Azure / Azure/terraform-provider-azapi

Importing a resource with a SystemAssigned identity should not show "known after apply" for principal_id

Open
#1,090 0 comments 1 reaction 1 assignee Claimed by @stevenjma View on GitHub
triaged
Dominant language
Go
Stars
244
Forks
97
Avg merge
5d 9h
Merged PRs (30d)
9

Description

We're trying to import a resource which has a SystemAssigned identity and also some role assignments for that identity. However, since the import for the resource shows "known after apply" for the principal_id, the role assignments (which use the principal_id to generate the name-guid) will need to be replaced.

Here's our resource:
```hcl
resource "azapi_resource" "policy_assignment" {
type = "Microsoft.Authorization/policyAssignments@2024-04-01"
parent_id = local.subscription_resource_id
name = "pa-monitoring-logs"
location = "westeurope"
identity {
type = "SystemAssigned"
}
body = {
properties = {
# ...
}
}
}
```
Importing the resource shows the following plan:

```hcl
# azapi_resource.policy_assignment will be updated in-place
# (imported from "/subscriptions/[redacted]/providers/Microsoft.Authorization/policyAssignments/pa-monitoring-logs?api-version=2024-04-01")
~ resource "azapi_resource" "policy_assignment" {
~ body = {
~ properties = {
- definitionVersion = "1.*.*"
# ...
}
}
id = "/subscriptions/[redacted]/providers/Microsoft.Authorization/policyAssignments/pa-monitoring-logs"
ignore_casing = false
ignore_missing_property = true
ignore_null_property = false
location = "westeurope"
name = "pa-monitoring-logs"
~ output = {
- id = "/subscriptions/[redacted]/providers/Microsoft.Authorization/policyAssignments/pa-monitoring-logs"
- identity = {
- principalId = "[redacted]"
- tenantId = "[redacted]"
}
- properties = {
- # ...
}
- type = "Microsoft.Authorization/policyAssignments"
} -> (known after apply)
parent_id = "/subscriptions/[redacted]"
+ response_export_values = []
schema_validation_enabled = true
sensitive_body = (write-only attribute)
type = "Microsoft.Authorization/policyAssignments@2024-04-01"

~ identity {
- identity_ids = [] -> null
~ principal_id = "[redacted]" -> (known after apply)
~ tenant_id = "[redacted]" -> (known after apply)
type = "SystemAssigned"
}
}
```

Would it be possible to change the import logic in a way that doesn't result in "known after apply" for `identity.principal_id` and `identity.tenant_id`?

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.