Cannot create Governance Rules for Defender for Cloud on Azure

[danielalvesleandro]

I am trying to create Governance Rules in the Defender for Cloud using the azapi_resource:

Terraform version : 1.5.7 Azure/Azapi version : 1.9.0 Resource: azapi_resource.governance_rules Type: Microsoft.Security/governanceRules@2022-01-01-preview

But it fails when it tries to reads the existing rules with the error below:

│ Error: reading "Resource: (ResourceId \"/subscriptions/<subscription_id>/providers/Microsoft.Security/governanceRules/43ad8a88-bd6e-7848-7ac7-f8d6960c30d6\" / Api Version \"2022-01-01-preview\")": ChainedTokenCredential: failed to acquire a token.
│ Attempted credentials:
│   managed identity timed out
│   AzureCLICredential: Azure CLI not found on path
│ 
│   with module.module_name.module.subscription_governance_rules.azapi_resource.governance_rules["1"],
│   on modules/nos/governance-rules/main.tf line 20, in resource "azapi_resource" "governance_rules":
│   20: resource "azapi_resource" "governance_rules" {
│ 

It happens when the client running Terraform doesn´t have the AZ CLI installed only, but it´s using the service principal and secret authentication mode that doesn´t need to have the AZ CLI installed as it must be when using the interactive authentication to Terraform.

I have already tried with different versions of Terraform and with the azapi provider, but the result is the same. I could also apply it locally from my machine that has the AZ CLI installed, but then when I tried to run it from the automation - where the image doesn´t have the AZ CLI - it fails with the same error above on the plan phase because it cannot even read the existing rules.

[ms-henglu]

Hi @danielalvesleandro ,

Thank you for taking time to report this issue and apologize for late response.

Here's a workaround for this, you could specify use_cli = false in the azapi provider block.

More details: https://registry.terraform.io/providers/Azure/azapi/latest/docs#use_cli

[szsascha]

provider "azapi" {
  use_cli = false
}

This in providers.tf doesn't resolve the issue for me.

I'm still getting managed identity timed out

[ms-henglu]

Hi @szsascha , sorry for late response.

If you're getting managed identity timed out and you want to skip the managed identity authentication, you could specify use_msi = false.

Refs: https://registry.terraform.io/providers/Azure/azapi/latest/docs#use_msi