oed-guzym
commented
1 year ago Hi all, I tried the steps described in the documentation to Programmatically create Azure subscriptions for a Microsoft Partner Agreement with the latest APIs using the Azure CLI and my CSP user and was able to create a subscription in a custom tenant without any issues.
### Request
###########
billingAccount=$( \
az billing account list | jq -r '.[] | select(.displayName | contains("<CSP Tenant>")) | .name' \
)
customerTenantId=$( \
az billing customer list \
--account-name ${billingAccount} \
| jq -r '.[] | select(.displayName | contains("<Customer>")) | .name' \
)
az account alias create \
--name "SUBSCRIPTION-TST-EXAMPLE-CLI" \
--billing-scope "/providers/Microsoft.Billing/billingAccounts/${billingAccount}/customers/${customerTenantId}" \
--display-name "SUBSCRIPTION-TST-EXAMPLE-CLI" \
--workload "Production"
### Response
############
{
"id": "/providers/Microsoft.Subscription/aliases/SUBSCRIPTION-TST-EXAMPLE-CLI",
"name": "SUBSCRIPTION-TST-EXAMPLE-CLI",
"properties": {
"acceptOwnershipState": null,
"acceptOwnershipUrl": null,
"billingScope": null,
"createdTime": null,
"displayName": null,
"managementGroupId": null,
"provisioningState": "Succeeded",
"resellerId": null,
"subscriptionId": "<SUBSCRIPTION_ID>",
"subscriptionOwnerId": null,
"tags": null,
"workload": null
},
"systemData": null,
"type": "Microsoft.Subscription/aliases"
}In theory, the steps should not differ too much via Terraform, because there we also link the Billing ID of the CSP tenant and the respective tenant ID of the customer. I also run the Terraform code through my CSP user, so lack of permissions shouldn't really be a problem.
Since we mainly work with Terraform, we would also like to realize the creation of a subscription via Terraform. The Azure CLI would be more a workaround and not a real alternative. However, I don't know what our problem is with Terraform and how we can solve it.
giridhar-kolli
iTiamo
Is there an existing issue for this?
Community Note
Terraform Version
1.5.1
AzureRM Provider Version
3.61.0
Affected Resource(s)/Data Source(s)
azurerm_subscription
Terraform Configuration Files
Debug Output/Panic Output
Expected Behaviour
Our expectation is that we can create a subscription through Terraform for a customer tenant via the Microsoft Partner Agreement through our CSP tenant.
Actual Behaviour
Currently, we manually create a new subscription for a customer tenant from the Azure portal via our CSP tenant. We would like to automate this step using the "azurerm_subscription" resource.
In the provider configuration, the tenant ID of our CSP tenant is configured and the Terraform code itself is executed via a personalized user that exists in the Active Directory of the CSP tenant as Global Admin.
After running the code, we get the mentioned error message saying that the wrong token seems to be used and Terraform terminates the deployment. Interestingly, the subscription is still created in the customer tenant, but without tags.
In the documentation of the Terraform resource you can read the following:
If we look at the official documentation for Programmatically create Azure subscriptions for a Microsoft Partner Agreement with the latest APIs, it says the following as a prerequisite:
Unfortunately, I have no idea what the configuration via Terraform should look like so that we can automatically provision a subscription in a customer tenant. The fact that a personalized user was used is just a test. In the end, a service principal should be used for provisioning.
Does anyone have any idea what the provider configuration should look like or exactly what pre-requisites for Terraform need to be met in order for the deployment to go through without error message?
Steps to Reproduce
No response
Important Factoids
No response
References
No response