Open jasmineteh opened 1 year ago
it happens when remove subscription from a management group too while a RBAC with custom role( data action is in the role definition) in place. my fix is removing the RBAC and rerun terraform.
I ran into this issue today and found that it doesn't occur if you go into the portal and move the subscription yourself from there. Terraform wants to delete the association before it creates a new one to move the subscription, so the subscription will temporarily reside in the root management group. The custom role doesn't exist at the root management group, which is why the error appears.
My half-workaround to this was to use create_before_destroy
on the association resource. The apply will still fail (because the original association won't exist anymore when it tries to delete it), but it'll move the subscription for you.
resource "azurerm_management_group_subscription_association" "example" {
management_group_id = var.management_group_id
subscription_id = var.subscription_id
lifecycle {
create_before_destroy = true
}
}
I think the resource needs to be reworked so instead of replacing the resource when the management group changes it will update in place.
I will take a look into this, since we got the error, too.
@katbyte @stephybun Sorry for mention there, but I would like to share my design/idea here before starting a implementation.
It seems like Azure naively supports moving subscription to other management groups. This is important where a subscription has role assignments with custom role and the custom role has an assignable scope. which is not the Tenant Root.
Currently, Terraform tries to remove the Management group association which does work in such scenario. However, moving subscription to other management groups works without issues.
Since a subscription can be only assigned to management group, I would suggest to change the ID of azurerm_management_group_subscription_association to the subscriptions id, e.g. /subscription/<ID>
instead /managementGroup/MyManagementGroup/subscription/<ID>
. I would also add an state migration to avoid a breaking change.
Then, I would remove the ForceNew flag from management_group_id
. Bit similar to #26282
Would you agree with that proposal?
Is there an existing issue for this?
Community Note
Terraform Version
1.3.4
AzureRM Provider Version
3.57.0
Affected Resource(s)/Data Source(s)
azurerm_management_group_subscription_association, azurerm_management_group, azurerm_subscription
Terraform Configuration Files
Debug Output/Panic Output
Expected Behaviour
Actual Behaviour
Steps to Reproduce
terraform apply
to move "Sub A" to A2 by adding the subscription id usingazurerm_management_group
or update themanagement_group_id
inazurerm_management_group_subscription_association
.Note: Moving the "Sub A" to another management group worked via Azure portal and command line: https://learn.microsoft.com/en-us/cli/azure/account/management-group/subscription?view=azure-cli-latest#az-account-management-group-subscription-add
Important Factoids
No response
References
No response