.Authorization/roleAssignments/d639e78a-b7b4-1da9-bfb0-1c934fbe4914" -> (known after apply)
      ~ name                                   = "d639e78a-b7b4-1da9-bfb0-1c934fbe4914" -> (known after apply)
      ~ principal_type                         = "Group" -> (known after apply)
      ~ role_definition_id                     = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/providers/Microsoft.Authorization/roleDefinitions/befefa01-2a29-4197-83a8-272ff33ce314" -> (known after apply)
      ~ scope                                  = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/resourceGroups/reformMgmtRG/providers/Microsoft.Network/dnsZones/staging.hearings.reform.hmcts.net" -> (known after apply) # forces replacement
      + skip_service_principal_aad_check       = (known after apply)
        # (5 unchanged attributes hidden)
    }

  # module.immigrationappealsonline.azurerm_dns_zone.zone must be replaced
-/+ resource "azurerm_dns_zone" "zone" {
      ~ id                        = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/resourceGroups/reformMgmtRG/providers/Microsoft.Network/dnsZones/staging.immigrationappealsonline.justice.gov.uk" -> (known after apply)
      ~ max_number_of_record_sets = 10000 -> (known after apply)
        name                      = "staging.immigrationappealsonline.justice.gov.uk"
      ~ name_servers              = [
          - "ns1-09.azure-dns.com.",
          - "ns2-09.azure-dns.net.",
          - "ns3-09.azure-dns.org.",
          - "ns4-09.azure-dns.info.",
        ] -> (known after apply)
      ~ number_of_record_sets     = 4 -> (known after apply)
      ~ resource_group_name       = "reformMgmtRG" -> "reformmgmtrg" # forces replacement
      - tags                      = {} -> null

      ~ soa_record (known after apply)
      - soa_record {
          - email         = "azuredns-hostmaster.microsoft.com" -> null
          - expire_time   = 2419200 -> null
          - fqdn          = "staging.immigrationappealsonline.justice.gov.uk." -> null
          - host_name     = "ns1-09.azure-dns.com." -> null
          - minimum_ttl   = 300 -> null
          - refresh_time  = 3600 -> null
          - retry_time    = 300 -> null
          - serial_number = 1 -> null
          - tags          = {} -> null
          - ttl           = 3600 -> null
        }
    }

  # module.immigrationappealsonline.azurerm_role_assignment.dnszonecontributer must be replaced
-/+ resource "azurerm_role_assignment" "dnszonecontributer" {
      + condition_version                      = (known after apply)
      ~ id                                     = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/resourceGroups/reformMgmtRG/providers/Microsoft.Network/dnsZones/staging.immigrationappealsonline.justice.gov.uk/providers/Microsoft.Authorization/roleAssignments/a06818d4-b274-8f7e-c3b7-bd698c495520" -> (known after apply)
      ~ name                                   = "a06818d4-b274-8f7e-c3b7-bd698c495520" -> (known after apply)
      ~ principal_type                         = "Group" -> (known after apply)
      ~ role_definition_id                     = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/providers/Microsoft.Authorization/roleDefinitions/befefa01-2a29-4197-83a8-272ff33ce314" -> (known after apply)
      ~ scope                                  = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/resourceGroups/reformMgmtRG/providers/Microsoft.Network/dnsZones/staging.immigrationappealsonline.justice.gov.uk" -> (known after apply) # forces replacement
      + skip_service_principal_aad_check       = (known after apply)
        # (5 unchanged attributes hidden)
    }

  # module.public-dns.azurerm_dns_zone.zone must be replaced
-/+ resource "azurerm_dns_zone" "zone" {
      ~ id                        = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/resourceGroups/reformMgmtRG/providers/Microsoft.Network/dnsZones/aat.platform.hmcts.net" -> (known after apply)
      ~ max_number_of_record_sets = 10000 -> (known after apply)
        name                      = "aat.platform.hmcts.net"
      ~ name_servers              = [
          - "ns1-03.azure-dns.com.",
          - "ns2-03.azure-dns.net.",
          - "ns3-03.azure-dns.org.",
          - "ns4-03.azure-dns.info.",
        ] -> (known after apply)
      ~ number_of_record_sets     = 201 -> (known after apply)
      ~ resource_group_name       = "reformMgmtRG" -> "reformmgmtrg" # forces replacement
      - tags                      = {} -> null

      ~ soa_record (known after apply)
      - soa_record {
          - email         = "azuredns-hostmaster.microsoft.com" -> null
          - expire_time   = 2419200 -> null
          - fqdn          = "aat.platform.hmcts.net." -> null
          - host_name     = "ns1-03.azure-dns.com." -> null
          - minimum_ttl   = 300 -> null
          - refresh_time  = 3600 -> null
          - retry_time    = 300 -> null
          - serial_number = 1 -> null
          - tags          = {} -> null
          - ttl           = 3600 -> null
        }
    }

  # module.public-dns.azurerm_role_assignment.dnszonecontributer must be replaced
-/+ resource "azurerm_role_assignment" "dnszonecontributer" {
      + condition_version                      = (known after apply)
      ~ id                                     = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/resourceGroups/reformMgmtRG/providers/Microsoft.Network/dnsZones/aat.platform.hmcts.net/providers/Microsoft.Authorization/roleAssignments/5c53696d-3e46-8526-8f9e-1558780b0631" -> (known after apply)
      ~ name                                   = "5c53696d-3e46-8526-8f9e-1558780b0631" -> (known after apply)
      ~ principal_type                         = "Group" -> (known after apply)
      ~ role_definition_id                     = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/providers/Microsoft.Authorization/roleDefinitions/befefa01-2a29-4197-83a8-272ff33ce314" -> (known after apply)
      ~ scope                                  = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/resourceGroups/reformMgmtRG/providers/Microsoft.Network/dnsZones/aat.platform.hmcts.net" -> (known after apply) # forces replacement
      + skip_service_principal_aad_check       = (known after apply)
        # (5 unchanged attributes hidden)
    }

  # module.staging.azurerm_dns_zone.zone must be replaced
-/+ resource "azurerm_dns_zone" "zone" {
      ~ id                        = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/resourceGroups/reformMgmtRG/providers/Microsoft.Network/dnsZones/staging.platform.hmcts.net" -> (known after apply)
      ~ max_number_of_record_sets = 10000 -> (known after apply)
        name                      = "staging.platform.hmcts.net"
      ~ name_servers              = [
          - "ns1-09.azure-dns.com.",
          - "ns2-09.azure-dns.net.",
          - "ns3-09.azure-dns.org.",
          - "ns4-09.azure-dns.info.",
        ] -> (known after apply)
      ~ number_of_record_sets     = 47 -> (known after apply)
      ~ resource_group_name       = "reformMgmtRG" -> "reformmgmtrg" # forces replacement
      - tags                      = {} -> null

      ~ soa_record (known after apply)
      - soa_record {
          - email         = "azuredns-hostmaster.microsoft.com" -> null
          - expire_time   = 2419200 -> null
          - fqdn          = "staging.platform.hmcts.net." -> null
          - host_name     = "ns1-09.azure-dns.com." -> null
          - minimum_ttl   = 300 -> null
          - refresh_time  = 3600 -> null
          - retry_time    = 300 -> null
          - serial_number = 1 -> null
          - tags          = {} -> null
          - ttl           = 3600 -> null
        }
    }

  # module.staging.azurerm_role_assignment.dnszonecontributer must be replaced
-/+ resource "azurerm_role_assignment" "dnszonecontributer" {
      + condition_version                      = (known after apply)
      ~ id                                     = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/resourceGroups/reformMgmtRG/providers/Microsoft.Network/dnsZones/staging.platform.hmcts.net/providers/Microsoft.Authorization/roleAssignments/37ab8ca3-bad5-99ca-ab84-1823793fc02b" -> (known after apply)
      ~ name                                   = "37ab8ca3-bad5-99ca-ab84-1823793fc02b" -> (known after apply)
      ~ principal_type                         = "Group" -> (known after apply)
      ~ role_definition_id                     = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/providers/Microsoft.Authorization/roleDefinitions/befefa01-2a29-4197-83a8-272ff33ce314" -> (known after apply)
      ~ scope                                  = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/resourceGroups/reformMgmtRG/providers/Microsoft.Network/dnsZones/staging.platform.hmcts.net" -> (known after apply) # forces replacement
      + skip_service_principal_aad_check       = (known after apply)
        # (5 unchanged attributes hidden)
    }

  # module.staging-apps-public-dns.azurerm_dns_zone.zone must be replaced
-/+ resource "azurerm_dns_zone" "zone" {
      ~ id                        = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/resourceGroups/reformMgmtRG/providers/Microsoft.Network/dnsZones/staging.apps.hmcts.net" -> (known after apply)
      ~ max_number_of_record_sets = 10000 -> (known after apply)
        name                      = "staging.apps.hmcts.net"
      ~ name_servers              = [
          - "ns1-07.azure-dns.com.",
          - "ns2-07.azure-dns.net.",
          - "ns3-07.azure-dns.org.",
          - "ns4-07.azure-dns.info.",
        ] -> (known after apply)
      ~ number_of_record_sets     = 28 -> (known after apply)
      ~ resource_group_name       = "reformMgmtRG" -> "reformmgmtrg" # forces replacement
      - tags                      = {} -> null

      ~ soa_record (known after apply)
      - soa_record {
          - email         = "azuredns-hostmaster.microsoft.com" -> null
          - expire_time   = 2419200 -> null
          - fqdn          = "staging.apps.hmcts.net." -> null
          - host_name     = "ns1-07.azure-dns.com." -> null
          - minimum_ttl   = 300 -> null
          - refresh_time  = 3600 -> null
          - retry_time    = 300 -> null
          - serial_number = 1 -> null
          - tags          = {} -> null
          - ttl           = 3600 -> null
        }
    }

  # module.staging-apps-public-dns.azurerm_role_assignment.dnszonecontributer must be replaced
-/+ resource "azurerm_role_assignment" "dnszonecontributer" {
      + condition_version                      = (known after apply)
      ~ id                                     = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/resourceGroups/reformMgmtRG/providers/Microsoft.Network/dnsZones/staging.apps.hmcts.net/providers/Microsoft.Authorization/roleAssignments/ad0e01c4-07d6-654c-5c76-1b56488b6ac9" -> (known after apply)
      ~ name                                   = "ad0e01c4-07d6-654c-5c76-1b56488b6ac9" -> (known after apply)
      ~ principal_type                         = "Group" -> (known after apply)
      ~ role_definition_id                     = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/providers/Microsoft.Authorization/roleDefinitions/befefa01-2a29-4197-83a8-272ff33ce314" -> (known after apply)
      ~ scope                                  = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/resourceGroups/reformMgmtRG/providers/Microsoft.Network/dnsZones/staging.apps.hmcts.net" -> (known after apply) # forces replacement
      + skip_service_principal_aad_check       = (known after apply)
        # (5 unchanged attributes hidden)
    }

  # module.staging-internal.azurerm_dns_zone.zone must be replaced
-/+ resource "azurerm_dns_zone" "zone" {
      ~ id                        = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/resourceGroups/reformMgmtRG/providers/Microsoft.Network/dnsZones/staging.internal.hmcts.net" -> (known after apply)
      ~ max_number_of_record_sets = 10000 -> (known after apply)
        name                      = "staging.internal.hmcts.net"
      ~ name_servers              = [
          - "ns1-04.azure-dns.com.",
          - "ns2-04.azure-dns.net.",
          - "ns3-04.azure-dns.org.",
          - "ns4-04.azure-dns.info.",
        ] -> (known after apply)
      ~ number_of_record_sets     = 13 -> (known after apply)
      ~ resource_group_name       = "reformMgmtRG" -> "reformmgmtrg" # forces replacement
      - tags                      = {} -> null

      ~ soa_record (known after apply)
      - soa_record {
          - email         = "azuredns-hostmaster.microsoft.com" -> null
          - expire_time   = 2419200 -> null
          - fqdn          = "staging.internal.hmcts.net." -> null
          - host_name     = "ns1-04.azure-dns.com." -> null
          - minimum_ttl   = 300 -> null
          - refresh_time  = 3600 -> null
          - retry_time    = 300 -> null
          - serial_number = 1 -> null
          - tags          = {} -> null
          - ttl           = 3600 -> null
        }
    }

