Azure Storage Accounts bicep deployment fails for sku Standard_LRS - azure
I have the following bicep file for Azure Blobs Storage on the Standard_LRS
resource storageAccount 'Microsoft.Storage/storageAccounts#2022-05-01' = {
name: 'ifmsstorageaccount'
location: location
sku: {
name: 'Standard_LRS'
}
kind: 'BlockBlobStorage'
properties: {
accessTier: 'Hot'
}
}
when deploying to azure I get the following error:
ERROR: ***"status":"Failed","error":***"code":"DeploymentFailed","message":"At
least one resource deployment operation failed. Please list deployment operations for details. Please see https://aka.ms/DeployOperations for
usage details.","details":[***"code":"Conflict","message":"***\r\n
\"status\": \"Failed\",\r\n \"error\": ***\r\n \"code\":
\"ResourceDeploymentFailure\",\r\n \"message\": \"The resource
operation completed with terminal provisioning state 'Failed'.\",\r\n
\"details\": [\r\n ***\r\n \"code\": \"DeploymentFailed
\",\r\n \"message\": \"At least one resource deployment operation
failed. Please list deployment operations for details. Please see
https://aka.ms/DeployOperations for usage details.\",\r\n
\"details\": [\r\n ***\r\n \"code\": \"BadRequest
\",\r\n \"message\": \"***\\r\\n \\\"error\\\": ***\\r\\n
\\\"code\\\": \\\"InvalidParameter\\\",\\r\\n \\\"message\\\": \\\"Pricing tier doesn't match the subscription's billing model. Read
http://aka.ms/PricingTierWarning for more details. Operation Id:
'ccfd950570ed8ac1dd3214b811d46933'\\\"\\r\\n ***\\r\\n***\"\r\n
***\r\n ]\r\n ***\r\n ]\r\n ***\r\n***"***,***"code":"Conflict","message":"***\r\n \"status\":
\"Failed\",\r\n \"error\": ***\r\n \"code\":
\"ResourceDeploymentFailure\",\r\n \"message\": \"The resource
operation completed with terminal provisioning state 'Failed'.\",\r\n
\"details\": [\r\n ***\r\n \"code\": \"DeploymentFailed
\",\r\n \"message\": \"At least one resource deployment operation
failed. Please list deployment operations for details. Please see
https://aka.ms/DeployOperations for usage details.\",\r\n
\"details\": [\r\n ***\r\n \"code\": \"BadRequest
\",\r\n \"message\": \"***\\r\\n \\\"error\\\": ***\\r\\n
\\\"code\\\": \\\"ParameterOutOfRange\\\",\\r\\n \\\"message\\\":
\\\"The value of the 'Sku.Name' should be in: [Standard_B1ms,
Standard_B1s, Standard_B2s, Standard_B4ms, Standard_B8ms,
Standard_D16s_v3, Standard_D2s_v3, Standard_D32s_v3, Standard_D4s_v3,
Standard_D64s_v3, Standard_D8s_v3, Standard_E16s_v3, Standard_E2s_v3,
Standard_E32s_v3, Standard_E4s_v3, Standard_E64s_v3, Standard_E8s_v3,
Standard_M128ms, Standard_M128s, Standard_M64ms, Standard_M64s,
Standard_E48s_v3, Standard_D2ds_v4, Standard_D4ds_v4, Standard_D8ds_v4,
Standard_D16ds_v4, Standard_D32ds_v4, Standard_D48ds_v4,
Standard_D64ds_v4, Standard_E2ds_v4, Standard_E4ds_v4, Standard_E8ds_v4,
Standard_E16ds_v4, Standard_E32ds_v4, Standard_E48ds_v4,
Standard_E64ds_v4, Standard_D48s_v3, Standard_E20ds_v4, Standard_M8ms,
Standard_M16ms, Standard_M32ts, Standard_M32ls, Standard_M32ms,
Standard_M64ls, Standard_M64, Standard_M64m, Standard_M128, Standard_M128m, Standard_B12ms, Standard_B16ms, Standard_B20ms,
Standard_D2ads_v5, Standard_D4ads_v5, Standard_D8ads_v5,
Standard_D16ads_v5, Standard_D32ads_v5, Standard_D48ads_v5,
Standard_D64ads_v5, Standard_D96ads_v5, Standard_E2ads_v5,
Standard_E4ads_v5, Standard_E16ads_v5, Standard_E20ads_v5,
Standard_E32ads_v5, Standard_E48ads_v5, Standard_E64ads_v5,
Standard_E96ads_v5, Standard_D2_v5, Standard_D4_v5, Standard_D8_v5,
Standard_D16_v5, Standard_D32_v5, Standard_D48_v5, Standard_D64_v5,
Standard_D96_v5, Standard_D2s_v5, Standard_D4s_v5, Standard_D8s_v5,
Standard_D16s_v5, Standard_D32s_v5, Standard_D48s_v5, Standard_D64s_v5,
Standard_D96s_v5, Standard_D2ds_v5, Standard_D4ds_v5, Standard_D8ds_v5,
Standard_D16ds_v5, Standard_D32ds_v5, Standard_D48ds_v5,
Standard_D64ds_v5, Standard_D96ds_v5, Standard_E2ds_v5,
Standard_E4ds_v5, Standard_E8ds_v5, Standard_E16ds_v5,
Standard_E20ds_v5, Standard_E32ds_v5, Standard_E48ds_v5,
Standard_E64ds_v5, Standard_E96ds_v5, Standard_E104ids_v5,
Standard_E2bds_v5, Standard_E4bds_v5, Standard_E8bds_v5,
Standard_E16bds_v5, Standard_E32bds_v5, Standard_E48bds_v5,
Standard_E64bds_v5]. Verify that the specified parameter value is
correct.\\\"\\r\\n ***\\r\\n***\"\r\n ***\r\n ]\r\n
