azuredevops_git_permission fails on collection-level groups

[EirikNess]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform (and Azure DevOps Provider) Version

Terraform v4.6.6 on linux_arm64 Provider version: 0.11.1

Affected Resource(s)

• azuredevops_git_permission

Terraform Configuration Files

First time reporting a bug, but here goes :) Setting git_permission on project-level groups works fine, but when setting permission on collection-level groups, terraform Apply fails. The permission gets updated in DevOps, but terraform fails to read the rules after write.

resource "azuredevops_project" "main" {
  count              = var.new_project == true ? 1 : 0
  name               = var.azuredevops_project.name
  visibility         = "private"
  version_control    = "Git"
  work_item_template = var.azuredevops_project.work_item_template
  description        = var.azuredevops_project.description
  features = {
    "boards"       = var.azuredevops_project.boards
    "repositories" = var.azuredevops_project.repositories
    "pipelines"    = var.azuredevops_project.pipelines
    "testplans"    = var.azuredevops_project.testplans
    "artifacts"    = var.azuredevops_project.artifacts
  }
}
data "azuredevops_group" "project_collection_build_service_accounts" {
  count = var.new_project ? 1 : 0
  name  = "Project Collection Build Service Accounts"
}

resource "azuredevops_git_permissions" "build_permissions" {
  count         = var.new_project ? 1 : 0
  project_id    = azuredevops_project.main[0].id
  principal     = data.azuredevops_group.project_collection_build_service_accounts[0].id
  permissions = {
    GenericContribute     = "Allow"
    PullRequestContribute = "Allow"
    CreateTag             = "Allow"
    GenericRead           = "Allow"
  }
}

Debug Output

│ Error:  waiting for permission update. Error reading permissions for principal INTERAL ERROR: identity map does not contain an item with key [Microsoft.TeamFoundation.Identity;x-x-x-xxx-xxx-xxx-xxx-x-x-x-x-x]: xxxxx.xxxxxxxxxxxxxxxxx 
│ 
│   with module.xxx.azuredevops_git_permissions.example-permissions[0],
│   on ../../modules/xxx/az-devops-setup.tf line 112, in resource "azuredevops_git_permissions" "example-permissions":
│  112: resource "azuredevops_git_permissions" "example-permissions" {
### Panic Output

Expected Behavior

Plan: 1 to add, 0 to change, 0 to destroy.
module.xxxxx.azuredevops_git_permissions.build_permissions[0]: Creating...
module.xxxxx.azuredevops_git_permissions.build_permissions[0]: Creation complete after 6s [id=xxxxxx/xxxxxxx-xxxx-xxxx-xxxx-xxxx/xxxxxx.xxxxxxxxxxxxxxxxxxx]

Apply complete! Resources: 1 added, 0 changed, 0 destroyed.

Actual Behavior

Setting git_permission on project groups works fine, but when setting permission on collection-level groups, terraform Apply fails. The permission gets updated in DevOps, but terraform fails to read the rules after write. Re-running terraform Apply will reproduce the error. I have tested to use time_sleep resource to force a wait between write and read, but with no luck.

Error:  waiting for permission update. Error reading permissions for principal INTERAL ERROR: identity map does not contain an item with key [Microsoft.TeamFoundation.Identity;x-x-x-xxx-xxx-xxx-xxx-x-x-x-x-x]: xxxxx.xxxxxxxxxxxxxxxxx 

Steps to Reproduce

1. terraform apply

Important Factoids

References

• 0000

[ken-vetter-absg]

I'm having the same issue. Trying to give the project build service account enhanced permissions in repos for pull requests tasks.
Can't select the specific Build Service User, but can use the Security Service Group, the build service is a member of (in the collection). The permissions update fine, but the script ultimately fails with the same error as OP shows. Is there a fix for this?

[CK-Yong]

Just ran into the exact same error. I have not found a workaround for this either.

Update: Since the resources are correctly created, we decided that we're pretty much unblocked for now, and for now we are working around it by setting count = 0 on the azuredevops_git_permissions resources. This allows other teams to not hit this same error on TF apply. Would be nice if it is fixed, however, as I can imagine doing further changes may be a pain...