azurerm_role_assignment - Error assigning an azure role to a new SPN

[andresguisado]

Terraform (and AzureRM Provider) Version

Terraform v0.11.10

• provider.azurerm v1.18.0
• provider.random v2.0.0

Terraform Configuration Files

It looks like terraform azure provider is trying to assign a role to an SPN before executing the creating of this.

Here is my main.tf which is doing the following:

• Creating a new SPN
• Assigning the Contributor role to the new SPN on my subscription
• Creating an Azure key vault adding the new SPN to the access policy
• Creating 2 secrets in the azure key vault created, one with the APP_ID and another with the KEY of the new SPN created previously.

module "spn" {
  source                    =   "azure/spn"
  spn_name                  =   "${var.spn_name}"
  spn_end_date              =   "${var.spn_end_date}"
}

resource "azurerm_role_assignment" "app_spn_role" {
  scope                = "${var.spn_scope}" 
  role_definition_name = "${var.spn_role_definition_name}"
  principal_id         = "${module.spn.spn_principal}"
  depends_on           = ["module.spn"]
}
module "keyvault" {
  source                    =   "azure/keyvault"
  rg_name                   =   "${var.rg_name}"
  location                  =   "${var.location}"
  kv_name                   =   "${var.kv_name}"
  tenant_id                 =   "${var.tenant_id}"
  object_id_1               =   "${var.object_id_1}"
  object_id_2               =   "${module.spn.spn_principal}"
}

module "tf_id_secret" {
  source                    =   "azure/keyvault-secret"
  name                      =   "${var.tf_id_secret_name}"
  value                     =   "${module.spn.spn_app_id}"
  vault_uri                 =   "${module.keyvault.vault_uri}"
}

module "tf_pass_secret" {
  source                    =   "azure/keyvault-secret"
  name                      =   "${var.tf_pass_secret_name}"
  value                     =   "${module.spn.spn_password}"
  vault_uri                 =   "${module.keyvault.vault_uri}"
}

Debug Output

Terraform is able to add the new SPN to the Azure key vault access policy correctly but it is not able to assign the Contributor role to the new SPN giving me the following error:

Error: Error applying plan:

1 error(s) occurred:

* azurerm_role_assignment.app_spn_role: 1 error(s) occurred:

* azurerm_role_assignment.app_spn_role: authorization.RoleAssignmentsClient#Create: Failure responding to request: StatusCode=400 -- Original Error: autorest/azure: Service returned an error. Status=400 Code="PrincipalNotFound" Message="Principal fb784dXXXXXXXXXXXXXXXXXXXXXXdoes not exist in the directory 0aaxxxx-xxxxx-xxxx-xxxx-xxxxxxxxxxxx."

It seems that it is trying to assign the role before the SPN is created??
Notice that I have configured "depends_on" on the "azurerm_role_assignment" resource.

Here the logs (debug has been enabled as follows: export TF_LOG=TRACE)

018/11/05 13:55:16 [INFO] CLI command args: []string{"apply", "plan.out"}
.
.
2018/11/05 13:55:16 [TRACE] DiffTransformer: Module: CREATE: azurerm_role_assignment.app_spn_role
  name:                 "" => "<computed>" (forces new resource)
  principal_id:         "" => "<computed>" (forces new resource)
  role_definition_name: "" => "Contributor" (forces new resource)
  scope:                "" => "/subscriptions/XXXXXXXX" (forces new resource)
.
.
2018/11/05 13:55:16 [TRACE] DiffTransformer: Module: CREATE: azurerm_azuread_application.app_spn
  application_id:             "" => "<computed>"
  available_to_other_tenants: "" => "true"
  homepage:                   "" => "<computed>"
  identifier_uris.#:          "" => "<computed>"
  name:                       "" => "tf-app"
  oauth2_allow_implicit_flow: "" => "false"
  reply_urls.#:               "" => "<computed>"
CREATE: azurerm_azuread_service_principal.app_spn_id
  application_id: "" => "<computed>" (forces new resource)
  display_name:   "" => "<computed>"
CREATE: azurerm_azuread_service_principal_password.app_spn_password
  end_date:             "" => "2020-01-01T01:02:03Z" (forces new resource)
  key_id:               "" => "<computed>" (forces new resource)
  service_principal_id: "" => "<computed>" (forces new resource)
  start_date:           "" => "<computed>" (forces new resource)
  value:                "<sensitive>" => "<sensitive>" (forces new resource)
CREATE: random_string.password
  length:           "" => "32" (forces new resource)
  lower:            "" => "true" (forces new resource)
  min_lower:        "" => "0" (forces new resource)
  min_numeric:      "" => "0" (forces new resource)
  min_special:      "" => "0" (forces new resource)
  min_upper:        "" => "0" (forces new resource)
  number:           "" => "true" (forces new resource)
  override_special: "" => "%@+#=" (forces new resource)
  result:           "" => "<computed>"
  special:          "" => "true" (forces new resource)
  upper:            "" => "true" (forces new resource)
.
.
2018/11/05 14:22:19 [TRACE] root: eval: *terraform.EvalWriteDiff
2018/11/05 14:22:19 [TRACE] root: eval: *terraform.EvalApplyPost
2018/11/05 14:22:19 [ERROR] root: eval: *terraform.EvalApplyPost, err: 1 error(s) occurred:

* azurerm_role_assignment.app_spn_role: authorization.RoleAssignmentsClient#Create: Failure responding to request: StatusCode=400 -- Original Error: autorest/azure: Service returned an error. Status=400 Code="PrincipalNotFound" Message="Principal XXXXXXdoes not exist in the directory XXXXX."
2018/11/05 14:22:19 [ERROR] root: eval: *terraform.EvalSequence, err: 1 error(s) occurred:

* azurerm_role_assignment.app_spn_role: authorization.RoleAssignmentsClient#Create: Failure responding to request: StatusCode=400 -- Original Error: autorest/azure: Service returned an error. Status=400 Code="PrincipalNotFound" Message="Principal XXXXXdoes not exist in the directory XXXXX"

Attempted solution

At this point, the SPN was created and attached to the azure key vault correctly and I can see that from the Azure portal.

As I mentioned, I have configured "depends_on" on the "azurerm_role_assignment" resource but not luck with this.

If I created a new plan after the first fail and apply this plan again terraform is able to assign the role to the SPN correctly:

azurerm_role_assignment.app_spn_role: Creating...
  name:                 "" => "<computed>"
  principal_id:         "" => "XXXXXXXXX"
  role_definition_name: "" => "Contributor"
  scope:                "" => "/subscriptions/XXXXXXXXXX"
azurerm_role_assignment.app_spn_role: Creation complete after 5s (ID: /subscriptions/XXXXXXXXX-...s/XXXXXXXXX)

Apply complete! Resources: 1 added, 0 changed, 0 destroyed.

Expected Behavior

Terraform provider should apply "depends_on" and execute "azurerm_role_assignment" resource after creating the new SPN by the module (related to #10076)

Terraform provider should assign roles to new SPN correctly (related to #669)

Steps to Reproduce

terraform apply

References

This could be related to #669, #10076

[tombuildsstuff]

hi @andresguisado

Thanks for opening this issue :)

This issue has previously been reported in #1635 - rather than having multiple issues open tracking the same thing I'm going to close this issue in favour of #1635

Thanks!

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. If you feel I made an error 🤖 🙉 , please reach out to my human friends 👉 [email protected]. Thanks!