azure cli $Path error running in terraform cloud

Question

Setting up terraform cloud for the first time and getting this error. Not sure why as on my local machine azure CLI is installed and the path is set, but I think has something to do with setting it in the terraform cloud platform.

Error: building AzureRM Client: please ensure you have installed Azure CLI version 2.0.79 or newer. Error parsing json result from the Azure CLI: launching Azure CLI: exec: "az": executable file not found in $PATH.
with provider["registry.terraform.io/hashicorp/azurerm"]
on versions.tf line 21, in provider "azurerm":

provider "azurerm" {

My currently tf code

versions.tf

terraform {

  cloud {
    organization = "myorg"

    workspaces {
      name = "dev"
    }
  }

  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "~>3.10.0"
    }
  }

  required_version = ">= 1.2.3"
}

provider "azurerm" {
  features {}
}

variables.tf

variable "tenant_id" {
    description = "tenant id for azure subscription"
}

main.tf

resource "azurerm_resource_group" "testrg" {
  name     = "test-rg"
  location = "Central US"
}

not doing anything fancy, but not sure how to get past the azure CLI error. I know where variables can be set in the terraform cloud platform, but not specifically where to set a $Path for the azure cli or even how to install azure cli in terraform cloud. On my local machine, I am logging in with az login on an account with sufficient permissions to the subscription.

user_15997509 · Answer

It looks like , you are trying to login using az login.This works for local terraform runs . To authenticate in terraform cloud instance , you may need to use Terraform Cloud workspace variables .

Please make sure to complete below steps:

Please check , if you have created service principal. If you're using Azure Clouds for example US Government .In the first step you need to configure the Azure CLI to work with that Cloud.
```
$ az cloud set --name AzureUSGovernment
```
Then log in using az login and check for the subscriptions listed and set it up for one.
```
$ az login
$ az account list
$ az account set --subscription="SUBSCRIPTION_ID"
```
Now please try to create the Service Principal which will have permissions to actually manage resources in that particular specified Subscription which had been set in the previous step.
```
$ az ad sp create-for-rbac --role="Contributor" --scopes="/subscriptions/SUBSCRIPTION_ID"
```
Where you can get tenant id, clientId etc which can be used as environment variables later. This document on creating a service principal using the azure-cli | Terraform Registry will guide you in detail
Now in terraform cloud workers , as we cant use az login, we can logout of it and set the environment variables something like below from the obtained values from previous steps.
```
$ export ARM_CLIENT_ID="xxxxxxxxxx"
$ export ARM_SUBSCRIPTION_ID="xxxxxxx"
$ export ARM_TENANT_ID="xxxxxx"
$ export ARM_CLIENT_SECRET="xxxxxxx"
```
see Configuring the Service Principal in Terraform
Then you can specify Terraform and Provider blocks
```
terraform {
  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "=3.0.0"
    }
  }
}

# Configure the Microsoft Azure Provider
provider "azurerm" {
  features {}
}
```
Then try to run terraform init > terraform plan or terraform apply which can probably make it possible to authenticate and make terraform to run using the Service Principal .

Reference: Using the Azure Provider with Terraform Cloud - Terraform - HashiCorp Discuss

Also do check if you have latest version of terraform, if not install and try with it.

azure cli $Path error running in terraform cloud

1 Answers