custom_settings_by_resource_type failling to apply with azurerm_public_ip-connectitity_vpn on second PIP (pip2)

### Community Note

- Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request
- Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
- If you are interested in working on this issue or have submitted a pull request, please leave a comment

### Versions

**terraform**: 1.8.1

**azure provider**: 3.101.0

**module**: 5.2.1

### Description

I apply successfully workaround for Basic SKU for public ip address deprecation for VPN gateway (https://github.com/Azure/Azure-Landing-Zones/issues/499) using custom settings shared below and I am now able to deploy vpngateway in uksouth in AZ enabled configuration successfully with zone enabled standard static IP for pip and pip2 on my vpngateway.

When I try to apply the same workaround to deploy vpngateay in ukwest (aka non zone enabled), the custom_settings_by_resource_type is applying the workaround only on the primary IP address (aka pip). The secondary IP address (pip2) remains configured with Basic SKU which result in a failed VPN deployment.

#### Describe the bug

ALZ custom_settings_by_resource_type configuration below fail to apply configuaration on second PIP when deploying VPN gateway in non zone enabled region. This results failed deployment of VPN Gateway in non zone enabled region.

advanced = {
custom_settings_by_resource_type = {
azurerm_public_ip = {
connectivity_vpn = {
ukwest = {
sku = "Standard"
allocation_method = "Static"
},
uksouth = {
sku = "Standard"
allocation_method = "Static"
}
}
}
}

#### Steps to Reproduce

1. Setup settings.connectivity.tf with uksouth and ukwest
2. Use the advanced settings shared above
3. Deploy successfully vpn gateway in uksouth - Enable ukwest and see the failure below.

#### Screenshots

**Successful deployment of custom_settings_by_resource_type for pip used in VPN gateway in AZ enabled zone (uksouth)**

module.enterprise_scale.azurerm_public_ip.connectivity["/subscriptions/6e8f4ab8-cba8-411f-b72a-f6f15694690a/resourceGroups/alz-connectivity-uksouth/providers/Microsoft.Network/publicIPAddresses/alz-vpngw-uksouth-pip"] will be created
+ resource "azurerm_public_ip" "connectivity" {
+ allocation_method = "Static"
+ ddos_protection_mode = "VirtualNetworkInherited"
+ fqdn = (known after apply)
+ id = (known after apply)
+ idle_timeout_in_minutes = 4
+ ip_address = (known after apply)
+ ip_version = "IPv4"
+ location = "uksouth"
+ name = "alz-vpngw-uksouth-pip"
+ resource_group_name = "alz-connectivity-uksouth"
+ sku = "Standard"
+ sku_tier = "Regional"
+ tags = {
+ "deployedBy" = "terraform/azure/caf-enterprise-scale"
+ "deployed_by" = "terraform-ALZ"
+ "environment" = "dev"
}
+ zones = [
+ "1",
+ "2",
+ "3",
]
}

module.enterprise_scale.azurerm_public_ip.connectivity["/subscriptions/6e8f4ab8-cba8-411f-b72a-f6f15694690a/resourceGroups/alz-connectivity-uksouth/providers/Microsoft.Network/publicIPAddresses/alz-vpngw-uksouth-pip2"] will be created
+ resource "azurerm_public_ip" "connectivity" {
+ allocation_method = "Static"
+ ddos_protection_mode = "VirtualNetworkInherited"
+ fqdn = (known after apply)
+ id = (known after apply)
+ idle_timeout_in_minutes = 4
+ ip_address = (known after apply)
+ ip_version = "IPv4"
+ location = "uksouth"
+ name = "alz-vpngw-uksouth-pip2"
+ resource_group_name = "alz-connectivity-uksouth"
+ sku = "Standard"
+ sku_tier = "Regional"
+ tags = {
+ "deployedBy" = "terraform/azure/caf-enterprise-scale"
+ "deployed_by" = "terraform-ALZ"
+ "environment" = "dev"
}
+ zones = [
+ "1",
+ "2",
+ "3",
]
}

**Failing deployment of custom_settings_by_resource_type for pip used in VPN gateway in a non AZ enabled zone (ukwest)**

module.enterprise_scale.azurerm_public_ip.connectivity["/subscriptions/6e8f4ab8-cba8-411f-b72a-f6f15694690a/resourceGroups/alz-connectivity-ukwest/providers/Microsoft.Network/publicIPAddresses/alz-vpngw-ukwest-pip"] will be created
+ resource "azurerm_public_ip" "connectivity" {
+ allocation_method = "Static"
+ ddos_protection_mode = "VirtualNetworkInherited"
+ fqdn = (known after apply)
+ id = (known after apply)
+ idle_timeout_in_minutes = 4
+ ip_address = (known after apply)
+ ip_version = "IPv4"
+ location = "ukwest"
+ name = "alz-vpngw-ukwest-pip"
+ resource_group_name = "alz-connectivity-ukwest"
+ sku = "Standard"
+ sku_tier = "Regional"
+ tags = {
+ "deployedBy" = "terraform/azure/caf-enterprise-scale"
+ "deployed_by" = "terraform-ALZ"
+ "environment" = "dev"
}
}

module.enterprise_scale.azurerm_public_ip.connectivity["/subscriptions/6e8f4ab8-cba8-411f-b72a-f6f15694690a/resourceGroups/alz-connectivity-ukwest/providers/Microsoft.Network/publicIPAddresses/alz-vpngw-ukwest-pip2"] will be created
+ resource "azurerm_public_ip" "connectivity" {
+ allocation_method = "Dynamic"
+ ddos_protection_mode = "VirtualNetworkInherited"
+ fqdn = (known after apply)
+ id = (known after apply)
+ idle_timeout_in_minutes = 4
+ ip_address = (known after apply)
+ ip_version = "IPv4"
+ location = "ukwest"
+ name = "alz-vpngw-ukwest-pip2"
+ resource_group_name = "alz-connectivity-ukwest"
**+ sku = "Basic"**
+ sku_tier = "Regional"
+ tags = {
+ "deployedBy" = "terraform/azure/caf-enterprise-scale"
+ "deployed_by" = "terraform-ALZ"
+ "environment" = "dev"
}
}
#### Additional context

Start with settings.connectivity.tf and the advanced custom_settings_by_resource_type configuration shown in the issue. Reproduce the ukwest deployment and compare the generated azurerm_public_ip plan for pip and pip2. Done means both public IPs receive Standard SKU and Static allocation in non-zone-enabled regions.

Written by the indexing model from the issue text.