Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritise this request
Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritise the request
If you are interested in working on this issue or have submitted a pull request, please leave a comment
Terraform (and AzureAD Provider) Version
terraform_1.8.1_linux_amd64
Affected Resource(s)
azuread_application
Terraform Configuration Files
resource "azuread_application" "sso_app" {
display_name = var.sso_app_display_name
sign_in_audience = "AzureADMyOrg"
group_membership_claims = ["ApplicationGroup"]
required_resource_access {
resource_app_id = "00000003-0000-0000-c000-000000000000" # Microsoft Graph
resource_access {
id = "e1fe6dd8-ba31-4d61-89e7-88639da4683d" # User.Read
type = "Scope"
}
}
web {
redirect_uris = ["https://${var.argocd_config.hostname}/auth/callback"]
}
public_client {
redirect_uris = ["http://localhost:8085/auth/callback"]
}
optional_claims {
access_token {
name = "groups"
}
id_token {
name = "groups"
}
saml2_token {
name = "groups"
}
}
}
Debug Output
Planning failed. Terraform encountered an error while generating this plan.
╷
│ Error: Retrieving Application with object ID "0efb6050-3049-415e-83e7-4d3f3c4d6f92"
│
│ with azuread_application.sso_app,
│ on ad.tf line 1, in resource "azuread_application" "sso_app":
│ 1: resource "azuread_application" "sso_app" {
│
│ ApplicationsClient.BaseClient.Get(): unexpected status 403 with OData
│ error: Authorization_RequestDenied: Insufficient privileges to complete the
│ operation.
╵
╷
│ Error: Unauthorized
│
│ with kubernetes_namespace.argocd,
│ on main.tf line 1, in resource "kubernetes_namespace" "argocd":
│ 1: resource "kubernetes_namespace" "argocd" {
│
╵
time=2024-06-11T14:30:55Z level=error msg=terraform invocation failed in /builds/infra/environment_definitions/nonprod/projects/platform/poc/uksouth/cluster/argocd/.terragrunt-cache/WtvgRNsKGK4kxhkbvUCP4kWR5Is/YKKYT5K-8aPuzHHttAxD0K0sA20/azure/argocd prefix=[/builds/infra/environment_definitions/nonprod/projects/platform/poc/uksouth/cluster/argocd]
time=2024-06-11T14:30:55Z level=error msg=Module /builds/infra/environment_definitions/nonprod/projects/platform/poc/uksouth/cluster/argocd has finished with an error: 1 error occurred:
[/builds/infra/environment_definitions/nonprod/projects/platform/poc/uksouth/cluster/argocd/.terragrunt-cache/WtvgRNsKGK4kxhkbvUCP4kWR5Is/YKKYT5K-8aPuzHHttAxD0K0sA20/azure/argocd] exit status 1
prefix=[/builds/infra/environment_definitions/nonprod/projects/platform/poc/uksouth/cluster/argocd]
time=2024-06-11T14:30:55Z level=info msg=╷
│ Error: Retrieving Application with object ID "0efb6050-3049-415e-83e7-4d3f3c4d6f92"
│
│ with azuread_application.sso_app,
│ on ad.tf line 1, in resource "azuread_application" "sso_app":
│ 1: resource "azuread_application" "sso_app" {
│
│ ApplicationsClient.BaseClient.Get(): unexpected status 403 with OData
│ error: Authorization_RequestDenied: Insufficient privileges to complete the
│ operation.
╵
╷
│ Error: Unauthorized
│
│ with kubernetes_namespace.argocd,
│ on main.tf line 1, in resource "kubernetes_namespace" "argocd":
│ 1: resource "kubernetes_namespace" "argocd" {
│
╵
time=2024-06-11T14:30:55Z level=error msg=terraform invocation failed in /builds/infra/environment_definitions/nonprod/projects/platform/poc/uksouth/cluster/argocd/.terragrunt-cache/WtvgRNsKGK4kxhkbvUCP4kWR5Is/YKKYT5K-8aPuzHHttAxD0K0sA20/azure/argocd prefix=[/builds/infra/environment_definitions/nonprod/projects/platform/poc/uksouth/cluster/argocd]
time=2024-06-11T14:30:55Z level=error msg=1 error occurred:
[/builds/infra/environment_definitions/nonprod/projects/platform/poc/uksouth/cluster/argocd/.terragrunt-cache/WtvgRNsKGK4kxhkbvUCP4kWR5Is/YKKYT5K-8aPuzHHttAxD0K0sA20/azure/argocd] exit status 1
Panic Output
Expected Behavior
terraform plan should have passed
Actual Behavior
terraform plan fails complaining insufficient privileges to complete the operation. The service principal used to run the terraform is member of Application Administrator role under EntraID and have also been given additional graphAPI permissions for Directory
Community Note
Terraform (and AzureAD Provider) Version
terraform_1.8.1_linux_amd64
Affected Resource(s)
azuread_application
Terraform Configuration Files
Debug Output
Planning failed. Terraform encountered an error while generating this plan. ╷ │ Error: Retrieving Application with object ID "0efb6050-3049-415e-83e7-4d3f3c4d6f92" │ │ with azuread_application.sso_app, │ on ad.tf line 1, in resource "azuread_application" "sso_app": │ 1: resource "azuread_application" "sso_app" { │ │ ApplicationsClient.BaseClient.Get(): unexpected status 403 with OData │ error: Authorization_RequestDenied: Insufficient privileges to complete the │ operation. ╵ ╷ │ Error: Unauthorized │ │ with kubernetes_namespace.argocd, │ on main.tf line 1, in resource "kubernetes_namespace" "argocd": │ 1: resource "kubernetes_namespace" "argocd" { │ ╵ time=2024-06-11T14:30:55Z level=error msg=terraform invocation failed in /builds/infra/environment_definitions/nonprod/projects/platform/poc/uksouth/cluster/argocd/.terragrunt-cache/WtvgRNsKGK4kxhkbvUCP4kWR5Is/YKKYT5K-8aPuzHHttAxD0K0sA20/azure/argocd prefix=[/builds/infra/environment_definitions/nonprod/projects/platform/poc/uksouth/cluster/argocd] time=2024-06-11T14:30:55Z level=error msg=Module /builds/infra/environment_definitions/nonprod/projects/platform/poc/uksouth/cluster/argocd has finished with an error: 1 error occurred:
Panic Output
Expected Behavior
terraform plan should have passed
Actual Behavior
terraform plan fails complaining insufficient privileges to complete the operation. The service principal used to run the terraform is member of Application Administrator role under EntraID and have also been given additional graphAPI permissions for Directory
Steps to Reproduce
terraform plan
Important Factoids
References
0000