Azure / Azure/Azure-Landing-Zones

[Bug]: Management Group role assignments keep updating roledefinitionid

Open
#3,970 14 comments 0 reactions 1 assignee Claimed by @matt-FFFFFF View on GitHub
Needs: Author Feedback :ear: Product: ALZ Provider (Terraform) Product: Terraform (AVM)
Dominant language
PowerShell
Stars
97
Forks
70
Avg merge
3d 1h
Merged PRs (30d)
7

Description

### Which product(s) are you raising for?

ALZ Terraform (AVM)

### What versions of the tools are you using?

ALZ Terraform AVM Pattern Module : v0.15.0

### What is the bug?

When we make a change to our tfvars file e.g. adding a new virtual wan connection. The management grou role assignments show as wanting to update in place due to the roledefintionid being known after apply.

If we run a plan without changing our tfvars file the output shows that no changes are going to be made.

role_assignment_definition_lookup_enabled is set to true, tried setting this to false but it throws an invalid index error.

### Log Output

```Text
│ Error: Invalid index

│ on .terraform/modules/management_groups.management_groups.avm_interfaces/locals.role_assignments.tf line 11, in locals:
│ 11: result = uuidv5("url", format("%s%s", v.principal_id, local.role_assignments_role_name_to_resource_id[v.role_definition_id_or_name]))
│ ├────────────────
│ │ local.role_assignments_role_name_to_resource_id is object with no attributes
│ │ v.role_definition_id_or_name is "Contributor"

│ The given key does not identify an element in this collection value.

# module.management_groups[0].module.management_groups.azapi_resource.management_group_role_assignments["identity_contributor"] will be updated in-place
~ resource "azapi_resource" "management_group_role_assignments" {
~ body = {
~ properties = {
~ roleDefinitionId = "/providers/Microsoft.Authorization/roleDefinitions/####" -> (known after apply)
# (6 unchanged attributes hidden)
}
}
id = "/providers/Microsoft.Management/managementGroups/alz-identity/providers/Microsoft.Authorization/roleAssignments/###"
+ location = (known after apply)
name = "###"
~ output = {} -> (known after apply)
+ tags = (known after apply)
# (9 unchanged attributes hidden)

# (1 unchanged block hidden)
}
```

### Screenshot(s)

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.