  # module.staging-internal.azurerm_role_assignment.dnszonecontributer must be replaced
-/+ resource "azurerm_role_assignment" "dnszonecontributer" {
      + condition_version                      = (known after apply)
      ~ id                                     = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/resourceGroups/reformMgmtRG/providers/Microsoft.Network/dnsZones/staging.internal.hmcts.net/providers/Microsoft.Authorization/roleAssignments/f4f6a694-f068-76f4-0d3d-7783e734205b" -> (known after apply)
      ~ name                                   = "f4f6a694-f068-76f4-0d3d-7783e734205b" -> (known after apply)
      ~ principal_type                         = "Group" -> (known after apply)
      ~ role_definition_id                     = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/providers/Microsoft.Authorization/roleDefinitions/befefa01-2a29-4197-83a8-272ff33ce314" -> (known after apply)
      ~ scope                                  = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/resourceGroups/reformMgmtRG/providers/Microsoft.Network/dnsZones/staging.internal.hmcts.net" -> (known after apply) # forces replacement
      + skip_service_principal_aad_check       = (known after apply)
        # (5 unchanged attributes hidden)
    }

  # module.tribunalsdecisions.azurerm_dns_zone.zone must be replaced
-/+ resource "azurerm_dns_zone" "zone" {
      ~ id                        = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/resourceGroups/reformMgmtRG/providers/Microsoft.Network/dnsZones/staging.tribunalsdecisions.service.gov.uk" -> (known after apply)
      ~ max_number_of_record_sets = 10000 -> (known after apply)
        name                      = "staging.tribunalsdecisions.service.gov.uk"
      ~ name_servers              = [
          - "ns1-06.azure-dns.com.",
          - "ns2-06.azure-dns.net.",
          - "ns3-06.azure-dns.org.",
          - "ns4-06.azure-dns.info.",
        ] -> (known after apply)
      ~ number_of_record_sets     = 4 -> (known after apply)
      ~ resource_group_name       = "reformMgmtRG" -> "reformmgmtrg" # forces replacement
      - tags                      = {} -> null

      ~ soa_record (known after apply)
      - soa_record {
          - email         = "azuredns-hostmaster.microsoft.com" -> null
          - expire_time   = 2419200 -> null
          - fqdn          = "staging.tribunalsdecisions.service.gov.uk." -> null
          - host_name     = "ns1-06.azure-dns.com." -> null
          - minimum_ttl   = 300 -> null
          - refresh_time  = 3600 -> null
          - retry_time    = 300 -> null
          - serial_number = 1 -> null
          - tags          = {} -> null
          - ttl           = 3600 -> null
        }
    }

  # module.tribunalsdecisions.azurerm_role_assignment.dnszonecontributer must be replaced
-/+ resource "azurerm_role_assignment" "dnszonecontributer" {
      + condition_version                      = (known after apply)
      ~ id                                     = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/resourceGroups/reformMgmtRG/providers/Microsoft.Network/dnsZones/staging.tribunalsdecisions.service.gov.uk/providers/Microsoft.Authorization/roleAssignments/ee85cee1-d82d-4532-2a59-ca5fe55f7f39" -> (known after apply)
      ~ name                                   = "ee85cee1-d82d-4532-2a59-ca5fe55f7f39" -> (known after apply)
      ~ principal_type                         = "Group" -> (known after apply)
      ~ role_definition_id                     = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/providers/Microsoft.Authorization/roleDefinitions/befefa01-2a29-4197-83a8-272ff33ce314" -> (known after apply)
      ~ scope                                  = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/resourceGroups/reformMgmtRG/providers/Microsoft.Network/dnsZones/staging.tribunalsdecisions.service.gov.uk" -> (known after apply) # forces replacement
      + skip_service_principal_aad_check       = (known after apply)
        # (5 unchanged attributes hidden)
    }

Plan: 22 to add, 0 to change, 22 to destroy.

hmcts-platform-operations · 2025-09-22T07:03:32Z

Plan Result (278: Ithc - TerraformPlanApply)

⚠️ Resource Deletion will happen

This plan contains resource delete operation. Please check the plan result very carefully!

Plan: 4 to add, 0 to change, 4 to destroy.

Replace
- module.ithc-apps-public-dns.azurerm_dns_zone.zone
- module.ithc-apps-public-dns.azurerm_role_assignment.dnszonecontributer
- module.public-dns.azurerm_dns_zone.zone
- module.public-dns.azurerm_role_assignment.dnszonecontributer

Change Result (Click me)

  # module.ithc-apps-public-dns.azurerm_dns_zone.zone must be replaced
-/+ resource "azurerm_dns_zone" "zone" {
      ~ id                        = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/resourceGroups/reformMgmtRG/providers/Microsoft.Network/dnsZones/ithc.apps.hmcts.net" -> (known after apply)
      ~ max_number_of_record_sets = 10000 -> (known after apply)
        name                      = "ithc.apps.hmcts.net"
      ~ name_servers              = [
          - "ns1-06.azure-dns.com.",
          - "ns2-06.azure-dns.net.",
          - "ns3-06.azure-dns.org.",
          - "ns4-06.azure-dns.info.",
        ] -> (known after apply)
      ~ number_of_record_sets     = 7 -> (known after apply)
      ~ resource_group_name       = "reformMgmtRG" -> "reformmgmtrg" # forces replacement
      - tags                      = {} -> null

      ~ soa_record (known after apply)
      - soa_record {
          - email         = "azuredns-hostmaster.microsoft.com" -> null
          - expire_time   = 2419200 -> null
          - fqdn          = "ithc.apps.hmcts.net." -> null
          - host_name     = "ns1-06.azure-dns.com." -> null
          - minimum_ttl   = 300 -> null
          - refresh_time  = 3600 -> null
          - retry_time    = 300 -> null
          - serial_number = 1 -> null
          - tags          = {} -> null
          - ttl           = 3600 -> null
        }
    }

  # module.ithc-apps-public-dns.azurerm_role_assignment.dnszonecontributer must be replaced
-/+ resource "azurerm_role_assignment" "dnszonecontributer" {
      + condition_version                      = (known after apply)
      ~ id                                     = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/resourceGroups/reformMgmtRG/providers/Microsoft.Network/dnsZones/ithc.apps.hmcts.net/providers/Microsoft.Authorization/roleAssignments/fd37763f-53eb-8cd3-8f07-ca3cbb09d409" -> (known after apply)
      ~ name                                   = "fd37763f-53eb-8cd3-8f07-ca3cbb09d409" -> (known after apply)
      ~ principal_type                         = "Group" -> (known after apply)
      ~ role_definition_id                     = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/providers/Microsoft.Authorization/roleDefinitions/befefa01-2a29-4197-83a8-272ff33ce314" -> (known after apply)
      ~ scope                                  = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/resourceGroups/reformMgmtRG/providers/Microsoft.Network/dnsZones/ithc.apps.hmcts.net" -> (known after apply) # forces replacement
      + skip_service_principal_aad_check       = (known after apply)
        # (5 unchanged attributes hidden)
    }

  # module.public-dns.azurerm_dns_zone.zone must be replaced
-/+ resource "azurerm_dns_zone" "zone" {
      ~ id                        = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/resourceGroups/reformMgmtRG/providers/Microsoft.Network/dnsZones/ithc.platform.hmcts.net" -> (known after apply)
      ~ max_number_of_record_sets = 10000 -> (known after apply)
        name                      = "ithc.platform.hmcts.net"
      ~ name_servers              = [
          - "ns1-01.azure-dns.com.",
          - "ns2-01.azure-dns.net.",
          - "ns3-01.azure-dns.org.",
          - "ns4-01.azure-dns.info.",
        ] -> (known after apply)
      ~ number_of_record_sets     = 193 -> (known after apply)
      ~ resource_group_name       = "reformMgmtRG" -> "reformmgmtrg" # forces replacement
      - tags                      = {} -> null

      ~ soa_record (known after apply)
      - soa_record {
          - email         = "azuredns-hostmaster.microsoft.com" -> null
          - expire_time   = 2419200 -> null
          - fqdn          = "ithc.platform.hmcts.net." -> null
          - host_name     = "ns1-01.azure-dns.com." -> null
          - minimum_ttl   = 300 -> null
          - refresh_time  = 3600 -> null
          - retry_time    = 300 -> null
          - serial_number = 1 -> null
          - tags          = {} -> null
          - ttl           = 3600 -> null
        }
    }

  # module.public-dns.azurerm_role_assignment.dnszonecontributer must be replaced
-/+ resource "azurerm_role_assignment" "dnszonecontributer" {
      + condition_version                      = (known after apply)
      ~ id                                     = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/resourceGroups/reformMgmtRG/providers/Microsoft.Network/dnsZones/ithc.platform.hmcts.net/providers/Microsoft.Authorization/roleAssignments/1c912dda-b651-c86b-3465-9a4449aa9df9" -> (known after apply)
      ~ name                                   = "1c912dda-b651-c86b-3465-9a4449aa9df9" -> (known after apply)
      ~ principal_type                         = "Group" -> (known after apply)
      ~ role_definition_id                     = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/providers/Microsoft.Authorization/roleDefinitions/befefa01-2a29-4197-83a8-272ff33ce314" -> (known after apply)
      ~ scope                                  = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/resourceGroups/reformMgmtRG/providers/Microsoft.Network/dnsZones/ithc.platform.hmcts.net" -> (known after apply) # forces replacement
      + skip_service_principal_aad_check       = (known after apply)
        # (5 unchanged attributes hidden)
    }

Plan: 4 to add, 0 to change, 4 to destroy.

hmcts-platform-operations · 2025-09-22T07:03:36Z

Plan Result (278: Dev - TerraformPlanApply)

⚠️ Resource Deletion will happen

This plan contains resource delete operation. Please check the plan result very carefully!

Plan: 16 to add, 0 to change, 14 to destroy.

Create
- module.dev.azurerm_dns_a_record.this["csds-active"]
- module.dev.azurerm_dns_a_record.this["csds-passive"]
Replace
- module.casetracker.azurerm_dns_zone.zone
- module.casetracker.azurerm_role_assignment.dnszonecontributer
- module.certificatedbailiffs.azurerm_dns_zone.zone
- module.certificatedbailiffs.azurerm_role_assignment.dnszonecontributer
- module.courtfines.azurerm_dns_zone.zone
- module.courtfines.azurerm_role_assignment.dnszonecontributer
- module.dev.azurerm_dns_zone.zone
- module.dev.azurerm_role_assignment.dnszonecontributer
- module.dev-apps-public-dns.azurerm_dns_zone.zone
- module.dev-apps-public-dns.azurerm_role_assignment.dnszonecontributer
- module.immigrationappealsonline.azurerm_dns_zone.zone
- module.immigrationappealsonline.azurerm_role_assignment.dnszonecontributer
- module.public-dns.azurerm_dns_zone.zone
- module.public-dns.azurerm_role_assignment.dnszonecontributer

Change Result (Click me)

  # module.casetracker.azurerm_dns_zone.zone must be replaced
-/+ resource "azurerm_dns_zone" "zone" {
      ~ id                        = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/resourceGroups/reformMgmtRG/providers/Microsoft.Network/dnsZones/dev.casetracker.justice.gov.uk" -> (known after apply)
      ~ max_number_of_record_sets = 10000 -> (known after apply)
        name                      = "dev.casetracker.justice.gov.uk"
      ~ name_servers              = [
          - "ns1-06.azure-dns.com.",
          - "ns2-06.azure-dns.net.",
          - "ns3-06.azure-dns.org.",
          - "ns4-06.azure-dns.info.",
        ] -> (known after apply)
      ~ number_of_record_sets     = 4 -> (known after apply)
      ~ resource_group_name       = "reformMgmtRG" -> "reformmgmtrg" # forces replacement
      - tags                      = {} -> null

      ~ soa_record (known after apply)
      - soa_record {
          - email         = "azuredns-hostmaster.microsoft.com" -> null
          - expire_time   = 2419200 -> null
          - fqdn          = "dev.casetracker.justice.gov.uk." -> null
          - host_name     = "ns1-06.azure-dns.com." -> null
          - minimum_ttl   = 300 -> null
          - refresh_time  = 3600 -> null
          - retry_time    = 300 -> null
          - serial_number = 1 -> null
          - tags          = {} -> null
          - ttl           = 3600 -> null
        }
    }

