Get oauth2_permissions from azuread_application using Terraform

Viewed 422

I have an app registration which defines two oauth2_permissions blocks, e.g. (other details elided)

resource "azuread_application" "myapp" {
  oauth2_permissions {
    is_enabled = true
    type       = "User"
    value      = "Permission.One"
  }

  oauth2_permissions {
    is_enabled = true
    type       = "User"
    value      = "Permission.Two"
  }
}

Which, when applied,works just fine. I then want to refer to those permissions in another app registration, e.g.

resource "azuread_application" "myotherapp" {
  required_resource_access {
    resource_app_id = azuread_application.myapp.application_id

    resource_access {
      id   = ??
      type = "Scope"
    }
  }
}

For the id here, I have tried:

id = lookup(azuread_application.myapp.oauth2_permissions[0], "id")

which gives This value does not have any indices. As does

id = azuread_application.myapp.oauth2_permissions.0.id

I can define a data block and get the output of oauth2_permissions from myapp:

data "azuread_application" "myapp" {
  application_id  = azuread_application.myapp.application_id
}

output "myapp-perms" {
  value = data.azuread_application.myapp.oauth2_permissions
}

And on apply, that will correctly show an array of the two permission blocks. If I try to refer to the data block instead of the application block, i.e.

id = lookup(data.azuread_application.myapp.oauth2_permissions[0], "id")

This gives me a different error: The given key does not identify an element in this collection value

If I apply those two permissions manually on the console, everything works fine. From reading around I was fairly sure that at least one of the above methods should work but I am clearly missing something.

For completeness, provider definition:

provider "azurerm" {
  version = "~> 2.12"
}

provider "azuread" {
  version = "~> 0.11.0"
}
1 Answers

Based on comments.

The solution is to use tolist. The reason is that the multiple oauth2_permissions blocks will be represented as sets of objects, which can't be accessed using indices.

id = tolist(azuread_application.myapp.oauth2_permissions)[0].id

However, the sets don't have guaranteed order. Thus a special attention should be payed to this.

Related