terraform-provider-azurerm: 1.32 tf refresh fails with AuthorizationFailed errors

Hi Guys,

I too have same issue, I believe it should have made optional, skip provider registration is not the right thing to do also I’m not using Microsoft.Maps Resource providers explicitly so why my SP need to have permission to register it.

Hi @Justin-W,

We added a new client this release (azure maps) so the SP/authorization methold you are using to access Azure needs permission to register new clients.

Well, that qualifies as a potentially-breaking change to existing configurations, doesn’t it? Shouldn’t such a backwards-incompatible change have been at least documented somewhere? E.g. In the release notes or change log?

it looks like for some reason you do not have such permissions? How are you authenticating to azure and what roles/permission does that grant?

Correct. The authentication credentials I am using were specifically created with limited permissions, so that they are only able to do what they “should” be able to do for the purposes they are used for.

The newly-required permissions are not something that they are “supposed” to be able do, and it feels somewhat like a hack if we would need to update our service account permissions just because the AzureRM provider added a new capability, even though we aren’t using it at all.

Is the set of “minimum required” permissions documented somewhere? And is it kept up to date whenever changes like this one in v1.32.0 occur?

Outside of changing permissions there you could potentially register the client in the portal.

This also feels lack a hack solution.

If your authentication method does not grant such permission you can skip provider registration by using the skip_provider_registration flag

I’m aware of that option, but the docs for that feature toggle don’t seem to be detailed enough for me to understand the full implications of disabling auto-registration, and whether that would be a good and/or feasible solution. What else might break if we do that? In what circumstances “should” that option be true, and in which should it be false?

IMO, the whole point of using permissions-limited credentials was to ensure that if anything changed the behavior of the terraform CLI operations, then regardless of the source and cause of such a change, the limited credentials would limit the scope of the effects of such changes (especially unintended and/or otherwise-invisible changes).

So basically, the limited-permissions account worked exactly as we intended. It prevented the AzureRM provider from doing something “new”, when the “change” that failed was something that: 1. we didn’t previously need; 2. we still don’t need (AFAIK); and 3. we don’t really want.

However, I’d like to better understand your views on the “correct” way for us to handle this whole issue. Thanks.

Just a workaround we made it to point below which is working fine

version = "= 1.31" insted of version = "~> 1.31"

More here: https://www.terraform.io/docs/configuration/providers.html

Hi,

Our setup is broken because of this and we are not using the map resources. The provider respects access restrictions on all other resources, why is the maps resource an exception to this?

We are going to hardcode our provider version to resolve this for now, but this is def breaking a bug