Running `make tre-stop` causes the next `make tre-deploy` to fail

Describe the bug

Running make tre-stop will cause the next make tre-deploy ran in the same environment to fail.

Steps to reproduce

1. Run make tre-deploy tre-start tre-stop
2. Run make tre-deploy again

Investigation

This seems to be due to the fact that commands make tre-start and make tre-stop are manipulating the resource fw-ip-configuration which is managed by terraform.

Because of this, Terraform wants to recreate it:

However there is also a lock on its parent resource. Because of this, Terraform fails to recreate it:

Given that the resource managed by Terraform is also modified elsewhere, I think we should add a lifecycle attribute there, to reflect the fact that the fw-ip-configuration resource is modified by processes outside Terraform:

lifecycle {
    ignore_changes = [
      ip_configuration,
    ]
  }

[daltskin]

As an interim, we could leave make tre-stop/start in place, and comment out the firewall changes from https://github.com/microsoft/AzureTRE/blob/main/devops/scripts/control_tre.sh

That way we stop the App Gateway from incurring further costs. Depends on time required for https://github.com/microsoft/AzureTRE/issues/1177

[tanya-borisova]

confused as to which it cannot create the IP - its trying to replace the entire firewall from what I can see

Confused about this as well, from what I understand this can happen if there’s no way to update the firewall in the API (or it’s not implemented in the provider). I’ll look again into this today