could not acquire access token to parse claims: clientCredentialsToken

[micro9000]

Is there an existing issue for this?

• [X] I have searched the existing issues

Community Note

• Please vote on this issue by adding a :thumbsup: reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave comments along the lines of "+1", "me too" or "any updates", they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment and review the contribution guide to help.

Terraform Version

1.9.6

AzureRM Provider Version

4.3.0

Affected Resource(s)/Data Source(s)

azurerm

Terraform Configuration Files

terraform {
  required_providers {
    azurerm = {
      source = "hashicorp/azurerm"
      version = "4.3.0"
    }
    random = {
      source = "hashicorp/random"
      version = "3.6.3"
    }
  }
  # backend "azurerm" {
  # }
}

provider "azurerm" {
  features {
    key_vault {
      purge_soft_delete_on_destroy    = true
      recover_soft_deleted_key_vaults = true
    }
  }
}

provider "random" {
  # Configuration options
}

resource "azurerm_key_vault" "main_keyvault" {
  name                        = "${local.global_resource_prefix}kv"
  location                    = azurerm_resource_group.main_rg.location
  resource_group_name         = azurerm_resource_group.main_rg.name
  enabled_for_disk_encryption = true
  tenant_id                   = data.azurerm_client_config.current.tenant_id
  soft_delete_retention_days  = 7
  purge_protection_enabled    = false

  sku_name = "standard"

  access_policy {
    tenant_id = data.azurerm_client_config.current.tenant_id
    object_id = data.azurerm_client_config.current.object_id

    key_permissions = [
      "Get",
    ]

    secret_permissions = [
      "Get",
    ]

    storage_permissions = [
      "Get",
    ]
  }
}

Debug Output/Panic Output

Error: building account: could not acquire access token to parse claims: clientCredentialsToken: received HTTP status 400 with response: {"error":"unauthorized_client","error_description":"AADSTS700016: Application with identifier '2a36b856-8c1f-4bd8-aaf2-ddcc425213a2' was not found in the directory 'richmindcorner'. This can happen if the application has not been installed by the administrator of the tenant or consented to by any user in the tenant. You may have sent your authentication request to the wrong tenant. Trace ID: d15aece9-1a1b-4036-a5db-476ab897bd00 Correlation ID: 99fc26df-9cb8-4a29-9921-b5e53e01ed14 Timestsented to by any user in the tenant. You may have sent your authentication request to the wrong tenant. Trace ID: d15aece9-1a1b-4036-a5db-476ab897bd00 Correlation ID: 99fc26df-9cb8-4a29-9921-b5e53e01ed14 Timestamp: 2024-09-27 14:36:10Z","error_codes":[700016],"timestamp":"2024-09-27 14:36:10Z","trace_id":"d15aece9-1a1b-4036-a5db-476ab897bd00","correlation_id":"99fc26df-9cb8-4a29-9921-b5e53e01ed14","error_uri":"https:amp: 2024-09-27 14:36:10Z","error_codes":[700016],"timestamp":"2024-09-27 14:36:10Z","trace_id":"d15aece9-1a1b-4036-a5db-476ab897bd00","correlation_id":"99fc26df-9cb8-4a29-9921-b5e53e01ed14","error_uri":"https://login.microsoftonline.com/error?code=700016"}
│
│   with provider["registry.terraform.io/hashicorp/azurerm"],
│   on provider.tf line 16, in provider "azurerm":
│   16: provider "azurerm" {
│
╵

Expected Behaviour

When I run the terraform plan, it should be able to use my personal account that I have logged in using az login, not the client I used before

Actual Behaviour

Not able to run the terraform plan and I'm getting the error above

Steps to Reproduce

1. az account clear
2. az login
3. re-open the VS Code or Terminal that is pointed to the TF configs
4. terraform plan

Important Factoids

No

References

No

[Chambras]

@micro9000 Couple of things:

1. what version of az cli are you using?
2. Have you tried doing a terraform init before doing a terraform plan?

Also remember that starting since version 4.0 Specifying Subscription ID is now Mandatory

[micro9000]

Hi @Chambras

1. I'm currently using az cli v2.64.0
2. Yes, I already run the terraform init

[micro9000]

Additional actions I did:

I already tried to use Service Account as user locally using the instructions here https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/guides/service_principal_client_secret

1. az login --service-principal -u CLIENT_ID -p CLIENT_SECRET --tenant TENANT_ID
2. az account set --subscription="20000000-0000-0000-0000-000000000000"

Running normal Azure CLI commands are fine, e.g. az group list it returns all resource groups

But I still encounter the error above

[dev-nextprogress]

+1