Azure Role Assignment to AAD group fails with Terraform - azure-devops

Question

I am trying to assign contributor rights on a resource group to an Azure Active Directory Group using Terraform. The Terraform script I use looks like this:
# Deploy Resource Groups
resource "azurerm_resource_group" "rg" {
name = "rg-companyname-syn-env-100"
location = "westeurope"
}
# Retrieve data for AAD CloudAdmin groups
data "azuread_group" "cloud_admin" {
display_name = "AAD-GRP-companyname-CloudAdministrators-env"
security_enabled = true
}
# Add "Contributor" role to Cloudadmin AAD group
resource "azurerm_role_assignment" "cloud_admin" {
scope = azurerm_resource_group.rg.id
role_definition_name = "Contributor"
principal_id = data.azuread_group.cloud_admin.id
depends_on = [azurerm_resource_group.rg]
}
If I run this I receive the following error:
╷
│ Error: authorization.RoleAssignmentsClient#Create: Failure responding to request: StatusCode=403 -- Original Error: autorest/azure: Service returned an error. Status=403 Code="AuthorizationFailed" Message="The client '<application_object_id>' with object id '<application_object_id>' does not have authorization to perform action 'Microsoft.Authorization/roleAssignments/write' over scope '/subscriptions/<subscription_id>/resourceGroups/rg-companyname-syn-env-100/providers/Microsoft.Authorization/roleAssignments/<role_assignment_id>' or the scope is invalid. If access was recently granted, please refresh your credentials."
│
│ with azurerm_role_assignment.cloud_admin["syn"],
│ on rg.tf line 15, in resource "azurerm_role_assignment" "cloud_admin":
│ 15: resource "azurerm_role_assignment" "cloud_admin" {
│
╵
Note the AAD Group (AAD-GRP-companyname-CloudAdministrators-env) already has the Owner role on the subscription used.
Is there somebody that knows a fix for this problem?

Answer 1

I had this issue occur today after someone else in the team had changed the service principal my deployment ran under to a contributor rather than owner of the subscription. Assign the role the role "owner" of the subscription to the service account your deployments run under

Answer 2

Whichever principal (either you, a service principal or managed identity assigned to a build agent) likely has the built in Azure role Contributor which can manage resources, but not Role Based Access Control (RBAC). So that is the reason you are getting a 403 Unauthorized response.
Contributor role is allowed to read, but not write role assignments. Since you are using Terraform, I would suggest creating a custom role definition which will allow write as well as delete so you can use terraform destroy
You can create a custom role definition by clicky-clicking in the portal, azure cli or Terraform (snippet below); executed by someone with the Owner role.
Once you have a custom role assignment with the appropriate permissions then assign the principal that is executing the terraform apply with that custom role.
data "azurerm_client_config" "current" {
}
resource "azurerm_role_definition" "role_assignment_write_delete" {
name = "RBAC Owner"
scope = data.azurerm_client_config.current.subscription_id
description = "Management of role assignments"
permissions {
actions = [
"Microsoft.Authorization/roleAssignments/write",
"Microsoft.Authorization/roleAssignments/delete",
]
not_actions = []
}
assignable_scopes = [
data.azurerm_client_config.current.subscription_id //or management group
]
}