  # module.casetracker.azurerm_role_assignment.dnszonecontributer must be replaced
-/+ resource "azurerm_role_assignment" "dnszonecontributer" {
      + condition_version                      = (known after apply)
      ~ id                                     = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/resourceGroups/reformMgmtRG/providers/Microsoft.Network/dnsZones/dev.casetracker.justice.gov.uk/providers/Microsoft.Authorization/roleAssignments/5f92a4be-12d7-ab17-49c9-6617f403edf1" -> (known after apply)
      ~ name                                   = "5f92a4be-12d7-ab17-49c9-6617f403edf1" -> (known after apply)
      ~ principal_type                         = "Group" -> (known after apply)
      ~ role_definition_id                     = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/providers/Microsoft.Authorization/roleDefinitions/befefa01-2a29-4197-83a8-272ff33ce314" -> (known after apply)
      ~ scope                                  = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/resourceGroups/reformMgmtRG/providers/Microsoft.Network/dnsZones/dev.casetracker.justice.gov.uk" -> (known after apply) # forces replacement
      + skip_service_principal_aad_check       = (known after apply)
        # (5 unchanged attributes hidden)
    }

  # module.certificatedbailiffs.azurerm_dns_zone.zone must be replaced
-/+ resource "azurerm_dns_zone" "zone" {
      ~ id                        = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/resourceGroups/reformMgmtRG/providers/Microsoft.Network/dnsZones/dev.certificatedbailiffs.justice.gov.uk" -> (known after apply)
      ~ max_number_of_record_sets = 10000 -> (known after apply)
        name                      = "dev.certificatedbailiffs.justice.gov.uk"
      ~ name_servers              = [
          - "ns1-04.azure-dns.com.",
          - "ns2-04.azure-dns.net.",
          - "ns3-04.azure-dns.org.",
          - "ns4-04.azure-dns.info.",
        ] -> (known after apply)
      ~ number_of_record_sets     = 4 -> (known after apply)
      ~ resource_group_name       = "reformMgmtRG" -> "reformmgmtrg" # forces replacement
      - tags                      = {} -> null

      ~ soa_record (known after apply)
      - soa_record {
          - email         = "azuredns-hostmaster.microsoft.com" -> null
          - expire_time   = 2419200 -> null
          - fqdn          = "dev.certificatedbailiffs.justice.gov.uk." -> null
          - host_name     = "ns1-04.azure-dns.com." -> null
          - minimum_ttl   = 300 -> null
          - refresh_time  = 3600 -> null
          - retry_time    = 300 -> null
          - serial_number = 1 -> null
          - tags          = {} -> null
          - ttl           = 3600 -> null
        }
    }

  # module.certificatedbailiffs.azurerm_role_assignment.dnszonecontributer must be replaced
-/+ resource "azurerm_role_assignment" "dnszonecontributer" {
      + condition_version                      = (known after apply)
      ~ id                                     = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/resourceGroups/reformMgmtRG/providers/Microsoft.Network/dnsZones/dev.certificatedbailiffs.justice.gov.uk/providers/Microsoft.Authorization/roleAssignments/b14eb5cb-10b8-cd2a-cce5-99be029625a1" -> (known after apply)
      ~ name                                   = "b14eb5cb-10b8-cd2a-cce5-99be029625a1" -> (known after apply)
      ~ principal_type                         = "Group" -> (known after apply)
      ~ role_definition_id                     = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/providers/Microsoft.Authorization/roleDefinitions/befefa01-2a29-4197-83a8-272ff33ce314" -> (known after apply)
      ~ scope                                  = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/resourceGroups/reformMgmtRG/providers/Microsoft.Network/dnsZones/dev.certificatedbailiffs.justice.gov.uk" -> (known after apply) # forces replacement
      + skip_service_principal_aad_check       = (known after apply)
        # (5 unchanged attributes hidden)
    }

  # module.courtfines.azurerm_dns_zone.zone must be replaced
-/+ resource "azurerm_dns_zone" "zone" {
      ~ id                        = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/resourceGroups/reformMgmtRG/providers/Microsoft.Network/dnsZones/dev.courtfines.direct.gov.uk" -> (known after apply)
      ~ max_number_of_record_sets = 10000 -> (known after apply)
        name                      = "dev.courtfines.direct.gov.uk"
      ~ name_servers              = [
          - "ns1-07.azure-dns.com.",
          - "ns2-07.azure-dns.net.",
          - "ns3-07.azure-dns.org.",
          - "ns4-07.azure-dns.info.",
        ] -> (known after apply)
      ~ number_of_record_sets     = 4 -> (known after apply)
      ~ resource_group_name       = "reformMgmtRG" -> "reformmgmtrg" # forces replacement
      - tags                      = {} -> null

      ~ soa_record (known after apply)
      - soa_record {
          - email         = "azuredns-hostmaster.microsoft.com" -> null
          - expire_time   = 2419200 -> null
          - fqdn          = "dev.courtfines.direct.gov.uk." -> null
          - host_name     = "ns1-07.azure-dns.com." -> null
          - minimum_ttl   = 300 -> null
          - refresh_time  = 3600 -> null
          - retry_time    = 300 -> null
          - serial_number = 1 -> null
          - tags          = {} -> null
          - ttl           = 3600 -> null
        }
    }

  # module.courtfines.azurerm_role_assignment.dnszonecontributer must be replaced
-/+ resource "azurerm_role_assignment" "dnszonecontributer" {
      + condition_version                      = (known after apply)
      ~ id                                     = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/resourceGroups/reformMgmtRG/providers/Microsoft.Network/dnsZones/dev.courtfines.direct.gov.uk/providers/Microsoft.Authorization/roleAssignments/bf30e6b0-1174-3bec-9685-323f32bd0709" -> (known after apply)
      ~ name                                   = "bf30e6b0-1174-3bec-9685-323f32bd0709" -> (known after apply)
      ~ principal_type                         = "Group" -> (known after apply)
      ~ role_definition_id                     = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/providers/Microsoft.Authorization/roleDefinitions/befefa01-2a29-4197-83a8-272ff33ce314" -> (known after apply)
      ~ scope                                  = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/resourceGroups/reformMgmtRG/providers/Microsoft.Network/dnsZones/dev.courtfines.direct.gov.uk" -> (known after apply) # forces replacement
      + skip_service_principal_aad_check       = (known after apply)
        # (5 unchanged attributes hidden)
    }

  # module.dev.azurerm_dns_a_record.this["csds-active"] will be created
  + resource "azurerm_dns_a_record" "this" {
      + fqdn                = (known after apply)
      + id                  = (known after apply)
      + name                = "csds-active"
      + records             = [
          + "4.234.140.234",
        ]
      + resource_group_name = "reformmgmtrg"
      + ttl                 = 300
      + zone_name           = "dev.platform.hmcts.net"
    }

  # module.dev.azurerm_dns_a_record.this["csds-passive"] will be created
  + resource "azurerm_dns_a_record" "this" {
      + fqdn                = (known after apply)
      + id                  = (known after apply)
      + name                = "csds-passive"
      + records             = [
          + "4.234.140.234",
        ]
      + resource_group_name = "reformmgmtrg"
      + ttl                 = 300
      + zone_name           = "dev.platform.hmcts.net"
    }

  # module.dev.azurerm_dns_zone.zone must be replaced
-/+ resource "azurerm_dns_zone" "zone" {
      ~ id                        = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/resourceGroups/reformMgmtRG/providers/Microsoft.Network/dnsZones/dev.platform.hmcts.net" -> (known after apply)
      ~ max_number_of_record_sets = 10000 -> (known after apply)
        name                      = "dev.platform.hmcts.net"
      ~ name_servers              = [
          - "ns1-05.azure-dns.com.",
          - "ns2-05.azure-dns.net.",
          - "ns3-05.azure-dns.org.",
          - "ns4-05.azure-dns.info.",
        ] -> (known after apply)
      ~ number_of_record_sets     = 44 -> (known after apply)
      ~ resource_group_name       = "reformMgmtRG" -> "reformmgmtrg" # forces replacement
      - tags                      = {} -> null

      ~ soa_record (known after apply)
      - soa_record {
          - email         = "azuredns-hostmaster.microsoft.com" -> null
          - expire_time   = 2419200 -> null
          - fqdn          = "dev.platform.hmcts.net." -> null
          - host_name     = "ns1-05.azure-dns.com." -> null
          - minimum_ttl   = 300 -> null
          - refresh_time  = 3600 -> null
          - retry_time    = 300 -> null
          - serial_number = 1 -> null
          - tags          = {} -> null
          - ttl           = 3600 -> null
        }
    }

  # module.dev.azurerm_role_assignment.dnszonecontributer must be replaced
-/+ resource "azurerm_role_assignment" "dnszonecontributer" {
      + condition_version                      = (known after apply)
      ~ id                                     = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/resourceGroups/reformMgmtRG/providers/Microsoft.Network/dnsZones/dev.platform.hmcts.net/providers/Microsoft.Authorization/roleAssignments/a8a888ac-6b0f-f7c1-7915-8dde64a84f47" -> (known after apply)
      ~ name                                   = "a8a888ac-6b0f-f7c1-7915-8dde64a84f47" -> (known after apply)
      ~ principal_type                         = "Group" -> (known after apply)
      ~ role_definition_id                     = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/providers/Microsoft.Authorization/roleDefinitions/befefa01-2a29-4197-83a8-272ff33ce314" -> (known after apply)
      ~ scope                                  = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/resourceGroups/reformMgmtRG/providers/Microsoft.Network/dnsZones/dev.platform.hmcts.net" -> (known after apply) # forces replacement
      + skip_service_principal_aad_check       = (known after apply)
        # (5 unchanged attributes hidden)
    }

  # module.dev-apps-public-dns.azurerm_dns_zone.zone must be replaced
-/+ resource "azurerm_dns_zone" "zone" {
      ~ id                        = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/resourceGroups/reformMgmtRG/providers/Microsoft.Network/dnsZones/dev.apps.hmcts.net" -> (known after apply)
      ~ max_number_of_record_sets = 10000 -> (known after apply)
        name                      = "dev.apps.hmcts.net"
      ~ name_servers              = [
          - "ns1-09.azure-dns.com.",
          - "ns2-09.azure-dns.net.",
          - "ns3-09.azure-dns.org.",
          - "ns4-09.azure-dns.info.",
        ] -> (known after apply)
      ~ number_of_record_sets     = 10 -> (known after apply)
      ~ resource_group_name       = "reformMgmtRG" -> "reformmgmtrg" # forces replacement
      - tags                      = {} -> null

      ~ soa_record (known after apply)
      - soa_record {
          - email         = "azuredns-hostmaster.microsoft.com" -> null
          - expire_time   = 2419200 -> null
          - fqdn          = "dev.apps.hmcts.net." -> null
          - host_name     = "ns1-09.azure-dns.com." -> null
          - minimum_ttl   = 300 -> null
          - refresh_time  = 3600 -> null
          - retry_time    = 300 -> null
          - serial_number = 1 -> null
          - tags          = {} -> null
          - ttl           = 3600 -> null
        }
    }

  # module.dev-apps-public-dns.azurerm_role_assignment.dnszonecontributer must be replaced
-/+ resource "azurerm_role_assignment" "dnszonecontributer" {
      + condition_version                      = (known after apply)
      ~ id                                     = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/resourceGroups/reformMgmtRG/providers/Microsoft.Network/dnsZones/dev.apps.hmcts.net/providers/Microsoft.Authorization/roleAssignments/0edbfb94-422e-8be6-63cd-0a2cbd084bbc" -> (known after apply)
      ~ name                                   = "0edbfb94-422e-8be6-63cd-0a2cbd084bbc" -> (known after apply)
      ~ principal_type                         = "Group" -> (known after apply)
      ~ role_definition_id                     = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/providers/Microsoft.Authorization/roleDefinitions/befefa01-2a29-4197-83a8-272ff33ce314" -> (known after apply)
      ~ scope                                  = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/resourceGroups/reformMgmtRG/providers/Microsoft.Network/dnsZones/dev.apps.hmcts.net" -> (known after apply) # forces replacement
      + skip_service_principal_aad_check       = (known after apply)
        # (5 unchanged attributes hidden)
    }

  # module.immigrationappealsonline.azurerm_dns_zone.zone must be replaced
-/+ resource "azurerm_dns_zone" "zone" {
      ~ id                        = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/resourceGroups/reformMgmtRG/providers/Microsoft.Network/dnsZones/dev.immigrationappealsonline.justice.gov.uk" -> (known after apply)
      ~ max_number_of_record_sets = 10000 -> (known after apply)
        name                      = "dev.immigrationappealsonline.justice.gov.uk"
      ~ name_servers              = [
          - "ns1-03.azure-dns.com.",
          - "ns2-03.azure-dns.net.",
          - "ns3-03.azure-dns.org.",
          - "ns4-03.azure-dns.info.",
        ] -> (known after apply)
      ~ number_of_record_sets     = 4 -> (known after apply)
      ~ resource_group_name       = "reformMgmtRG" -> "reformmgmtrg" # forces replacement
      - tags                      = {} -> null

