Azure Role Assignment to AAD group fails with Terraform

user_19305113 0
Viewed 140

I am trying to assign contributor rights on a resource group to an Azure Active Directory Group using Terraform. The Terraform script I use looks like this:

# Deploy Resource Groups
resource "azurerm_resource_group" "rg" {
  name     = "rg-companyname-syn-env-100"
  location = "westeurope"
}

# Retrieve data for AAD CloudAdmin groups
data "azuread_group" "cloud_admin" {
  display_name        = "AAD-GRP-companyname-CloudAdministrators-env"
  security_enabled    = true
}

# Add "Contributor" role to Cloudadmin AAD group
resource "azurerm_role_assignment" "cloud_admin" {
  scope                = azurerm_resource_group.rg.id
  role_definition_name = "Contributor"
  principal_id         = data.azuread_group.cloud_admin.id
  depends_on           = [azurerm_resource_group.rg]
}

If I run this I receive the following error:

╷
│ Error: authorization.RoleAssignmentsClient#Create: Failure responding to request: StatusCode=403 -- Original Error: autorest/azure: Service returned an error. Status=403 Code="AuthorizationFailed" Message="The client '<application_object_id>' with object id '<application_object_id>' does not have authorization to perform action 'Microsoft.Authorization/roleAssignments/write' over scope '/subscriptions/<subscription_id>/resourceGroups/rg-companyname-syn-env-100/providers/Microsoft.Authorization/roleAssignments/<role_assignment_id>' or the scope is invalid. If access was recently granted, please refresh your credentials."
│ 
│   with azurerm_role_assignment.cloud_admin["syn"],
│   on rg.tf line 15, in resource "azurerm_role_assignment" "cloud_admin":
│   15: resource "azurerm_role_assignment" "cloud_admin" {
│ 
╵

Note the AAD Group (AAD-GRP-companyname-CloudAdministrators-env) already has the Owner role on the subscription used. Is there somebody that knows a fix for this problem?

azure-service-principal terraform roles azure-devops
2 Answers

I had this issue occur today after someone else in the team had changed the service principal my deployment ran under to a contributor rather than owner of the subscription. Assign the role the role "owner" of the subscription to the service account your deployments run under

user_105117370

Whichever principal (either you, a service principal or managed identity assigned to a build agent) likely has the built in Azure role Contributor which can manage resources, but not Role Based Access Control (RBAC). So that is the reason you are getting a 403 Unauthorized response.

Contributor role is allowed to read, but not write role assignments. Since you are using Terraform, I would suggest creating a custom role definition which will allow write as well as delete so you can use terraform destroy

You can create a custom role definition by clicky-clicking in the portal, azure cli or Terraform (snippet below); executed by someone with the Owner role.

Once you have a custom role assignment with the appropriate permissions then assign the principal that is executing the terraform apply with that custom role.


 data "azurerm_client_config" "current" {
 }

 resource "azurerm_role_definition" "role_assignment_write_delete" {
     name  = "RBAC Owner"
     scope = data.azurerm_client_config.current.subscription_id
     description = "Management of role assignments"
    
     permissions {
         actions = [
             "Microsoft.Authorization/roleAssignments/write",
             "Microsoft.Authorization/roleAssignments/delete",
         ]
         not_actions = []
     }
    
     assignable_scopes = [
         data.azurerm_client_config.current.subscription_id //or management group
     ]
 }
user_75127420
Related