Enable soft delete for workspace backup Recovery Services vaults and fix core public IP lifecycle issues

CHANGELOG.md

@@ -20,6 +20,7 @@ ENHANCEMENTS:
 * Update `picomatch` package to v2.3.2 and v4.0.4 to address security vulnerabilities ([#4887](https://github.com/microsoft/AzureTRE/issues/4887))
 
 BUG FIXES:
+* Enable soft delete on workspace backup Recovery Services vaults and purge protected items on destroy to avoid deployment failures and preserve delete behavior ([#4907](https://github.com/microsoft/AzureTRE/pull/4907))
 * Fix OpenAPI/schema sample generation for `get_sample_operation` step parameters. ([#4864](https://github.com/microsoft/AzureTRE/issues/4864))
 * Fix test airlock request sample data fields and enum values. ([#4866](https://github.com/microsoft/AzureTRE/issues/4866))
 * Fix property substitution not occuring where there is only a main step in the pipeline ([#4824](https://github.com/microsoft/AzureTRE/issues/4824))
@@ -1703,4 +1704,3 @@ FEATURES:
 * Centrally manage the firewall share service state to enable other services to ask for rule changes
 
 Many more enhancements are listed on the [release page](https://github.com/microsoft/AzureTRE/releases/tag/v0.4)
-

core/terraform/appgateway/appgateway.tf

@@ -7,7 +7,7 @@ resource "azurerm_public_ip" "appgwpip" {
   domain_name_label   = var.tre_id
   tags                = local.tre_core_tags
 
-  lifecycle { ignore_changes = [tags, zones] }
+  lifecycle { ignore_changes = [tags, zones, ip_tags] }
 }
 
 resource "azurerm_user_assigned_identity" "agw_id" {

core/terraform/firewall/firewall.tf

@@ -7,7 +7,7 @@ resource "azurerm_public_ip" "fwtransit" {
   sku                 = "Standard"
   tags                = var.tre_core_tags
 
-  lifecycle { ignore_changes = [tags, zones] }
+  lifecycle { ignore_changes = [tags, zones, ip_tags] }
 }
 
 moved {

core/version.txt

@@ -1 +1 @@
-__version__ = "0.16.16"
+__version__ = "0.16.17"

templates/workspaces/base/porter.yaml

@@ -1,7 +1,7 @@
 ---
 schemaVersion: 1.0.0
 name: tre-workspace-base
-version: 2.8.3
+version: 2.8.4
 description: "A base Azure TRE workspace"
 dockerfile: Dockerfile.tmpl
 registry: azuretre

templates/workspaces/base/terraform/backup/backup.tf

@@ -4,7 +4,6 @@ resource "azurerm_recovery_services_vault" "vault" {
   location            = var.location
   resource_group_name = var.resource_group_name
   sku                 = "Standard"
-  soft_delete_enabled = false
   storage_mode_type   = "ZoneRedundant" #  Possible values are "GeoRedundant", "LocallyRedundant" and "ZoneRedundant". Defaults to "GeoRedundant".
   tags                = var.tre_workspace_tags
 

templates/workspaces/base/terraform/providers.tf

@@ -2,7 +2,7 @@ terraform {
   required_providers {
     azurerm = {
       source  = "hashicorp/azurerm"
-      version = "= 4.57.0"
+      version = "= 4.73.0"
     }
     azuread = {
       source  = "hashicorp/azuread"
@@ -33,6 +33,10 @@ provider "azurerm" {
       recover_soft_deleted_certificates = true
       recover_soft_deleted_keys         = true
     }
+    recovery_service {
+      purge_protected_items_from_vault_on_destroy          = true
+      vm_backup_stop_protection_and_retain_data_on_destroy = false
+    }
     resource_group {
       prevent_deletion_if_contains_resources = false
     }