Addition of skip_service_principal_aad_check in v1.34.0 forces recreation of azurerm_role_assignment

[tdmalone]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform (and AzureRM Provider) Version

Terraform v0.11.14
+ provider.azuread v0.1.0
+ provider.azurerm v1.34.0

Affected Resource(s)

• azurerm_role_assignment

Terraform Configuration Files

provider "azurerm" {
  version = "~> 1.9"
}

resource "azurerm_role_assignment" "terraform_via_bamboo_storage_key_lister" {
  role_definition_id = "${azurerm_role_definition.storage_key_lister.id}"
  principal_id       = "${azuread_service_principal.terraform_via_bamboo.id}"
  scope              = "${azurerm_storage_account.main.id}"
}

Expected Behavior

No diff should have been generated.

Actual Behavior

The following diff was generated after upgrading to the recently released v1.34.0:

-/+ azurerm_role_assignment.terraform_via_bamboo_storage_key_lister (new resource required)
      id:                               "/subscriptions/XXXXX/resourceGroups/XXXXX/providers/Microsoft.Storage/storageAccounts/XXXXX/providers/Microsoft.Authorization/roleAssignments/XXXXX" => <computed> (forces new resource)
      name:                             "XXXXX" => <computed>
      principal_id:                     "XXXXX" => "XXXXX"
      principal_type:                   "ServicePrincipal" => <computed>
      role_definition_id:               "/subscriptions/XXXXX/providers/Microsoft.Authorization/roleDefinitions/XXXXX" => "/subscriptions/XXXXX/providers/Microsoft.Authorization/roleDefinitions/XXXXX"
      scope:                            "/subscriptions/XXXXX/resourceGroups/XXXXX/providers/Microsoft.Storage/storageAccounts/XXXXX" => "/subscriptions/XXXXX/resourceGroups/XXXXX/providers/Microsoft.Storage/storageAccounts/XXXXX"
      skip_service_principal_aad_check: "" => "false" (forces new resource)

Manually adding skip_service_principal_aad_check to the configuration and setting it to true also forces a new resource. Setting it to "" is evaluated as false, the default, which also forces a new resource.

The only workaround I can see, to avoid recreating the resource, is to add:

  lifecycle {
    ignore_changes = ["skip_service_principal_aad_check"]
  }

Steps to Reproduce

1. terraform init -upgrade
2. terraform apply

References

• New argument was added in arm_role_assignment: add principal_type and skip_service_principal_aad_check properties #4168

[ghost]

This has been released in version 1.35.0 of the provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading. As an example:

provider "azurerm" {
    version = "~> 1.35.0"
}
# ... other configuration ...

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. If you feel I made an error 🤖 🙉 , please reach out to my human friends 👉 [email protected]. Thanks!