      ~ soa_record (known after apply)
      - soa_record {
          - email         = "azuredns-hostmaster.microsoft.com" -> null
          - expire_time   = 2419200 -> null
          - fqdn          = "dev.immigrationappealsonline.justice.gov.uk." -> null
          - host_name     = "ns1-03.azure-dns.com." -> null
          - minimum_ttl   = 300 -> null
          - refresh_time  = 3600 -> null
          - retry_time    = 300 -> null
          - serial_number = 1 -> null
          - tags          = {} -> null
          - ttl           = 3600 -> null
        }
    }

  # module.immigrationappealsonline.azurerm_role_assignment.dnszonecontributer must be replaced
-/+ resource "azurerm_role_assignment" "dnszonecontributer" {
      + condition_version                      = (known after apply)
      ~ id                                     = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/resourceGroups/reformMgmtRG/providers/Microsoft.Network/dnsZones/dev.immigrationappealsonline.justice.gov.uk/providers/Microsoft.Authorization/roleAssignments/d983d746-a43b-0d10-b350-dcc49b4279d2" -> (known after apply)
      ~ name                                   = "d983d746-a43b-0d10-b350-dcc49b4279d2" -> (known after apply)
      ~ principal_type                         = "Group" -> (known after apply)
      ~ role_definition_id                     = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/providers/Microsoft.Authorization/roleDefinitions/befefa01-2a29-4197-83a8-272ff33ce314" -> (known after apply)
      ~ scope                                  = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/resourceGroups/reformMgmtRG/providers/Microsoft.Network/dnsZones/dev.immigrationappealsonline.justice.gov.uk" -> (known after apply) # forces replacement
      + skip_service_principal_aad_check       = (known after apply)
        # (5 unchanged attributes hidden)
    }

  # module.public-dns.azurerm_dns_zone.zone must be replaced
-/+ resource "azurerm_dns_zone" "zone" {
      ~ id                        = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/resourceGroups/reformMgmtRG/providers/Microsoft.Network/dnsZones/preview.platform.hmcts.net" -> (known after apply)
      ~ max_number_of_record_sets = 10000 -> (known after apply)
        name                      = "preview.platform.hmcts.net"
      ~ name_servers              = [
          - "ns1-06.azure-dns.com.",
          - "ns2-06.azure-dns.net.",
          - "ns3-06.azure-dns.org.",
          - "ns4-06.azure-dns.info.",
        ] -> (known after apply)
      ~ number_of_record_sets     = 12 -> (known after apply)
      ~ resource_group_name       = "reformMgmtRG" -> "reformmgmtrg" # forces replacement
      - tags                      = {} -> null

      ~ soa_record (known after apply)
      - soa_record {
          - email         = "azuredns-hostmaster.microsoft.com" -> null
          - expire_time   = 2419200 -> null
          - fqdn          = "preview.platform.hmcts.net." -> null
          - host_name     = "ns1-06.azure-dns.com." -> null
          - minimum_ttl   = 300 -> null
          - refresh_time  = 3600 -> null
          - retry_time    = 300 -> null
          - serial_number = 1 -> null
          - tags          = {} -> null
          - ttl           = 3600 -> null
        }
    }

  # module.public-dns.azurerm_role_assignment.dnszonecontributer must be replaced
-/+ resource "azurerm_role_assignment" "dnszonecontributer" {
      + condition_version                      = (known after apply)
      ~ id                                     = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/resourceGroups/reformMgmtRG/providers/Microsoft.Network/dnsZones/preview.platform.hmcts.net/providers/Microsoft.Authorization/roleAssignments/f09cc4f8-3055-2270-45fc-52504308b78c" -> (known after apply)
      ~ name                                   = "f09cc4f8-3055-2270-45fc-52504308b78c" -> (known after apply)
      ~ principal_type                         = "Group" -> (known after apply)
      ~ role_definition_id                     = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/providers/Microsoft.Authorization/roleDefinitions/befefa01-2a29-4197-83a8-272ff33ce314" -> (known after apply)
      ~ scope                                  = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/resourceGroups/reformMgmtRG/providers/Microsoft.Network/dnsZones/preview.platform.hmcts.net" -> (known after apply) # forces replacement
      + skip_service_principal_aad_check       = (known after apply)
        # (5 unchanged attributes hidden)
    }

Plan: 16 to add, 0 to change, 14 to destroy.

hmcts-platform-operations · 2025-09-22T07:03:38Z

Plan Result (278: nle - TerraformPlanApply)

⚠️ Resource Deletion will happen

This plan contains resource delete operation. Please check the plan result very carefully!

Plan: 4 to add, 0 to change, 4 to destroy.

Replace
- module.nle-hmcts-net.azurerm_dns_zone.zone
- module.nle-hmcts-net.azurerm_role_assignment.dnszonecontributer
- module.public-dns.azurerm_dns_zone.zone
- module.public-dns.azurerm_role_assignment.dnszonecontributer

Change Result (Click me)

  # module.nle-hmcts-net.azurerm_dns_zone.zone must be replaced
-/+ resource "azurerm_dns_zone" "zone" {
      ~ id                        = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/resourceGroups/reformMgmtRG/providers/Microsoft.Network/dnsZones/nle.hmcts.net" -> (known after apply)
      ~ max_number_of_record_sets = 10000 -> (known after apply)
        name                      = "nle.hmcts.net"
      ~ name_servers              = [
          - "ns1-05.azure-dns.com.",
          - "ns2-05.azure-dns.net.",
          - "ns3-05.azure-dns.org.",
          - "ns4-05.azure-dns.info.",
        ] -> (known after apply)
      ~ number_of_record_sets     = 4 -> (known after apply)
      ~ resource_group_name       = "reformMgmtRG" -> "reformmgmtrg" # forces replacement
      - tags                      = {} -> null

      ~ soa_record (known after apply)
      - soa_record {
          - email         = "azuredns-hostmaster.microsoft.com" -> null
          - expire_time   = 2419200 -> null
          - fqdn          = "nle.hmcts.net." -> null
          - host_name     = "ns1-05.azure-dns.com." -> null
          - minimum_ttl   = 300 -> null
          - refresh_time  = 3600 -> null
          - retry_time    = 300 -> null
          - serial_number = 1 -> null
          - tags          = {} -> null
          - ttl           = 3600 -> null
        }
    }

  # module.nle-hmcts-net.azurerm_role_assignment.dnszonecontributer must be replaced
-/+ resource "azurerm_role_assignment" "dnszonecontributer" {
      + condition_version                      = (known after apply)
      ~ id                                     = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/resourceGroups/reformMgmtRG/providers/Microsoft.Network/dnsZones/nle.hmcts.net/providers/Microsoft.Authorization/roleAssignments/f575bb67-e80f-bc4d-b4d6-8b37640149f6" -> (known after apply)
      ~ name                                   = "f575bb67-e80f-bc4d-b4d6-8b37640149f6" -> (known after apply)
      ~ principal_type                         = "Group" -> (known after apply)
      ~ role_definition_id                     = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/providers/Microsoft.Authorization/roleDefinitions/befefa01-2a29-4197-83a8-272ff33ce314" -> (known after apply)
      ~ scope                                  = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/resourceGroups/reformMgmtRG/providers/Microsoft.Network/dnsZones/nle.hmcts.net" -> (known after apply) # forces replacement
      + skip_service_principal_aad_check       = (known after apply)
        # (5 unchanged attributes hidden)
    }

  # module.public-dns.azurerm_dns_zone.zone must be replaced
-/+ resource "azurerm_dns_zone" "zone" {
      ~ id                        = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/resourceGroups/reformMgmtRG/providers/Microsoft.Network/dnsZones/nle.platform.hmcts.net" -> (known after apply)
      ~ max_number_of_record_sets = 10000 -> (known after apply)
        name                      = "nle.platform.hmcts.net"
      ~ name_servers              = [
          - "ns1-07.azure-dns.com.",
          - "ns2-07.azure-dns.net.",
          - "ns3-07.azure-dns.org.",
          - "ns4-07.azure-dns.info.",
        ] -> (known after apply)
      ~ number_of_record_sets     = 14 -> (known after apply)
      ~ resource_group_name       = "reformMgmtRG" -> "reformmgmtrg" # forces replacement
      - tags                      = {} -> null

      ~ soa_record (known after apply)
      - soa_record {
          - email         = "azuredns-hostmaster.microsoft.com" -> null
          - expire_time   = 2419200 -> null
          - fqdn          = "nle.platform.hmcts.net." -> null
          - host_name     = "ns1-07.azure-dns.com." -> null
          - minimum_ttl   = 300 -> null
          - refresh_time  = 3600 -> null
          - retry_time    = 300 -> null
          - serial_number = 1 -> null
          - tags          = {} -> null
          - ttl           = 3600 -> null
        }
    }

  # module.public-dns.azurerm_role_assignment.dnszonecontributer must be replaced
-/+ resource "azurerm_role_assignment" "dnszonecontributer" {
      + condition_version                      = (known after apply)
      ~ id                                     = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/resourceGroups/reformMgmtRG/providers/Microsoft.Network/dnsZones/nle.platform.hmcts.net/providers/Microsoft.Authorization/roleAssignments/6e81fe88-7d2e-98ba-3113-6e99f9525e35" -> (known after apply)
      ~ name                                   = "6e81fe88-7d2e-98ba-3113-6e99f9525e35" -> (known after apply)
      ~ principal_type                         = "Group" -> (known after apply)
      ~ role_definition_id                     = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/providers/Microsoft.Authorization/roleDefinitions/befefa01-2a29-4197-83a8-272ff33ce314" -> (known after apply)
      ~ scope                                  = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/resourceGroups/reformMgmtRG/providers/Microsoft.Network/dnsZones/nle.platform.hmcts.net" -> (known after apply) # forces replacement
      + skip_service_principal_aad_check       = (known after apply)
        # (5 unchanged attributes hidden)
    }

Plan: 4 to add, 0 to change, 4 to destroy.

hmcts-platform-operations · 2025-09-22T07:03:39Z

Plan Result (278: Test - TerraformPlanApply)

No changes. Your infrastructure matches the configuration.

hmcts-platform-operations · 2025-09-22T07:03:40Z

Plan Result (278: Demo - TerraformPlanApply)

No changes. Your infrastructure matches the configuration.

hmcts-platform-operations · 2025-09-22T07:03:41Z

Plan Result (278: Prod - TerraformPlanApply)

⚠️ Resource Deletion will happen

This plan contains resource delete operation. Please check the plan result very carefully!

Plan: 114 to add, 1 to change, 114 to destroy.

