microsoft / microsoft/AzureTRE
Enabling AUTO_GRANT_WORKSPACE_CONSENT on an existing TRE causes workspace updates to fail
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 235
- Forks
- 192
- Avg merge
- 1d 23h
- Merged PRs (30d)
- 13
Description
On an existing TRE with workspaces deployed, enabling the AUTO_GRANT_WORKSPACE_CONSENT variable, causes issues when trying to update / upgrade existing workspaces (ones that were granted consent manually):
This is because the workspace consent was manually approved, and terraform refuses to add it because it exists already.
Workaround - go into Entra > App Registrations > mytre UX > API Permissions and revoke the consent for the workspace that was manually granted
Then update the workspace which will re grant the consent via terraform.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing an existing workspace update with AUTO_GRANT_WORKSPACE_CONSENT enabled, then trace the Terraform handling of workspace consent and the manually granted Entra permission. Done means upgrades work without requiring users to revoke existing consent first.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- azure, terraform
- Domain
- authorization, cloud, infrastructure
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100