The problem was, that I was associating multiple Network Security Groups to one and the same subnet resource. This is apparently not possible, you’ll have to create a subnet for each Network Security Group.

An correct example using the code in my question would be (notice the changed address space in the VNET and the additional subnet):

# Resource Group
resource "azurerm_resource_group" "rg_subnet_test" {
  location = "germanywestcentral"
  name     = "rg-subnet-test"
}

# VNET
resource "azurerm_virtual_network" "vnet_subnet_test" {
  address_space       = ["10.100.0.0/16"]
  location            = azurerm_resource_group.rg_subnet_test.location
  name                = "subnet-test-vnet"
  resource_group_name = azurerm_resource_group.rg_subnet_test.name
}

# Subnet
resource "azurerm_subnet" "subnet1" {
  name                 = "subnet-test-subnet1"
  address_prefixes     = ["10.100.2.0/24"]
  resource_group_name  = azurerm_virtual_network.vnet_subnet_test.resource_group_name
  virtual_network_name = azurerm_virtual_network.vnet_subnet_test.name
}

resource "azurerm_subnet" "subnet2" {
  name                 = "subnet-test-subnet2"
  address_prefixes     = ["10.100.3.0/24"]
  resource_group_name  = azurerm_virtual_network.vnet_subnet_test.resource_group_name
  virtual_network_name = azurerm_virtual_network.vnet_subnet_test.name
}

# First Network Security Group
resource "azurerm_network_security_group" "app_server_nsg_1" {
  name                = "subnet-test-nsg-1"
  location            = azurerm_resource_group.rg_subnet_test.location
  resource_group_name = azurerm_resource_group.rg_subnet_test.name
}

# Second Network Security Group
resource "azurerm_network_security_group" "app_server_nsg_2" {
  name                = "subnet-test-nsg-2"
  location            = azurerm_resource_group.rg_subnet_test.location
  resource_group_name = azurerm_resource_group.rg_subnet_test.name
}

# Association between first NSG to subnet
resource "azurerm_subnet_network_security_group_association" "association1" {
  subnet_id                 = azurerm_subnet.subnet1.id
  network_security_group_id = azurerm_network_security_group.app_server_nsg_1.id
}

# Association between second NSG to subnet
resource "azurerm_subnet_network_security_group_association" "association2" {
  subnet_id                 = azurerm_subnet.subnet2.id
  network_security_group_id = azurerm_network_security_group.app_server_nsg_2.id
}

Terraform and Azure: Problems with association between NetworkSecurityGroups and Subnets

As mentioned in the error we need to import the subnet resource as per the requirement as this only the approach which works. When I test this configuration, I face the similar issue you mentioned

terraform_move command was wont work here as we need move the configuration changes as per the resource we need to move in the state file as Rui Jarimba mentioned it better remove the resource info from the state and reimport it as per the requirement only works as expected.

The error we are faced only due to miss match of configuration with the state which we tried not with the way the resources are provisioned.

configuration goes as per the repo you shared in github i only shared the part of the configuration where we import the resource.

configuration:

modules/german/main.tf

variable "region" {}
variable "resource_group_name" {}

module "network" {
  source = "../network"
  region = var.region
  resource_group_name = var.resource_group_name
}

module "appserver" {
  source = "../vm/app"
  region = var.region
  resource_group_name = var.resource_group_name
  subnet_id = module.network.subnet_id
}

module "dbserver" {
  source = "../vm/db"
  region = var.region
  resource_group_name = var.resource_group_name
  subnet_id = module.network.subnet_id
}

modules/network/main.tf:

variable "region" {}
variable "resource_group_name" {}

resource "azurerm_virtual_network" "vnet" {
  name                = "subnet-test-de-vnet"
  address_space       = ["10.0.0.0/16"]
  location            = var.region
  resource_group_name = var.resource_group_name
}

resource "azurerm_subnet" "subnet" {
  name                 = "subnet-test-de-subnet"
  resource_group_name  = var.resource_group_name
  virtual_network_name = azurerm_virtual_network.vnet.name
  address_prefixes     = ["10.0.1.0/24"]
}

output "subnet_id" {
  value = azurerm_subnet.subnet.id
}

continue with the rest of the configuration

Deployment:

run the command terraform state list

remove the resource

this resource was imported into different module as per the requirement

terraform import 'module.german_region.module.dbserver.azurerm_subnet_network_security_gassociation.association_subnet_db

Refer:

https://github.com/azurerm/terraform-azure-resources/tree/v1.0.10/modules/subnet_network_security_group_association

https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/subnet_network_security_group_association

https://github.com/Azure/terraform-azurerm-network-security-group

Error: A resource with the ID xxxxxx already exists – to be managed via Terraform this resource needs to be imported into the State.

There are several possible scenarios that can lead to this error:

• Resource was created manually and was later added to Terraform configuration: Since Terraform’s state does not include this resource, Terraform attempts to create it.
• Resource was moved between modules: Terraform loses track of the resource’s state because its address has changed and consequently tries to create a new resource with the same ID.
• Resource was renamed: Renaming a resource in the configuration without updating the state state will make Terraform think it needs to create a new resource. The old resource still exists in the infrastructure, causing a conflict.

Please refer to Vinay B’s answer or Moving resources for details on how to fix this issue.