Update
- module.prod-platform.azurerm_dns_cname_record.this["_ac285a78514b19d657b18c29b98f4c7f.vh-admin-web"]
Replace
- module.appeal-benefit.azurerm_dns_zone.zone
- module.appeal-benefit.azurerm_role_assignment.dnszonecontributer
- module.appeal-immigration.azurerm_dns_zone.zone
- module.appeal-immigration.azurerm_role_assignment.dnszonecontributer
- module.appeal-infected-blood-compensation-decision.azurerm_dns_zone.zone
- module.appeal-infected-blood-compensation-decision.azurerm_role_assignment.dnszonecontributer
- module.appeal-tax-tribunal.azurerm_dns_zone.zone
- module.appeal-tax-tribunal.azurerm_role_assignment.dnszonecontributer
- module.apply-divorce.azurerm_dns_zone.zone
- module.apply-divorce.azurerm_role_assignment.dnszonecontributer
- module.apply-for-probate.azurerm_dns_zone.zone
- module.apply-for-probate.azurerm_role_assignment.dnszonecontributer
- module.apply-to-adopt-a-child-placed-in-your-care.azurerm_dns_zone.zone
- module.apply-to-adopt-a-child-placed-in-your-care.azurerm_role_assignment.dnszonecontributer
- module.apply-to-court-about-child-arrangements-c100.azurerm_dns_zone.zone
- module.apply-to-court-about-child-arrangements-c100.azurerm_role_assignment.dnszonecontributer
- module.apps-hmcts.azurerm_dns_zone.zone
- module.apps-hmcts.azurerm_role_assignment.dnszonecontributer
- module.apps-nle-hmcts.azurerm_dns_zone.zone
- module.apps-nle-hmcts.azurerm_role_assignment.dnszonecontributer
- module.c100-application.azurerm_dns_zone.zone
- module.c100-application.azurerm_role_assignment.dnszonecontributer
- module.casetracker.azurerm_dns_zone.zone
- module.casetracker.azurerm_role_assignment.dnszonecontributer
- module.certificatedbailiffs.azurerm_dns_zone.zone
- module.certificatedbailiffs.azurerm_role_assignment.dnszonecontributer
- module.cjscp_org_uk.azurerm_dns_zone.zone
- module.cjscp_org_uk.azurerm_role_assignment.dnszonecontributer
- module.claim-employment-tribunals.azurerm_dns_zone.zone
- module.claim-employment-tribunals.azurerm_role_assignment.dnszonecontributer
- module.courtfines.azurerm_dns_zone.zone
- module.courtfines.azurerm_role_assignment.dnszonecontributer
- module.courtfines_justice.azurerm_dns_zone.zone
- module.courtfines_justice.azurerm_role_assignment.dnszonecontributer
- module.ctsc-hmcts.azurerm_dns_zone.zone
- module.ctsc-hmcts.azurerm_role_assignment.dnszonecontributer
- module.darts-nle-service.azurerm_dns_zone.zone
- module.darts-nle-service.azurerm_role_assignment.dnszonecontributer
- module.darts-service.azurerm_dns_zone.zone
- module.darts-service.azurerm_role_assignment.dnszonecontributer
- module.ejudiciary_net.azurerm_dns_zone.zone
- module.ejudiciary_net.azurerm_role_assignment.dnszonecontributer
- module.employment-tribunals.azurerm_dns_zone.zone
- module.employment-tribunals.azurerm_role_assignment.dnszonecontributer
- module.end-civil-partnership.azurerm_dns_zone.zone
- module.end-civil-partnership.azurerm_role_assignment.dnszonecontributer
- module.erupload-justice.azurerm_dns_zone.zone
- module.erupload-justice.azurerm_role_assignment.dnszonecontributer
- module.eruploadtest-justice.azurerm_dns_zone.zone
- module.eruploadtest-justice.azurerm_role_assignment.dnszonecontributer
- module.find-court-tribunal.azurerm_dns_zone.zone
- module.find-court-tribunal.azurerm_role_assignment.dnszonecontributer
- module.hearings.azurerm_dns_zone.zone
- module.hearings.azurerm_role_assignment.dnszonecontributer
- module.hearings_reform_hmcts_net.azurerm_dns_zone.zone
- module.hearings_reform_hmcts_net.azurerm_role_assignment.dnszonecontributer
- module.helpwithcourtfees.azurerm_dns_zone.zone
- module.helpwithcourtfees.azurerm_role_assignment.dnszonecontributer
- module.hmcts-access.azurerm_dns_zone.zone
- module.hmcts-access.azurerm_role_assignment.dnszonecontributer
- module.hmcts-webchat.azurerm_dns_zone.zone
- module.hmcts-webchat.azurerm_role_assignment.dnszonecontributer
- module.hmcts_net.azurerm_dns_zone.zone
- module.hmcts_net.azurerm_role_assignment.dnszonecontributer
- module.immigrationappealsonline.azurerm_dns_zone.zone
- module.immigrationappealsonline.azurerm_role_assignment.dnszonecontributer
- module.internal-hmcts.azurerm_dns_zone.zone
- module.internal-hmcts.azurerm_role_assignment.dnszonecontributer
- module.jcm-judiciary.azurerm_dns_zone.zone
- module.jcm-judiciary.azurerm_role_assignment.dnszonecontributer
- module.juror-bureau.azurerm_dns_zone.zone
- module.juror-bureau.azurerm_role_assignment.dnszonecontributer
- module.mailrelay-platform-hmcts.azurerm_dns_zone.zone
- module.mailrelay-platform-hmcts.azurerm_role_assignment.dnszonecontributer
- module.manage-your-support-for-hmcts-services.azurerm_dns_zone.zone
- module.manage-your-support-for-hmcts-services.azurerm_role_assignment.dnszonecontributer
- module.mft-hmcts.azurerm_dns_zone.zone
- module.mft-hmcts.azurerm_role_assignment.dnszonecontributer
- module.moneyclaims.azurerm_dns_zone.zone
- module.moneyclaims.azurerm_role_assignment.dnszonecontributer
- module.pip-court-tribunal-hearings.azurerm_dns_zone.zone
- module.pip-court-tribunal-hearings.azurerm_role_assignment.dnszonecontributer
- module.platform-hmcts.azurerm_dns_zone.zone
- module.platform-hmcts.azurerm_role_assignment.dnszonecontributer
- module.pre-recorded-evidence-justice.azurerm_dns_zone.zone
- module.pre-recorded-evidence-justice.azurerm_role_assignment.dnszonecontributer
- module.probatesearch.azurerm_dns_zone.zone
- module.probatesearch.azurerm_role_assignment.dnszonecontributer
- module.prod-hmcts-net.azurerm_dns_zone.zone
- module.prod-hmcts-net.azurerm_role_assignment.dnszonecontributer
- module.prod-internal.azurerm_dns_zone.zone
- module.prod-internal.azurerm_role_assignment.dnszonecontributer
- module.prod-platform.azurerm_dns_zone.zone
- module.prod-platform.azurerm_role_assignment.dnszonecontributer
- module.reform-hmcts.azurerm_dns_zone.zone
- module.reform-hmcts.azurerm_role_assignment.dnszonecontributer
- module.reply-jury-summons.azurerm_dns_zone.zone
- module.reply-jury-summons.azurerm_role_assignment.dnszonecontributer
- module.residential-property-tribunals.azurerm_dns_zone.zone
- module.residential-property-tribunals.azurerm_role_assignment.dnszonecontributer
- module.respond-divorce.azurerm_dns_zone.zone
- module.respond-divorce.azurerm_role_assignment.dnszonecontributer
- module.respond-employment-tribunals.azurerm_dns_zone.zone
- module.respond-employment-tribunals.azurerm_role_assignment.dnszonecontributer
- module.sftp-hmcts.azurerm_dns_zone.zone
- module.sftp-hmcts.azurerm_role_assignment.dnszonecontributer
- module.special-tribunals.azurerm_dns_zone.zone
- module.special-tribunals.azurerm_role_assignment.dnszonecontributer
- module.track-benefit-appeal.azurerm_dns_zone.zone
- module.track-benefit-appeal.azurerm_role_assignment.dnszonecontributer
- module.tribunalsdecisions.azurerm_dns_zone.zone
- module.tribunalsdecisions.azurerm_role_assignment.dnszonecontributer
- module.vh.azurerm_dns_zone.zone
- module.vh.azurerm_role_assignment.dnszonecontributer

Change Result (Click me)

⚠️ The content is omitted as it is too long. ⚠️

  # module.appeal-benefit.azurerm_dns_zone.zone must be replaced
-/+ resource "azurerm_dns_zone" "zone" {
      ~ id                        = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/resourceGroups/reformMgmtRG/providers/Microsoft.Network/dnsZones/appeal-benefit-decision.service.gov.uk" -> (known after apply)
      ~ max_number_of_record_sets = 10000 -> (known after apply)
        name                      = "appeal-benefit-decision.service.gov.uk"
      ~ name_servers              = [
          - "ns1-09.azure-dns.com.",
          - "ns2-09.azure-dns.net.",
          - "ns3-09.azure-dns.org.",
          - "ns4-09.azure-dns.info.",
        ] -> (known after apply)
      ~ number_of_record_sets     = 13 -> (known after apply)
      ~ resource_group_name       = "reformMgmtRG" -> "reformmgmtrg" # forces replacement
      - tags                      = {} -> null

      ~ soa_record (known after apply)
      - soa_record {
          - email         = "azuredns-hostmaster.microsoft.com" -> null
          - expire_time   = 2419200 -> null
          - fqdn          = "appeal-benefit-decision.service.gov.uk." -> null
          - host_name     = "ns1-09.azure-dns.com." -> null
          - minimum_ttl   = 300 -> null
          - refresh_time  = 3600 -> null
          - retry_time    = 300 -> null
          - serial_number = 1 -> null
          - tags          = {} -> null
          - ttl           = 3600 -> null
        }
    }

  # module.appeal-benefit.azurerm_role_assignment.dnszonecontributer must be replaced
-/+ resource "azurerm_role_assignment" "dnszonecontributer" {
      + condition_version                      = (known after apply)
      ~ id                                     = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/resourceGroups/reformMgmtRG/providers/Microsoft.Network/dnsZones/appeal-benefit-decision.service.gov.uk/providers/Microsoft.Authorization/roleAssignments/9cec249b-557c-6288-f7d6-b70738ee8a96" -> (known after apply)
      ~ name                                   = "9cec249b-557c-6288-f7d6-b70738ee8a96" -> (known after apply)
      ~ principal_type                         = "Group" -> (known after apply)
      ~ role_definition_id                     = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/providers/Microsoft.Authorization/roleDefinitions/befefa01-2a29-4197-83a8-272ff33ce314" -> (known after apply)
      ~ scope                                  = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/resourceGroups/reformMgmtRG/providers/Microsoft.Network/dnsZones/appeal-benefit-decision.service.gov.uk" -> (known after apply) # forces replacement
      + skip_service_principal_aad_check       = (known after apply)
        # (5 unchanged attributes hidden)
    }

  # module.appeal-immigration.azurerm_dns_zone.zone must be replaced
-/+ resource "azurerm_dns_zone" "zone" {
      ~ id                        = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/resourceGroups/reformMgmtRG/providers/Microsoft.Network/dnsZones/appeal-immigration-asylum-decision.service.gov.uk" -> (known after apply)
      ~ max_number_of_record_sets = 10000 -> (known after apply)
        name                      = "appeal-immigration-asylum-decision.service.gov.uk"
      ~ name_servers              = [
          - "ns1-07.azure-dns.com.",
          - "ns2-07.azure-dns.net.",
          - "ns3-07.azure-dns.org.",
          - "ns4-07.azure-dns.info.",
        ] -> (known after apply)
      ~ number_of_record_sets     = 6 -> (known after apply)
      ~ resource_group_name       = "reformMgmtRG" -> "reformmgmtrg" # forces replacement
      - tags                      = {} -> null

      ~ soa_record (known after apply)
      - soa_record {
          - email         = "azuredns-hostmaster.microsoft.com" -> null
          - expire_time   = 2419200 -> null
          - fqdn          = "appeal-immigration-asylum-decision.service.gov.uk." -> null
          - host_name     = "ns1-07.azure-dns.com." -> null
          - minimum_ttl   = 300 -> null
          - refresh_time  = 3600 -> null
          - retry_time    = 300 -> null
          - serial_number = 1 -> null
          - tags          = {} -> null
          - ttl           = 3600 -> null
        }
    }

  # module.appeal-immigration.azurerm_role_assignment.dnszonecontributer must be replaced
-/+ resource "azurerm_role_assignment" "dnszonecontributer" {
      + condition_version                      = (known after apply)
      ~ id                                     = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/resourceGroups/reformMgmtRG/providers/Microsoft.Network/dnsZones/appeal-immigration-asylum-decision.service.gov.uk/providers/Microsoft.Authorization/roleAssignments/2cec231a-eaae-4eba-06cb-550cb404f1a5" -> (known after apply)
      ~ name                                   = "2cec231a-eaae-4eba-06cb-550cb404f1a5" -> (known after apply)
      ~ principal_type                         = "Group" -> (known after apply)
      ~ role_definition_id                     = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/providers/Microsoft.Authorization/roleDefinitions/befefa01-2a29-4197-83a8-272ff33ce314" -> (known after apply)
      ~ scope                                  = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/resourceGroups/reformMgmtRG/providers/Microsoft.Network/dnsZones/appeal-immigration-asylum-decision.service.gov.uk" -> (known after apply) # forces replacement
      + skip_service_principal_aad_check       = (known after apply)
        # (5 unchanged attributes hidden)
    }

  # module.appeal-infected-blood-compensation-decision.azurerm_dns_zone.zone must be replaced
-/+ resource "azurerm_dns_zone" "zone" {
      ~ id                        = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/resourceGroups/reformMgmtRG/providers/Microsoft.Network/dnsZones/appeal-infected-blood-compensation-decision.service.gov.uk" -> (known after apply)
      ~ max_number_of_record_sets = 10000 -> (known after apply)
        name                      = "appeal-infected-blood-compensation-decision.service.gov.uk"
      ~ name_servers              = [
          - "ns1-09.azure-dns.com.",
          - "ns2-09.azure-dns.net.",
          - "ns3-09.azure-dns.org.",
          - "ns4-09.azure-dns.info.",
        ] -> (known after apply)
      ~ number_of_record_sets     = 9 -> (known after apply)
      ~ resource_group_name       = "reformMgmtRG" -> "reformmgmtrg" # forces replacement
      - tags                      = {} -> null

