403 after root MG creation with ServicePrincipal - follow up on #173

Check for previous/existing GitHub issues

• I have checked for previous/existing GitHub issues

Issue Type?

I'm not sure

(Optional) Module Version

0.12.0

(Optional) Correlation Id

No response

Description

This is a follow up on Azure/Azure-Landing-Zones#1614 which is already closed and the solution unfortunately doesn't work for me.

Basically:

• root mg is created successfully in Azure (I can see it in the portal), but terraform returns an error and no success
• error is 403

"/providers/Microsoft.Management/managementGroups/alzroot" / Api Version
│ "2023-04-01"): GET
│ https://management.azure.com/providers/Microsoft.Management/managementGroups/alzroot
│ --------------------------------------------------------------------------------
│ --------------------------------------------------------------------------------
│ RESPONSE 403: 403 Forbidden
│ ERROR CODE: AuthorizationFailed
│ --------------------------------------------------------------------------------
│ {
│   "error": {
│     "code": "AuthorizationFailed",
│     "message": "The client '4a56321e-f77f-42b6-af0f-e38bec3010cd' with object id '4a56321e-f77f-42b6-af0f-e38bec3010cd' does not have authorization to perform action 'Microsoft.Management/managementGroups/read' over scope '/providers/Microsoft.Management/managementGroups/alzroot' or the scope is invalid. If access was recently granted, please refresh your credentials."
│   }
│ }
│ --------------------------------------------------------------------------------

• I use a service principal (with HCP TF Cloud) and ARM_ environment variables
• with az login it works, as well as with terraform-caf-enterprise-scale
• I already followed the solution from Azure/Azure-Landing-Zones#1614 and increased timeouts

 retries = {
    management_groups = {
      error_message_regex = [
        "AuthorizationFailed",
        "Failed to retrieve resource",
      ]
      interval_seconds     = 20
      max_interval_seconds = 180
      multiplier           = 2
      randomization_factor = 0.5
    }
  }
  timeouts = {
    management_group = {
      create = "30m"
      delete = "20m"
      read   = "30m"
      update = "30m"
    }
  }

After having it increased to 30m now and still being stuck in the issue I create this case, as I think that it can't be to increase it beyond this as this would then apply to each MG.

Do you guys have any ideas if that could be related to something else I don't see?
I double-checked, the alzroot gets my SP assigned as Owner automatically, so that should be fine as well.

Best & Thanks a lot,
Matthias