terraform-provider-azurerm: azurerm_role_assignment must be replaced
Community Note
- Please vote on this issue by adding a đź‘Ť reaction to the original issue to help the community and maintainers prioritize this request
- Please do not leave “+1” or “me too” comments, they generate extra noise for issue followers and do not help prioritize the request
- If you are interested in working on this issue or have submitted a pull request, please leave a comment
Terraform (and AzureRM Provider) Version
Terraform v0.12.13
- provider.azuread v0.6.0
- provider.azurerm v1.36.1
Affected Resource(s)
azurerm_role_assignment
Terraform Configuration Files
terraform {
required_version = ">= 0.12"
}
provider "azurerm" {
version = "~> 1.36.0"
}
provider "azuread" {
version = "~> 0.6.0"
}
data "azurerm_client_config" "current" {
}
# Get the tenant root Management Group
data "azurerm_management_group" "mgTenantRoot" {
group_id = data.azurerm_client_config.current.tenant_id
}
# Create a Management Group as a child to the tenant root
resource "azurerm_management_group" "test239857" {
display_name = "test239857"
parent_management_group_id = data.azurerm_management_group.mgTenantRoot.id
group_id = "test239857"
subscription_ids = [
data.azurerm_client_config.current.subscription_id //move the subscription under the role definition scope
]
}
# Create a custom role scoped to a management group
resource "azurerm_role_definition" "test239857" {
name = "test239857"
scope = azurerm_management_group.test239857.id
description = "Role scoped to a management group"
permissions {
actions = [
"Microsoft.DeploymentManager/*/read"
]
not_actions = []
}
assignable_scopes = [
azurerm_management_group.test239857.id
]
}
# create a target for the role assignment
resource "azuread_group" "test239857" {
name = "test239857"
}
# Get the current subscription
data "azurerm_subscription" "currentSubscription" {
}
# Assignment of a Management Group scoped role to a subscription
resource "azurerm_role_assignment" "test239857" {
scope = data.azurerm_subscription.currentSubscription.id
role_definition_id = azurerm_role_definition.test239857.id
principal_id = azuread_group.test239857.id
}
Debug Output
https://gist.github.com/rjfmachado/b8dd89e4e89fd88391e26e27ab0ff3f2
Expected Behavior
Terraform plan should have no changes after apply
Actual Behavior
Terraform wants to recreate the Role Assignment
Steps to Reproduce
- Terraform apply
- Terraform plan
Important Factoids
User should have global tenant admin role on Azure AD and Owner on the subscription
References
#3450 Also hitting this when destroying
About this issue
- Original URL
- State: open
- Created 5 years ago
- Reactions: 63
- Comments: 24 (4 by maintainers)
Thanks for the tip @boillodmanuel , in my case it doesn’t work, there must be some kind of mess in azurerm_role_assignment resource in my version combination:
For instance, if I write:
Terraform wants to set role_definition_id to:
Which according to Documentation should be the output for “role_definition_id” not for “id”
But then if I make use of role_definition_resource_id
Terraform wants to set role_definition_id to:
Which initially works but in subsequent applies Terraform will want to change it again and again:
So the (ugly) workaround that works for me its:
I really cannot understand what’s going on with this resource in azurerm, this issue has been open for one year now.
How is this more than 2 yrs old and still not fixed?
I am having a similar issue that has to deal with multiple subscriptions in the same tenant. Here is my scenario:
Subsequent runs of this produces the following terraform plans (wants to replace them due to the ID changing, when it hasn’t changed.
Still having the same issue today 23/01/2020. It looks like it keeps wanting to switch between:
/subscriptions/GUID/providers/Microsoft.Authorization/roleDefinitions/GUID" -> “/providers/Microsoft.Authorization/roleDefinitions/GUID”
Every time it is also creating a new role_definition_id GUID.
I ended up setting
role_definition_nameinstead of therole_definition_idwhen assigning custom roles. Since custom role definition names are unique across a tenant this will work.My understanding suggests that a role definition object is created within each scope specified within the azurerm_role_definition resource. The object referred to in azurerm_role_assignment -> role_definition_id should be the one created for the scope set in azurerm_role_assignment -> role_definition_id.
The provider tries to use the object existing in its own subscription (the one specified in the provider configuration).
The (ugly) workaround suggested by @juanjojulian worked for me.
To avoid confusion between azurerm_role_definition and azurerm_role_assignment the input should be named role_definition_resource_id, not role_definition_id.
Quick update. I have just tested this with @thedevopscat using Terraform v0.14.8 & azurerm v2.51.0
Using the role_definition_name instead of role_definition_id does not cause the issue to occur, however you cannot use a custom role_definition_name as a datasource just by specifying the name.
It would be great if this can be fixed.
Hi, I found a workaround for
role_definition_idthat should be applied in some situations only:role_definition_nameis usedrole_definition_id = azurerm_role_definition.example.idas in terraform examplerole_definition_id = "${data.azurerm_subscription.primary.id}${ azurerm_role_definition.example.id}"Manuel
Your problem is related to an issue in azurerm_role_definition that was introduced in version 2.16, downgrade to version 2.15 and it will work as expected. Please don’t forget to post in issue #7549 to let the developers know that there is more people affected.