      ~ soa_record (known after apply)
      - soa_record {
          - email         = "azuredns-hostmaster.microsoft.com" -> null
          - expire_time   = 2419200 -> null
          - fqdn          = "appeal-infected-blood-compensation-decision.service.gov.uk." -> null
          - host_name     = "ns1-09.azure-dns.com." -> null
          - minimum_ttl   = 300 -> null
          - refresh_time  = 3600 -> null
          - retry_time    = 300 -> null
          - serial_number = 1 -> null
          - tags          = {} -> null
          - ttl           = 3600 -> null
        }
    }

  # module.appeal-infected-blood-compensation-decision.azurerm_role_assignment.dnszonecontributer must be replaced
-/+ resource "azurerm_role_assignment" "dnszonecontributer" {
      + condition_version                      = (known after apply)
      ~ id                                     = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/resourceGroups/reformMgmtRG/providers/Microsoft.Network/dnsZones/appeal-infected-blood-compensation-decision.service.gov.uk/providers/Microsoft.Authorization/roleAssignments/0ae9071a-4d5a-e9b4-b355-25324ad55424" -> (known after apply)
      ~ name                                   = "0ae9071a-4d5a-e9b4-b355-25324ad55424" -> (known after apply)
      ~ principal_type                         = "Group" -> (known after apply)
      ~ role_definition_id                     = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/providers/Microsoft.Authorization/roleDefinitions/befefa01-2a29-4197-83a8-272ff33ce314" -> (known after apply)
      ~ scope                                  = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/resourceGroups/reformMgmtRG/providers/Microsoft.Network/dnsZones/appeal-infected-blood-compensation-decision.service.gov.uk" -> (known after apply) # forces replacement
      + skip_service_principal_aad_check       = (known after apply)
        # (5 unchanged attributes hidden)
    }

  # module.appeal-tax-tribunal.azurerm_dns_zone.zone must be replaced
-/+ resource "azurerm_dns_zone" "zone" {
      ~ id                        = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/resourceGroups/reformMgmtRG/providers/Microsoft.Network/dnsZones/appeal-tax-tribunal.service.gov.uk" -> (known after apply)
      ~ max_number_of_record_sets = 10000 -> (known after apply)
        name                      = "appeal-tax-tribunal.service.gov.uk"
      ~ name_servers              = [
          - "ns1-36.azure-dns.com.",
          - "ns2-36.azure-dns.net.",
          - "ns3-36.azure-dns.org.",
          - "ns4-36.azure-dns.info.",
        ] -> (known after apply)
      ~ number_of_record_sets     = 8 -> (known after apply)
      ~ resource_group_name       = "reformMgmtRG" -> "reformmgmtrg" # forces replacement
      - tags                      = {} -> null

      ~ soa_record (known after apply)
      - soa_record {
          - email         = "azuredns-hostmaster.microsoft.com" -> null
          - expire_time   = 2419200 -> null
          - fqdn          = "appeal-tax-tribunal.service.gov.uk." -> null
          - host_name     = "ns1-36.azure-dns.com." -> null
          - minimum_ttl   = 300 -> null
          - refresh_time  = 3600 -> null
          - retry_time    = 300 -> null
          - serial_number = 1 -> null
          - tags          = {} -> null
          - ttl           = 3600 -> null
        }
    }

  # module.appeal-tax-tribunal.azurerm_role_assignment.dnszonecontributer must be replaced
-/+ resource "azurerm_role_assignment" "dnszonecontributer" {
      + condition_version                      = (known after apply)
      ~ id                                     = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/resourceGroups/reformMgmtRG/providers/Microsoft.Network/dnsZones/appeal-tax-tribunal.service.gov.uk/providers/Microsoft.Authorization/roleAssignments/a4c788a8-7802-024a-6aee-14bb1c8fc74d" -> (known after apply)
      ~ name                                   = "a4c788a8-7802-024a-6aee-14bb1c8fc74d" -> (known after apply)
      ~ principal_type                         = "Group" -> (known after apply)
      ~ role_definition_id                     = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/providers/Microsoft.Authorization/roleDefinitions/befefa01-2a29-4197-83a8-272ff33ce314" -> (known after apply)
      ~ scope                                  = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/resourceGroups/reformMgmtRG/providers/Microsoft.Network/dnsZones/appeal-tax-tribunal.service.gov.uk" -> (known after apply) # forces replacement
      + skip_service_principal_aad_check       = (known after apply)
        # (5 unchanged attributes hidden)
    }

  # module.apply-divorce.azurerm_dns_zone.zone must be replaced
-/+ resource "azurerm_dns_zone" "zone" {
      ~ id                        = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/resourceGroups/reformMgmtRG/providers/Microsoft.Network/dnsZones/apply-divorce.service.gov.uk" -> (known after apply)
      ~ max_number_of_record_sets = 10000 -> (known after apply)
        name                      = "apply-divorce.service.gov.uk"
      ~ name_servers              = [
          - "ns1-03.azure-dns.com.",
          - "ns2-03.azure-dns.net.",
          - "ns3-03.azure-dns.org.",
          - "ns4-03.azure-dns.info.",
        ] -> (known after apply)
      ~ number_of_record_sets     = 25 -> (known after apply)
      ~ resource_group_name       = "reformMgmtRG" -> "reformmgmtrg" # forces replacement
      - tags                      = {} -> null

      ~ soa_record (known after apply)
      - soa_record {
          - email         = "azuredns-hostmaster.microsoft.com" -> null
          - expire_time   = 2419200 -> null
          - fqdn          = "apply-divorce.service.gov.uk." -> null
          - host_name     = "ns1-03.azure-dns.com." -> null
          - minimum_ttl   = 300 -> null
          - refresh_time  = 3600 -> null
          - retry_time    = 300 -> null
          - serial_number = 1 -> null
          - tags          = {} -> null
          - ttl           = 3600 -> null
        }
    }

  # module.apply-divorce.azurerm_role_assignment.dnszonecontributer must be replaced
-/+ resource "azurerm_role_assignment" "dnszonecontributer" {
      + condition_version                      = (known after apply)
      ~ id                                     = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/resourceGroups/reformMgmtRG/providers/Microsoft.Network/dnsZones/apply-divorce.service.gov.uk/providers/Microsoft.Authorization/roleAssignments/a051dbd2-a188-5365-b161-4a2c76c74757" -> (known after apply)
      ~ name                                   = "a051dbd2-a188-5365-b161-4a2c76c74757" -> (known after apply)
      ~ principal_type                         = "Group" -> (known after apply)
      ~ role_definition_id                     = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/providers/Microsoft.Authorization/roleDefinitions/befefa01-2a29-4197-83a8-272ff33ce314" -> (known after apply)
      ~ scope                                  = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/resourceGroups/reformMgmtRG/providers/Microsoft.Network/dnsZones/apply-divorce.service.gov.uk" -> (known after apply) # forces replacement
      + skip_service_principal_aad_check       = (known after apply)
        # (5 unchanged attributes hidden)
    }

  # module.apply-for-probate.azurerm_dns_zone.zone must be replaced
-/+ resource "azurerm_dns_zone" "zone" {
      ~ id                        = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/resourceGroups/reformMgmtRG/providers/Microsoft.Network/dnsZones/apply-for-probate.service.gov.uk" -> (known after apply)
      ~ max_number_of_record_sets = 10000 -> (known after apply)
        name                      = "apply-for-probate.service.gov.uk"
      ~ name_servers              = [
          - "ns1-01.azure-dns.com.",
          - "ns2-01.azure-dns.net.",
          - "ns3-01.azure-dns.org.",
          - "ns4-01.azure-dns.info.",
        ] -> (known after apply)
      ~ number_of_record_sets     = 7 -> (known after apply)
      ~ resource_group_name       = "reformMgmtRG" -> "reformmgmtrg" # forces replacement
      - tags                      = {} -> null

      ~ soa_record (known after apply)
      - soa_record {
          - email         = "azuredns-hostmaster.microsoft.com" -> null
          - expire_time   = 2419200 -> null
          - fqdn          = "apply-for-probate.service.gov.uk." -> null
          - host_name     = "ns1-01.azure-dns.com." -> null
          - minimum_ttl   = 300 -> null
          - refresh_time  = 3600 -> null
          - retry_time    = 300 -> null
          - serial_number = 1 -> null
          - tags          = {} -> null
          - ttl           = 3600 -> null
        }
    }

  # module.apply-for-probate.azurerm_role_assignment.dnszonecontributer must be replaced
-/+ resource "azurerm_role_assignment" "dnszonecontributer" {
      + condition_version                      = (known after apply)
      ~ id                                     = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/resourceGroups/reformMgmtRG/providers/Microsoft.Network/dnsZones/apply-for-probate.service.gov.uk/providers/Microsoft.Authorization/roleAssignments/a9a10efe-fedb-8aaa-60da-311cd89c9f74" -> (known after apply)
      ~ name                                   = "a9a10efe-fedb-8aaa-60da-311cd89c9f74" -> (known after apply)
      ~ principal_type                         = "Group" -> (known after apply)
      ~ role_definition_id                     = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/providers/Microsoft.Authorization/roleDefinitions/befefa01-2a29-4197-83a8-272ff33ce314" -> (known after apply)
      ~ scope                                  = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/resourceGroups/reformMgmtRG/providers/Microsoft.Network/dnsZones/apply-for-probate.service.gov.uk" -> (known after apply) # forces replacement
      + skip_service_principal_aad_check       = (known after apply)
        # (5 unchanged attributes hidden)
    }

  # module.apply-to-adopt-a-child-placed-in-your-care.azurerm_dns_zone.zone must be replaced
-/+ resource "azurerm_dns_zone" "zone" {
      ~ id                        = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/resourceGroups/reformMgmtRG/providers/Microsoft.Network/dnsZones/apply-to-adopt-a-child-placed-in-your-care.service.gov.uk" -> (known after apply)
      ~ max_number_of_record_sets = 10000 -> (known after apply)
        name                      = "apply-to-adopt-a-child-placed-in-your-care.service.gov.uk"
      ~ name_servers              = [
          - "ns1-36.azure-dns.com.",
          - "ns2-36.azure-dns.net.",
          - "ns3-36.azure-dns.org.",
          - "ns4-36.azure-dns.info.",
        ] -> (known after apply)
      ~ number_of_record_sets     = 8 -> (known after apply)
      ~ resource_group_name       = "reformMgmtRG" -> "reformmgmtrg" # forces replacement
      - tags                      = {} -> null

      ~ soa_record (known after apply)
      - soa_record {
          - email         = "azuredns-hostmaster.microsoft.com" -> null
          - expire_time   = 2419200 -> null
          - fqdn          = "apply-to-adopt-a-child-placed-in-your-care.service.gov.uk." -> null
          - host_name     = "ns1-36.azure-dns.com." -> null
          - minimum_ttl   = 300 -> null
          - refresh_time  = 3600 -> null
          - retry_time    = 300 -> null
          - serial_number = 1 -> null
          - tags          = {} -> null
          - ttl           = 3600 -> null
        }
    }

  # module.apply-to-adopt-a-child-placed-in-your-care.azurerm_role_assignment.dnszonecontributer must be replaced
-/+ resource "azurerm_role_assignment" "dnszonecontributer" {
      + condition_version                      = (known after apply)
      ~ id                                     = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/resourceGroups/reformMgmtRG/providers/Microsoft.Network/dnsZones/apply-to-adopt-a-child-placed-in-your-care.service.gov.uk/providers/Microsoft.Authorization/roleAssignments/abc3392f-ea20-dfa2-ffb0-9690e64de890" -> (known after apply)
      ~ name                                   = "abc3392f-ea20-dfa2-ffb0-9690e64de890" -> (known after apply)
      ~ principal_type                         = "Group" -> (known after apply)
      ~ role_definition_id                     = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/providers/Microsoft.Authorization/roleDefinitions/befefa01-2a29-4197-83a8-272ff33ce314" -> (known after apply)
      ~ scope                                  = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/resourceGroups/reformMgmtRG/providers/Microsoft.Network/dnsZones/apply-to-adopt-a-child-placed-in-your-care.service.gov.uk" -> (known after apply) # forces replacement
      + skip_service_principal_aad_check       = (known after apply)
        # (5 unchanged attributes hidden)
    }

