OpenAI deployment error "performing Delete: unexpected status 400 (400 Bad Request) with error"

Issue Description

When deploying or modifying a content filter and an associated policy for an OpenAI deployment in Azure via Terraform, the content filter fails to be replaced for a specific deployment. The following error message is encountered:

performing Delete: unexpected status 400 (400 Bad Request) with error: BadRequest: Please remove any references to this content filtering 
configuration from deployments before deleting.

This error indicates that the content filtering configuration cannot be deleted because there are still references to it in the deployment.

Impact

Unable to update the OpenAI deployment after modifying for instance changing the name of the associated policy.

Cause

Issue Context :

This behavior is expected, as outlined in the official documentation for the azurerm_cognitive_account_rai_policy resource. Changing the name of the policy triggers Terraform to create a new resource, causing it to attempt to delete the existing one (e.g., when trying to change the policy name from example-policy  to example-policy-test)

resource "azurerm_cognitive_account_rai_policy" "example" {
  name                 = "example-policy"  //changes this forces a new resource to be created
  cognitive_account_id = azurerm_cognitive_account.example.id                                       
  .
  .

  dynamic "content_filter" {
  for_each = var.content_filter

  content {

  	name               = content_filter.value.name
  	filter_enabled     = content_filter.value.filter_enabled
  	block_enabled      = content_filter.value.block_enabled
  	severity_threshold = content_filter.value.severity_threshold
  	source             = content_filter.value.source
  }
 }
}

resource "azurerm_cognitive_deployment" "example" {
  name                   = "example-cd"
  rai_policy_name        = azurerm_cognitive_account_rai_policy.example.name
  .
  .
  sku {
  name     = "GlobalStandard"
  capacity = 1000
  }
}

However, because the existing policy is already referenced in the azurerm_cognitive_deployment resource (via rai_policy_name = azurerm_cognitive_account_rai_policy.example.name), Terraform encounters an error during destruction with the following error message :

BadRequest: Please remove any references to this content filtering configuration from deployments before deleting.

This error occurs because references to the policy must be removed before the policy can be deleted.

Solutions:

Now, in order to solve this, you can use the  create_before_destroy meta-argument which changes the default terraform behaviour so that the new replacement object is created first, and the prior object is destroyed after the replacement is created.

resource "azurerm_cognitive_account_rai_policy" "example" {

  name                 = "example-rai-policy-test"

  cognitive_account_id = azurerm_cognitive_account.example.id

  .

  .

  dynamic "content_filter"{

  .

  .

  }

lifecycle {

    create_before_destroy = true

  }

}

Outcome

After adding the create_before_destroy meta argument, Terraform correctly first creates the new resource with name example-rai-policy-test and then delete the old one

Additional Information

• Details about the supported attributes for resource

  azurerm_cognitive_account_rai_policy can be found here on our official documentation.

If you are still not able to solve your issue, please reach out HCP Terraform support at

tf-cloud@hashicorp.support or submit a ticket via our support portal.