Open aeimer opened 1 month ago
Hi @aeimer , thank you for bringing this to our attention. I've confirmed the issue on my end as well. It occurs because Terraform attempts to locate the principal_id
for the azurerm_role_assignment
resource during plan generation, but fails since the principal_id
hasn't been created yet. As a temporary solution, you can include the identity block for the initial terraform apply
run. Afterwards, incorporate the azurerm_role_assignment
and execute terraform apply
again.
Mininal template to reproduce:
terraform {
required_providers {
azurerm = {
source = "hashicorp/azurerm"
version = "3.85"
}
}
}
provider "azurerm" {
features {}
}
resource "azurerm_resource_group" "example" {
name = "yunliuGHTest"
location = "East US"
lifecycle {
ignore_changes = [tags]
}
}
resource "azurerm_cognitive_account" "example" {
name = "example-account"
location = azurerm_resource_group.example.location
resource_group_name = azurerm_resource_group.example.name
kind = "SpeechServices"
sku_name = "S0"
tags = {
Acceptance = "Test"
}
}
resource "azurerm_search_service" "example" {
name = "example-search222"
location = azurerm_resource_group.example.location
resource_group_name = azurerm_resource_group.example.name
sku = "basic"
identity {
type = "SystemAssigned"
}
}
resource "azurerm_role_assignment" "cognitiveaccount_search_reader" {
scope = azurerm_search_service.example.id
role_definition_name = "Search Index Data Reader"
principal_id = azurerm_cognitive_account.example.identity[0].principal_id
}
Error details
╷
│ Error: Invalid index
│
│ on main.tf line 51, in resource "azurerm_role_assignment" "cognitiveaccount_search_reader":
│ 51: principal_id = azurerm_cognitive_account.example.identity[0].principal_id
│ ├────────────────
│ │ azurerm_cognitive_account.example.identity is empty list of object
│
│ The given key does not identify an element in this collection value: the collection has no elements.
Is there an existing issue for this?
Community Note
Terraform Version
1.9.2
AzureRM Provider Version
~> 3.85
Affected Resource(s)/Data Source(s)
azurerm_search_service, azurerm_role_assignment
Terraform Configuration Files
Debug Output/Panic Output
Expected Behaviour
The provider should be able to enable the identity first and then using the generated values.
Actual Behaviour
The provider fails as the current state does not have the required properties.
Steps to Reproduce
Important Factoids
No response
References
No response