  # module.apply-to-court-about-child-arrangements-c100.azurerm_dns_zone.zone must be replaced
-/+ resource "azurerm_dns_zone" "zone" {
      ~ id                        = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/resourceGroups/reformMgmtRG/providers/Microsoft.Network/dnsZones/apply-to-court-about-child-arrangements-c100.service.gov.uk" -> (known after apply)
      ~ ma

# ...
# ... The maximum length of GitHub Comment is 65536, so the content is omitted by tfcmt.
# ...

sidential-property-tribunals.service.gov.uk/providers/Microsoft.Authorization/roleAssignments/1fccdcbb-d8d3-f8f4-10c0-c3d38c2c8614" -> (known after apply)
      ~ name                                   = "1fccdcbb-d8d3-f8f4-10c0-c3d38c2c8614" -> (known after apply)
      ~ principal_type                         = "Group" -> (known after apply)
      ~ role_definition_id                     = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/providers/Microsoft.Authorization/roleDefinitions/befefa01-2a29-4197-83a8-272ff33ce314" -> (known after apply)
      ~ scope                                  = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/resourceGroups/reformMgmtRG/providers/Microsoft.Network/dnsZones/residential-property-tribunals.service.gov.uk" -> (known after apply) # forces replacement
      + skip_service_principal_aad_check       = (known after apply)
        # (5 unchanged attributes hidden)
    }

  # module.respond-divorce.azurerm_dns_zone.zone must be replaced
-/+ resource "azurerm_dns_zone" "zone" {
      ~ id                        = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/resourceGroups/reformMgmtRG/providers/Microsoft.Network/dnsZones/respond-divorce.service.gov.uk" -> (known after apply)
      ~ max_number_of_record_sets = 10000 -> (known after apply)
        name                      = "respond-divorce.service.gov.uk"
      ~ name_servers              = [
          - "ns1-06.azure-dns.com.",
          - "ns2-06.azure-dns.net.",
          - "ns3-06.azure-dns.org.",
          - "ns4-06.azure-dns.info.",
        ] -> (known after apply)
      ~ number_of_record_sets     = 6 -> (known after apply)
      ~ resource_group_name       = "reformMgmtRG" -> "reformmgmtrg" # forces replacement
      - tags                      = {} -> null

      ~ soa_record (known after apply)
      - soa_record {
          - email         = "azuredns-hostmaster.microsoft.com" -> null
          - expire_time   = 2419200 -> null
          - fqdn          = "respond-divorce.service.gov.uk." -> null
          - host_name     = "ns1-06.azure-dns.com." -> null
          - minimum_ttl   = 300 -> null
          - refresh_time  = 3600 -> null
          - retry_time    = 300 -> null
          - serial_number = 1 -> null
          - tags          = {} -> null
          - ttl           = 3600 -> null
        }
    }

  # module.respond-divorce.azurerm_role_assignment.dnszonecontributer must be replaced
-/+ resource "azurerm_role_assignment" "dnszonecontributer" {
      + condition_version                      = (known after apply)
      ~ id                                     = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/resourceGroups/reformMgmtRG/providers/Microsoft.Network/dnsZones/respond-divorce.service.gov.uk/providers/Microsoft.Authorization/roleAssignments/80d8c5be-6a12-d6f0-bbee-39066ba0ac4f" -> (known after apply)
      ~ name                                   = "80d8c5be-6a12-d6f0-bbee-39066ba0ac4f" -> (known after apply)
      ~ principal_type                         = "Group" -> (known after apply)
      ~ role_definition_id                     = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/providers/Microsoft.Authorization/roleDefinitions/befefa01-2a29-4197-83a8-272ff33ce314" -> (known after apply)
      ~ scope                                  = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/resourceGroups/reformMgmtRG/providers/Microsoft.Network/dnsZones/respond-divorce.service.gov.uk" -> (known after apply) # forces replacement
      + skip_service_principal_aad_check       = (known after apply)
        # (5 unchanged attributes hidden)
    }

  # module.respond-employment-tribunals.azurerm_dns_zone.zone must be replaced
-/+ resource "azurerm_dns_zone" "zone" {
      ~ id                        = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/resourceGroups/reformMgmtRG/providers/Microsoft.Network/dnsZones/respond-employment-tribunals.service.gov.uk" -> (known after apply)
      ~ max_number_of_record_sets = 10000 -> (known after apply)
        name                      = "respond-employment-tribunals.service.gov.uk"
      ~ name_servers              = [
          - "ns1-04.azure-dns.com.",
          - "ns2-04.azure-dns.net.",
          - "ns3-04.azure-dns.org.",
          - "ns4-04.azure-dns.info.",
        ] -> (known after apply)
      ~ number_of_record_sets     = 8 -> (known after apply)
      ~ resource_group_name       = "reformMgmtRG" -> "reformmgmtrg" # forces replacement
      - tags                      = {} -> null

      ~ soa_record (known after apply)
      - soa_record {
          - email         = "azuredns-hostmaster.microsoft.com" -> null
          - expire_time   = 2419200 -> null
          - fqdn          = "respond-employment-tribunals.service.gov.uk." -> null
          - host_name     = "ns1-04.azure-dns.com." -> null
          - minimum_ttl   = 300 -> null
          - refresh_time  = 3600 -> null
          - retry_time    = 300 -> null
          - serial_number = 1 -> null
          - tags          = {} -> null
          - ttl           = 3600 -> null
        }
    }

  # module.respond-employment-tribunals.azurerm_role_assignment.dnszonecontributer must be replaced
-/+ resource "azurerm_role_assignment" "dnszonecontributer" {
      + condition_version                      = (known after apply)
      ~ id                                     = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/resourceGroups/reformMgmtRG/providers/Microsoft.Network/dnsZones/respond-employment-tribunals.service.gov.uk/providers/Microsoft.Authorization/roleAssignments/42687a96-4675-7d04-d8bc-427162eb9317" -> (known after apply)
      ~ name                                   = "42687a96-4675-7d04-d8bc-427162eb9317" -> (known after apply)
      ~ principal_type                         = "Group" -> (known after apply)
      ~ role_definition_id                     = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/providers/Microsoft.Authorization/roleDefinitions/befefa01-2a29-4197-83a8-272ff33ce314" -> (known after apply)
      ~ scope                                  = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/resourceGroups/reformMgmtRG/providers/Microsoft.Network/dnsZones/respond-employment-tribunals.service.gov.uk" -> (known after apply) # forces replacement
      + skip_service_principal_aad_check       = (known after apply)
        # (5 unchanged attributes hidden)
    }

  # module.sftp-hmcts.azurerm_dns_zone.zone must be replaced
-/+ resource "azurerm_dns_zone" "zone" {
      ~ id                        = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/resourceGroups/reformMgmtRG/providers/Microsoft.Network/dnsZones/sftp.hmcts.net" -> (known after apply)
      ~ max_number_of_record_sets = 10000 -> (known after apply)
        name                      = "sftp.hmcts.net"
      ~ name_servers              = [
          - "ns1-03.azure-dns.com.",
          - "ns2-03.azure-dns.net.",
          - "ns3-03.azure-dns.org.",
          - "ns4-03.azure-dns.info.",
        ] -> (known after apply)
      ~ number_of_record_sets     = 6 -> (known after apply)
      ~ resource_group_name       = "reformMgmtRG" -> "reformmgmtrg" # forces replacement
      - tags                      = {} -> null

      ~ soa_record (known after apply)
      - soa_record {
          - email         = "azuredns-hostmaster.microsoft.com" -> null
          - expire_time   = 2419200 -> null
          - fqdn          = "sftp.hmcts.net." -> null
          - host_name     = "ns1-03.azure-dns.com." -> null
          - minimum_ttl   = 300 -> null
          - refresh_time  = 3600 -> null
          - retry_time    = 300 -> null
          - serial_number = 1 -> null
          - tags          = {} -> null
          - ttl           = 3600 -> null
        }
    }

  # module.sftp-hmcts.azurerm_role_assignment.dnszonecontributer must be replaced
-/+ resource "azurerm_role_assignment" "dnszonecontributer" {
      + condition_version                      = (known after apply)
      ~ id                                     = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/resourceGroups/reformMgmtRG/providers/Microsoft.Network/dnsZones/sftp.hmcts.net/providers/Microsoft.Authorization/roleAssignments/702c5c8c-2cba-b7f2-8bdf-e2527b0ca758" -> (known after apply)
      ~ name                                   = "702c5c8c-2cba-b7f2-8bdf-e2527b0ca758" -> (known after apply)
      ~ principal_type                         = "Group" -> (known after apply)
      ~ role_definition_id                     = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/providers/Microsoft.Authorization/roleDefinitions/befefa01-2a29-4197-83a8-272ff33ce314" -> (known after apply)
      ~ scope                                  = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/resourceGroups/reformMgmtRG/providers/Microsoft.Network/dnsZones/sftp.hmcts.net" -> (known after apply) # forces replacement
      + skip_service_principal_aad_check       = (known after apply)
        # (5 unchanged attributes hidden)
    }

  # module.special-tribunals.azurerm_dns_zone.zone must be replaced
-/+ resource "azurerm_dns_zone" "zone" {
      ~ id                        = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/resourceGroups/reformMgmtRG/providers/Microsoft.Network/dnsZones/special-tribunals.service.gov.uk" -> (known after apply)
      ~ max_number_of_record_sets = 10000 -> (known after apply)
        name                      = "special-tribunals.service.gov.uk"
      ~ name_servers              = [
          - "ns1-01.azure-dns.com.",
          - "ns2-01.azure-dns.net.",
          - "ns3-01.azure-dns.org.",
          - "ns4-01.azure-dns.info.",
        ] -> (known after apply)
      ~ number_of_record_sets     = 14 -> (known after apply)
      ~ resource_group_name       = "reformMgmtRG" -> "reformmgmtrg" # forces replacement
      - tags                      = {} -> null

      ~ soa_record (known after apply)
      - soa_record {
          - email         = "azuredns-hostmaster.microsoft.com" -> null
          - expire_time   = 2419200 -> null
          - fqdn          = "special-tribunals.service.gov.uk." -> null
          - host_name     = "ns1-01.azure-dns.com." -> null
          - minimum_ttl   = 300 -> null
          - refresh_time  = 3600 -> null
          - retry_time    = 300 -> null
          - serial_number = 1 -> null
          - tags          = {} -> null
          - ttl           = 3600 -> null
        }
    }

  # module.special-tribunals.azurerm_role_assignment.dnszonecontributer must be replaced
-/+ resource "azurerm_role_assignment" "dnszonecontributer" {
      + condition_version                      = (known after apply)
      ~ id                                     = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/resourceGroups/reformMgmtRG/providers/Microsoft.Network/dnsZones/special-tribunals.service.gov.uk/providers/Microsoft.Authorization/roleAssignments/c6d810ff-58fd-eb79-4126-8c0f14e46cb7" -> (known after apply)
      ~ name                                   = "c6d810ff-58fd-eb79-4126-8c0f14e46cb7" -> (known after apply)
      ~ principal_type                         = "Group" -> (known after apply)
      ~ role_definition_id                     = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/providers/Microsoft.Authorization/roleDefinitions/befefa01-2a29-4197-83a8-272ff33ce314" -> (known after apply)
      ~ scope                                  = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/resourceGroups/reformMgmtRG/providers/Microsoft.Network/dnsZones/special-tribunals.service.gov.uk" -> (known after apply) # forces replacement
      + skip_service_principal_aad_check       = (known after apply)
        # (5 unchanged attributes hidden)
    }

  # module.track-benefit-appeal.azurerm_dns_zone.zone must be replaced
-/+ resource "azurerm_dns_zone" "zone" {
      ~ id                        = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/resourceGroups/reformMgmtRG/providers/Microsoft.Network/dnsZones/track-benefit-appeal.service.gov.uk" -> (known after apply)
      ~ max_number_of_record_sets = 10000 -> (known after apply)
        name                      = "track-benefit-appeal.service.gov.uk"
      ~ name_servers              = [
          - "ns1-07.azure-dns.com.",
          - "ns2-07.azure-dns.net.",
          - "ns3-07.azure-dns.org.",
          - "ns4-07.azure-dns.info.",
        ] -> (known after apply)
      ~ number_of_record_sets     = 6 -> (known after apply)
      ~ resource_group_name       = "reformMgmtRG" -> "reformmgmtrg" # forces replacement
      - tags                      = {} -> null

