fix: Make deployment of diagnostic setting deterministic

Author: celloza

infrastructure/backup_vault.tf

@@ -27,7 +27,7 @@ locals {
 }
 
 resource "azurerm_monitor_diagnostic_setting" "backup_vault" {
-  for_each                   = var.deploy_diagnostic_settings ? [1] : []
+  count                      = var.deploy_diagnostic_settings ? 1 : 0
   name                       = "${var.backup_vault_name}-diagnostic-settings"
   target_resource_id         = azurerm_data_protection_backup_vault.backup_vault.id
   log_analytics_workspace_id = var.log_analytics_workspace_id

infrastructure/variables.tf

@@ -138,7 +138,7 @@ variable "deploy_diagnostic_settings" {
   default     = true
 
   validation {
-    condition     = var.deploy_diagnostic_settings == true || var.log_analytics_workspace_id == ""
+    condition     = !var.deploy_diagnostic_settings || var.log_analytics_workspace_id != ""
     error_message = "Diagnostic settings can only be deployed if a log analytics workspace ID is provided."
   }
 }