Feat: ignore hidden tags on web & function apps

[pregress]

Web apps and function apps that are connected to application insights have a set of 3 hidden tags.

A new rule to add this to ignore_changes list would help to not mark a resource as changed if nothing is changed.

Willing to implement this myself if ok.

lifecycle {
    ignore_changes = [
        tags["hidden-link: /app-insights-conn-string"],
        tags["hidden-link: /app-insights-instrumentation-key"],
        tags["hidden-link: /app-insights-resource-id"],
    ]
  }

[wata727]

Thank you for raising this.
Are there any official sources for this recommendation? Terraform or Azure references would be great.

[JannoTjarks]

Hi, I think this explains it on a very high level: https://learn.microsoft.com/en-us/community/content/hidden-tags-azure.

But the real hidden tags are resource specific.

[wata727]

@JannoTjarks Thank you. If this makes sense to you, we'll be happy to accept this feature request. What do you think?

[JannoTjarks]

Hi, in my opinion a very valid feature request.

Just 3 weeks ago, I found myself in a situation where the connection string was in the hidden tag in a pull request for an application insight.
Microsoft itself probably doesn't see it as a sensitive attribute, but anyone with the connection string can upload data that could end up being at least financially relevant and generate noise in the log.

I'm just wondering if maybe you should generally throw a warning if someone implements a tag that starts with “hidden-” in the name.
So turn the topic around: No hint that the tag has to be in the ignore-changes block, but a hint that you should not write a tag with “hidden” by your own.
This also prevents you from using such tags for yourself in the team and thus running the risk of collision with Microsoft backend stuff.

The note can then point out that, if available, you should intercept the existing “hidden” tags with an ignore-changes block.

What do you think, @wata727, @pregress?

[wata727]

To be honest, I'm not an expert on Azure, so I can't judge how valid this proposal is. However, I understand that the @pregress proposal is a request to prevent changes from being triggered by implicitly added hidden tags.

So, I think there are two feature requests: a proposal to always ignore hidden tags, and a proposal to avoid using hidden tags.

I'd like to hear your opinions on how reasonable it makes for users to always enforce the former, and whether the recommendation to always avoid hidden tags is convincing.

[JannoTjarks]

@wata727 Got your take.

I totally agree with @pregress about the need for a rule regarding ignoring specific tags of an application insights:

• "hidden-link: /app-insights-conn-string"
• "hidden-link: /app-insights-instrumentation-key"
• "hidden-link: /app-insights-resource-id"

These are autogenerated by the azure and should never been overwritten.

So from my site it's a go.

(Regarding my proposal, will discuss this again with my team and will open a dedicated issue if they agree)