Open oed-guzym opened 1 year ago
Hi all, I tried the steps described in the documentation to Programmatically create Azure subscriptions for a Microsoft Partner Agreement with the latest APIs using the Azure CLI and my CSP user and was able to create a subscription in a custom tenant without any issues.
### Request
###########
billingAccount=$( \
az billing account list | jq -r '.[] | select(.displayName | contains("<CSP Tenant>")) | .name' \
)
customerTenantId=$( \
az billing customer list \
--account-name ${billingAccount} \
| jq -r '.[] | select(.displayName | contains("<Customer>")) | .name' \
)
az account alias create \
--name "SUBSCRIPTION-TST-EXAMPLE-CLI" \
--billing-scope "/providers/Microsoft.Billing/billingAccounts/${billingAccount}/customers/${customerTenantId}" \
--display-name "SUBSCRIPTION-TST-EXAMPLE-CLI" \
--workload "Production"
### Response
############
{
"id": "/providers/Microsoft.Subscription/aliases/SUBSCRIPTION-TST-EXAMPLE-CLI",
"name": "SUBSCRIPTION-TST-EXAMPLE-CLI",
"properties": {
"acceptOwnershipState": null,
"acceptOwnershipUrl": null,
"billingScope": null,
"createdTime": null,
"displayName": null,
"managementGroupId": null,
"provisioningState": "Succeeded",
"resellerId": null,
"subscriptionId": "<SUBSCRIPTION_ID>",
"subscriptionOwnerId": null,
"tags": null,
"workload": null
},
"systemData": null,
"type": "Microsoft.Subscription/aliases"
}
In theory, the steps should not differ too much via Terraform, because there we also link the Billing ID of the CSP tenant and the respective tenant ID of the customer. I also run the Terraform code through my CSP user, so lack of permissions shouldn't really be a problem.
Since we mainly work with Terraform, we would also like to realize the creation of a subscription via Terraform. The Azure CLI would be more a workaround and not a real alternative. However, I don't know what our problem is with Terraform and how we can solve it.
Are there any updates on this issue?
Hello All, We also came across this same issue recently and are actively looking for solutions. We used azapi_resource to create a subscription, also using a Service Principal to provision and have added in provider.
Terraform Configuration File
# provider.tf
terraform {
required_version = ">= 1.3.0"
required_providers {
azurerm = {
source = "hashicorp/azurerm"
version = ">= 3.7.0"
}
azapi = {
source = "Azure/azapi"
version = ">= 1.3.0"
}
}
}
provider "azurerm" {
features {}
client_id = "<SP_Client_ID>"
client_secret = "<SP_Secret_Value>"
skip_provider_registration = true
tenant_id = var.CSP_tenant_id
}
# main.tf
data "azurerm_billing_mpa_account_scope" "CSP_Tenant" {
billing_account_name = "CSP_Tenant_Billing_account_Name"
customer_name = var.customer_tenant_id
}
resource "azapi_resource" "subscription" {
type = "Microsoft.Subscription/aliases@2021-10-01"
name = var.subscription_alias_name
parent_id = "/"
body = jsonencode({
properties = {
displayName = var.subscription_name
workload = "Production"
billingScope = data.azurerm_billing_mpa_account_scope.CSP_Tenant.id
}
})
response_export_values = ["properties.subscriptionId"]
lifecycle {
ignore_changes = [
body,
name
]
}
}
Output
2024-01-26T23:09:13.274Z [ERROR] provider.terraform-provider-azurerm_v3.89.0_x5: Response contains error diagnostic: @module=sdk.proto tf_provider_addr=provider @caller=github.com/hashicorp/terraform-plugin-go@v0.19.0/tfprotov5/internal/diag/diagnostics.go:58 diagnostic_detail= diagnostic_severity=ERROR diagnostic_summary="building account: unable to configure ResourceManagerAccount: subscription ID could not be determined and was not specified" tf_proto_version=5.4 tf_req_id=dab60aff-1fc3-3994-f349-1f61616df1ea tf_rpc=Configure timestamp=2024-01-26T23:09:13.274Z
2024-01-26T23:09:13.275Z [ERROR] vertex "module.sub_vending.provider[\"registry.terraform.io/hashicorp/azurerm\"]" error: building account: unable to configure ResourceManagerAccount: subscription ID could not be determined and was not specified
╷
│ Error: building account: unable to configure ResourceManagerAccount: subscription ID could not be determined and was not specified
│
│ with module.sub_vending.provider["registry.terraform.io/hashicorp/azurerm"],
│ on ../../provider.tf line 15, in provider "azurerm":
│ 15: provider "azurerm" {
│
╵
Unfortunately, It is looking for a subscription_id, which at this point is unknown and we cannot set on the provider. How to proceed on this?
References:
I am running into the same issue, any updates?
What I am seeing in the debug logs is that Terraform is waiting for the deployed subscription to be enabled. To do that it calls /subscriptions/<
Is there an existing issue for this?
Community Note
Terraform Version
1.5.1
AzureRM Provider Version
3.61.0
Affected Resource(s)/Data Source(s)
azurerm_subscription
Terraform Configuration Files
Debug Output/Panic Output
Expected Behaviour
Our expectation is that we can create a subscription through Terraform for a customer tenant via the Microsoft Partner Agreement through our CSP tenant.
Actual Behaviour
Currently, we manually create a new subscription for a customer tenant from the Azure portal via our CSP tenant. We would like to automate this step using the "azurerm_subscription" resource.
In the provider configuration, the tenant ID of our CSP tenant is configured and the Terraform code itself is executed via a personalized user that exists in the Active Directory of the CSP tenant as Global Admin.
After running the code, we get the mentioned error message saying that the wrong token seems to be used and Terraform terminates the deployment. Interestingly, the subscription is still created in the customer tenant, but without tags.
In the documentation of the Terraform resource you can read the following:
If we look at the official documentation for Programmatically create Azure subscriptions for a Microsoft Partner Agreement with the latest APIs, it says the following as a prerequisite:
Unfortunately, I have no idea what the configuration via Terraform should look like so that we can automatically provision a subscription in a customer tenant. The fact that a personalized user was used is just a test. In the end, a service principal should be used for provisioning.
Does anyone have any idea what the provider configuration should look like or exactly what pre-requisites for Terraform need to be met in order for the deployment to go through without error message?
Steps to Reproduce
No response
Important Factoids
No response
References
No response