      ~ soa_record (known after apply)
      - soa_record {
          - email         = "azuredns-hostmaster.microsoft.com" -> null
          - expire_time   = 2419200 -> null
          - fqdn          = "track-benefit-appeal.service.gov.uk." -> null
          - host_name     = "ns1-07.azure-dns.com." -> null
          - minimum_ttl   = 300 -> null
          - refresh_time  = 3600 -> null
          - retry_time    = 300 -> null
          - serial_number = 1 -> null
          - tags          = {} -> null
          - ttl           = 3600 -> null
        }
    }

  # module.track-benefit-appeal.azurerm_role_assignment.dnszonecontributer must be replaced
-/+ resource "azurerm_role_assignment" "dnszonecontributer" {
      + condition_version                      = (known after apply)
      ~ id                                     = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/resourceGroups/reformMgmtRG/providers/Microsoft.Network/dnsZones/track-benefit-appeal.service.gov.uk/providers/Microsoft.Authorization/roleAssignments/64bc54bb-abd3-0d78-543c-05be3c41603f" -> (known after apply)
      ~ name                                   = "64bc54bb-abd3-0d78-543c-05be3c41603f" -> (known after apply)
      ~ principal_type                         = "Group" -> (known after apply)
      ~ role_definition_id                     = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/providers/Microsoft.Authorization/roleDefinitions/befefa01-2a29-4197-83a8-272ff33ce314" -> (known after apply)
      ~ scope                                  = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/resourceGroups/reformMgmtRG/providers/Microsoft.Network/dnsZones/track-benefit-appeal.service.gov.uk" -> (known after apply) # forces replacement
      + skip_service_principal_aad_check       = (known after apply)
        # (5 unchanged attributes hidden)
    }

  # module.tribunalsdecisions.azurerm_dns_zone.zone must be replaced
-/+ resource "azurerm_dns_zone" "zone" {
      ~ id                        = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/resourceGroups/reformMgmtRG/providers/Microsoft.Network/dnsZones/tribunalsdecisions.service.gov.uk" -> (known after apply)
      ~ max_number_of_record_sets = 10000 -> (known after apply)
        name                      = "tribunalsdecisions.service.gov.uk"
      ~ name_servers              = [
          - "ns1-05.azure-dns.com.",
          - "ns2-05.azure-dns.net.",
          - "ns3-05.azure-dns.org.",
          - "ns4-05.azure-dns.info.",
        ] -> (known after apply)
      ~ number_of_record_sets     = 15 -> (known after apply)
      ~ resource_group_name       = "reformMgmtRG" -> "reformmgmtrg" # forces replacement
      - tags                      = {} -> null

      ~ soa_record (known after apply)
      - soa_record {
          - email         = "azuredns-hostmaster.microsoft.com" -> null
          - expire_time   = 2419200 -> null
          - fqdn          = "tribunalsdecisions.service.gov.uk." -> null
          - host_name     = "ns1-05.azure-dns.com." -> null
          - minimum_ttl   = 300 -> null
          - refresh_time  = 3600 -> null
          - retry_time    = 300 -> null
          - serial_number = 1 -> null
          - tags          = {} -> null
          - ttl           = 3600 -> null
        }
    }

  # module.tribunalsdecisions.azurerm_role_assignment.dnszonecontributer must be replaced
-/+ resource "azurerm_role_assignment" "dnszonecontributer" {
      + condition_version                      = (known after apply)
      ~ id                                     = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/resourceGroups/reformMgmtRG/providers/Microsoft.Network/dnsZones/tribunalsdecisions.service.gov.uk/providers/Microsoft.Authorization/roleAssignments/22d2b96a-fe2e-bacf-26c9-a13ced08a2f4" -> (known after apply)
      ~ name                                   = "22d2b96a-fe2e-bacf-26c9-a13ced08a2f4" -> (known after apply)
      ~ principal_type                         = "Group" -> (known after apply)
      ~ role_definition_id                     = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/providers/Microsoft.Authorization/roleDefinitions/befefa01-2a29-4197-83a8-272ff33ce314" -> (known after apply)
      ~ scope                                  = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/resourceGroups/reformMgmtRG/providers/Microsoft.Network/dnsZones/tribunalsdecisions.service.gov.uk" -> (known after apply) # forces replacement
      + skip_service_principal_aad_check       = (known after apply)
        # (5 unchanged attributes hidden)
    }

  # module.vh.azurerm_dns_zone.zone must be replaced
-/+ resource "azurerm_dns_zone" "zone" {
      ~ id                        = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/resourceGroups/reformMgmtRG/providers/Microsoft.Network/dnsZones/vh.hmcts.net" -> (known after apply)
      ~ max_number_of_record_sets = 10000 -> (known after apply)
        name                      = "vh.hmcts.net"
      ~ name_servers              = [
          - "ns1-01.azure-dns.com.",
          - "ns2-01.azure-dns.net.",
          - "ns3-01.azure-dns.org.",
          - "ns4-01.azure-dns.info.",
        ] -> (known after apply)
      ~ number_of_record_sets     = 17 -> (known after apply)
      ~ resource_group_name       = "reformMgmtRG" -> "reformmgmtrg" # forces replacement
      - tags                      = {} -> null

      ~ soa_record (known after apply)
      - soa_record {
          - email         = "azuredns-hostmaster.microsoft.com" -> null
          - expire_time   = 2419200 -> null
          - fqdn          = "vh.hmcts.net." -> null
          - host_name     = "ns1-01.azure-dns.com." -> null
          - minimum_ttl   = 300 -> null
          - refresh_time  = 3600 -> null
          - retry_time    = 300 -> null
          - serial_number = 1 -> null
          - tags          = {} -> null
          - ttl           = 3600 -> null
        }
    }

  # module.vh.azurerm_role_assignment.dnszonecontributer must be replaced
-/+ resource "azurerm_role_assignment" "dnszonecontributer" {
      + condition_version                      = (known after apply)
      ~ id                                     = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/resourceGroups/reformMgmtRG/providers/Microsoft.Network/dnsZones/vh.hmcts.net/providers/Microsoft.Authorization/roleAssignments/993e75b5-91cb-d09b-ce6b-f127f4f4ecc1" -> (known after apply)
      ~ name                                   = "993e75b5-91cb-d09b-ce6b-f127f4f4ecc1" -> (known after apply)
      ~ principal_type                         = "Group" -> (known after apply)
      ~ role_definition_id                     = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/providers/Microsoft.Authorization/roleDefinitions/befefa01-2a29-4197-83a8-272ff33ce314" -> (known after apply)
      ~ scope                                  = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/resourceGroups/reformMgmtRG/providers/Microsoft.Network/dnsZones/vh.hmcts.net" -> (known after apply) # forces replacement
      + skip_service_principal_aad_check       = (known after apply)
        # (5 unchanged attributes hidden)
    }

Plan: 114 to add, 1 to change, 114 to destroy.

renovate bot requested a review from a team as a code owner September 22, 2025 07:00

renovate bot added the dependencies label Sep 22, 2025

renovate bot requested review from biswajitchakrabortycpp, cpareek and gunnertwin and removed request for a team September 22, 2025 07:00

hmcts-platform-operations added the 278: Sandbox - TerraformPlanApply/no-changes label Sep 22, 2025

hmcts-platform-operations added the 278: Staging - TerraformPlanApply/no-changes label Sep 22, 2025

hmcts-platform-operations added the 278: Ithc - TerraformPlanApply/no-changes label Sep 22, 2025

hmcts-platform-operations added the 278: Dev - TerraformPlanApply/no-changes label Sep 22, 2025

hmcts-platform-operations added 278: nle - TerraformPlanApply/no-changes 278: Test - TerraformPlanApply/no-changes labels Sep 22, 2025

hmcts-platform-operations added the 278: Demo - TerraformPlanApply/no-changes label Sep 22, 2025

hmcts-platform-operations added the 278: Prod - TerraformPlanApply/add-or-update label Sep 22, 2025

renovate bot force-pushed the renovate/azurerm-4.x branch 3 times, most recently from 5ff6321 to 81f5c82 Compare September 22, 2025 23:24

renovate bot changed the title ~~chore(deps): update terraform azurerm to v4.45.0~~ chore(deps): update terraform azurerm to v4.45.1 Sep 22, 2025

renovate bot force-pushed the renovate/azurerm-4.x branch 4 times, most recently from 686cae6 to 318da9b Compare September 25, 2025 16:30

renovate bot force-pushed the renovate/azurerm-4.x branch 9 times, most recently from 08ccf1d to 6ca3994 Compare February 6, 2026 19:42

renovate bot changed the title ~~chore(deps): update terraform azurerm to v4.58.0~~ chore(deps): update terraform azurerm to v4.59.0 Feb 6, 2026

renovate bot force-pushed the renovate/azurerm-4.x branch 7 times, most recently from 540ec88 to 1a2bf4f Compare February 12, 2026 21:15

renovate bot changed the title ~~chore(deps): update terraform azurerm to v4.59.0~~ chore(deps): update terraform azurerm to v4.60.0 Feb 12, 2026

renovate bot force-pushed the renovate/azurerm-4.x branch 9 times, most recently from 553d848 to 80023c9 Compare February 19, 2026 23:47

renovate bot changed the title ~~chore(deps): update terraform azurerm to v4.60.0~~ chore(deps): update terraform azurerm to v4.61.0 Feb 19, 2026

chore(deps): update terraform azurerm to v4.61.0

c3dcc8c

renovate bot force-pushed the renovate/azurerm-4.x branch from 80023c9 to c3dcc8c Compare February 20, 2026 11:17

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): update terraform azurerm to v4.61.0#2197

chore(deps): update terraform azurerm to v4.61.0#2197
renovate[bot] wants to merge 1 commit intomasterfrom
renovate/azurerm-4.x

renovate bot commented Sep 22, 2025 •

edited

Loading

Uh oh!

hmcts-platform-operations commented Sep 22, 2025 •

edited

Loading

Uh oh!

hmcts-platform-operations commented Sep 22, 2025 •

edited

Loading

Uh oh!

hmcts-platform-operations commented Sep 22, 2025 •

edited

Loading

Uh oh!

hmcts-platform-operations commented Sep 22, 2025 •

edited

Loading

Uh oh!

hmcts-platform-operations commented Sep 22, 2025 •

edited

Loading

Uh oh!

hmcts-platform-operations commented Sep 22, 2025

Uh oh!

hmcts-platform-operations commented Sep 22, 2025 •

edited

Loading

Uh oh!

hmcts-platform-operations commented Sep 22, 2025 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Comments

Conversation

renovate bot commented Sep 22, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

Configuration

Uh oh!

hmcts-platform-operations commented Sep 22, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Plan Result (278: Sandbox - TerraformPlanApply)

⚠️ Resource Deletion will happen

Uh oh!

hmcts-platform-operations commented Sep 22, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Plan Result (278: Staging - TerraformPlanApply)

⚠️ Resource Deletion will happen

Uh oh!

hmcts-platform-operations commented Sep 22, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Plan Result (278: Ithc - TerraformPlanApply)

⚠️ Resource Deletion will happen

Uh oh!

hmcts-platform-operations commented Sep 22, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Plan Result (278: Dev - TerraformPlanApply)

⚠️ Resource Deletion will happen

Uh oh!

hmcts-platform-operations commented Sep 22, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Plan Result (278: nle - TerraformPlanApply)

⚠️ Resource Deletion will happen

Uh oh!

hmcts-platform-operations commented Sep 22, 2025

Plan Result (278: Test - TerraformPlanApply)

Uh oh!

hmcts-platform-operations commented Sep 22, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Plan Result (278: Demo - TerraformPlanApply)

Uh oh!

hmcts-platform-operations commented Sep 22, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Plan Result (278: Prod - TerraformPlanApply)

⚠️ Resource Deletion will happen

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Comments

renovate bot commented Sep 22, 2025 •

edited

Loading

hmcts-platform-operations commented Sep 22, 2025 •

edited

Loading

hmcts-platform-operations commented Sep 22, 2025 •

edited

Loading

hmcts-platform-operations commented Sep 22, 2025 •

edited

Loading

hmcts-platform-operations commented Sep 22, 2025 •

edited

Loading

hmcts-platform-operations commented Sep 22, 2025 •

edited

Loading

hmcts-platform-operations commented Sep 22, 2025 •

edited

Loading

hmcts-platform-operations commented Sep 22, 2025 •

edited

Loading