When running make tre-deploy in succession terraform updates/replaces resources that have not changed.

Describe the bug Each time run make tre-deploy terraform updates/replaces resources unnecessarily.

Steps to reproduce

1. Deploy TRE with make
2. Re run `‘make tre-deploy’ and monitor terraform output.

[marrobi]

Here’s an occurrence:

module.resource_processor_vmss_porter[0].azurerm_role_assignment.subscription_owner must be replaced
-/+ resource "azurerm_role_assignment" "subscription_owner" ***
      ~ id                               = "/subscriptions/***/providers/Microsoft.Authorization/roleAssignments/deb370d9-e9c0-6ede-a44b-1f1ee3d2146d" -> (known after apply)
      ~ name                             = "deb370d9-e9c0-6ede-a44b-1f1ee3d2146d" -> (known after apply)
      ~ principal_type                   = "ServicePrincipal" -> (known after apply)
      ~ role_definition_id               = "/subscriptions/***/providers/Microsoft.Authorization/roleDefinitions/8e3af657-a8ff-443c-a75c-2fe8c4bcb635" -> (known after apply)
      ~ scope                            = "/subscriptions/***" -> (known after apply) # forces replacement
      + skip_service_principal_aad_check = (known after apply)
        # (2 unchanged attributes hidden)
    ***

[tanya-borisova]

I’m going to close this as the remaining work is tracked in https://github.com/microsoft/AzureTRE/issues/1161