terraform-provider-azurerm: Error: Invalid index. The given key does not identify an element in this collection value.

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave “+1” or “me too” comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform (and AzureRM Provider) Version

Terraform v0.12.20

• provider.azurerm v1.42.0

Affected Resource(s)

• azurerm_virtual_machine
• azurerm_role_assignment

Terraform Configuration Files

Initial terraform configuration (Other resources not shown here including Network interface etc). This deploys perfectly.

resource "azurerm_virtual_machine" "virtual_machine" {
  count                                 = 2
  name                                 = "${format("vm-%03d", count.index + 1)}"
  location                             = var.location
  resource_group_name    = var.rg
  network_interface_ids     = [element(azurerm_network_interface.df_network_interface.*.id, count.index)]
  vm_size                              = "Standard_B2s"
  license_type                  = "Windows_Server"

Modified TF configuration (adding ‘identity’ block and new resource for role assignment to the VM).

resource "azurerm_virtual_machine" "virtual_machine" {
  count                                 = var.VMCount
  name                                 = "${format("vm-%03d", count.index + 1)}"
  location                             = var.location
  resource_group_name    = var.rg
  network_interface_ids     = [element(azurerm_network_interface.df_network_interface.*.id, count.index)]
  vm_size                              = "Standard_B2s"
  license_type                  = "Windows_Server"
  identity {
    type = "SystemAssigned"
  }

resource "azurerm_role_assignment" "df_contributor" {
  count                = local.create_data_factory ? var.VMCount : 0
  scope                = azurerm_data_factory.factory.id
  role_definition_name = "Reader"
  principal_id         = "${azurerm_virtual_machine.virtual_machine[count.index].identity.0.principal_id}"
  depends_on           = ["azurerm_virtual_machine.virtual_machine"]
  }

Debug Output

<script src="https://gist.github.com/andrewCluey/1ed407e821af6fde065141c25df71b08.js"></script>

Panic Output

Expected Behavior

The identity block for the VM should first be applied, then the Role assignment should apply.

Actual Behavior

On both plan and apply the error message (below) is returned…

Error: Invalid index

  on main.tf line 207, in resource "azurerm_role_assignment" "df_contributor":
 207:   principal_id         = "${azurerm_virtual_machine.df_virtual_machine[count.index].identity.0.principal_id}"
    |----------------
    | azurerm_virtual_machine.virtual_machine is tuple with 2 elements
    | count.index is 0

The given key does not identify an element in this collection value.

Seems to be that the ‘identity’ block for the VM is not applied before the role assignment resource is applied.

If I comment out the Role_Assignment resource, ad re-apply, then the VM is modified in place with the ‘identity’ block. If i then re-enable the ‘role_assignment’ resource and re-apply again, it’s all fine.

This seems to suggest a issue in the ordering of dependencies between the ‘identity’ block in the VM_resource and the role_assignment resource.

Steps to Reproduce

1. Created a terraform config for a new Azure VM resource with count attribute set. Using latest Terraform version and Azure provider.
2. terraform apply
3. Add an identity block into the azurerm_virtual_machine resource for ‘systemassigned’.
4. add a new resource into the terraform config to assign a role to the VM (azurerm_role_assignment). Using count and count.index to identity the correct principal IDs.
5. terraform apply.
6. Error: Invalid index

Important Factoids

References

• #0000