Role assignments don't work when scoped to hardcoded resource groups

[angusjellis]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform (and AzureRM Provider) Version

Terraform: 1.0.0
Azure Provider: 2.64.0

Affected Resource(s)

• azurerm_role_assignment

Terraform Configuration Files

resource "azurerm_role_assignment" "cluster-identity-operator" {
  scope                = "/subscriptions/${var.subscription_id}"
  role_definition_name = "Managed Identity Operator"
  principal_id         = azurerm_user_assigned_identity.runner-identity.principal_id
}
# deploys successfully
resource "azurerm_role_assignment" "cluster-identity-operator-resource-group" {
  scope                = "/subscriptions/${var.subscription_id}/resource_groups/${azurerm_kubernetes_cluster.gh-runner-cluster.node_resource_group}"
  role_definition_name = "Managed Identity Operator"
  principal_id         = azurerm_user_assigned_identity.runner-identity.principal_id
}
#does not deploy successfully
resource "azurerm_role_assignment" "cluster-identity-operator-resource-group-provided" {
  scope = azurerm_resource_group.gh-runners-shared.id
  role_definition_name = "Managed Identity Operator"
  principal_id         = azurerm_user_assigned_identity.runner-identity.principal_id
}
# deploys successfully

Debug Output

https://gist.github.com/angusjellis/96b8e2aec3e4dfe489f839e4c3b4a022.js

Expected Behaviour

I should be able to run terraform apply, and add a role assignment scoped to a 'hardcoded' resource group id

Actual Behaviour

Terraform is not able to assign a role to a 'hardcoded' resource group id. It errors out with a 400 code.

Steps to Reproduce

Create an identity role assignment that is scoped to a hardcoded resource group id.

1. terraform apply

Important Factoids

While I'm raising this on the 2.64.0 version of the provider, I've seen the issue on 2.63.0, 2.62.0, 2.62.1, 2.61.0 as well.

References

Possibly related to this closed issue

[tombuildsstuff]

hi @angusjellis

Thanks for opening this issue.

The ARM Resource ID for a Resource Group includes the segment resourceGroups rather than resource_groups - which is why this is failing, as such updating this should fix this. Since the casing on ARM ID's is pedantic across various parts of Azure, we highly recommend using the Data Sources to look this value up rather than hard-coding it - such as in this case by using the azurerm_resource_group Data Source.

This forum is intended to be used for feature enhancements and bugs in the Azure Provider - so that we can keep this forum focused on that we instead ask that broader questions are raised using one of the Community Resources.

Thanks!

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.