***\r\n ]\r\n ***\r\n***"***,***"code":"Conflict","message":"***\r\n
\"status\": \"Failed\",\r\n \"error\": ***\r\n \"code\":
\"ResourceDeploymentFailure\",\r\n \"message\": \"The resource
operation completed with terminal provisioning state 'Failed'.\",\r\n
\"details\": [\r\n ***\r\n \"code\": \"DeploymentFailed
\",\r\n \"message\": \"At least one resource deployment operation
failed. Please list deployment operations for details. Please see
https://aka.ms/DeployOperations for usage details.\",\r\n
\"details\": [\r\n ***\r\n \"code\": \"BadRequest
\",\r\n \"message\": \"***\\r\\n \\\"error\\\": ***\\r\\n
\\\"code\\\": \\\"InvalidValuesForRequestParameters\\\",\\r\\n
\\\"message\\\": \\\"Values for request parameters are invalid: kind,
sku. For more information, see - https://aka.ms/storageaccounttypes\\\"
\\r\\n ***\\r\\n***\"\r\n ***\r\n ]\r\n ***\r\n
]\r\n ***\r\n***"***]***
and I don't know how to tell which of these are Standard_LRS
The BlockBlobStorage kind is part of the Premium SKU.
In order for the storage account to be deployed, you would need to slightly amend your configuration so that the SKU name matches the chosen kind configuration:
resource storage_account 'Microsoft.Storage/storageAccounts#2022-09-01' = {
name: 'ifmsstorageaccount'
location: location
sku: {
name: 'Premium_LRS'
}
kind: 'BlockBlobStorage'
}
This should allow you to deploy the storage account. The displayed VM SKUs are strange but I assume that you also have some further configurations in your bicep file that are the cause for that particular error.
Hope this helps!
I tried in my environment and got below results:
According to MS-DOCS, location should be string in your code like East US or West US.
Main.bicep:
resource storageAccount 'Microsoft.Storage/storageAccounts#2022-05-01'= {
name: 'venkat9874'
location: 'East US'
sku: {
name: 'Standard_LRS'
}
kind: 'StorageV2'
properties: {
accessTier: 'Hot'
}
}
The above Bicep file is deployed with using PowerShell.
Commands:
New-AzResourceGroupDeployment -TemplateFile Main.bicep -ResourceGroupName <your resource grp>
Console:
Portal:
Related
Error The parameter LinuxFxVersion has an invalid value when deploying my azure function resource
I am attempting to deploy .NET Framework application with Azure function, i am working off an existing ARM json template which i converted to .bicep file. One of the resources is the below resource resourceName_resource 'Microsoft.Web/sites#2021-02-01' = { name: resourceName location: resourceLocation identity: { type: 'SystemAssigned' } tags: { 'hidden-related:${appServicePlan_ResourceId}': 'empty' } kind: 'functionapp' properties: { httpsOnly: true reserved: false serverFarmId: appServicePlan_ResourceId siteConfig: { alwaysOn: true linuxFxVersion: 'DOTNETCORE|6.0' } } dependsOn: [ appServicePlan_name storage_name ] } However when i run the deployment i get the below error, now i am assuming the error is caused by the above configuration as thats the only resource with LinuxFxVersion. How do i correct this error ? { "status":"Failed", "error":{ "code":"DeploymentFailed", "message":"At least one resource deployment operation failed. Please list deployment operations for details. Please see https://aka.ms/DeployOperations for usage details.", "details":[ { "code":"BadRequest", "message":"{\r\n \"Code\": \"BadRequest\",\r\n \"Message\": \"The parameter LinuxFxVersion has an invalid value.\",\r\n \"Target\": null,\r\n \"Details\": [\r\n {\r\n \"Message\": \"The parameter LinuxFxVersion has an invalid value.\"\r\n },\r\n {\r\n \"Code\": \"BadRequest\"\r\n },\r\n {\r\n \"ErrorEntity\": {\r\n \"ExtendedCode\": \"01007\",\r\n \"MessageTemplate\": \"The parameter {0} has an invalid value.\",\r\n \"Parameters\": [\r\n \"LinuxFxVersion\"\r\n ],\r\n \"Code\": \"BadRequest\",\r\n \"Message\": \"The parameter LinuxFxVersion has an invalid value.\"\r\n }\r\n }\r\n ],\r\n \"Innererror\": null\r\n}" } ] } }
Double check the bicep for deploying the Microsoft.Web/serverfarms resource. I recall a similar error because I had left out the property setting reserved: true. Once I added that setting, then the deployment succeeded. If you already created the app service plan, you'll need to remove it and redeploy in order for the change to be accepted. I ran the following and it worked. param location string = 'East US' resource hostingPlan 'Microsoft.Web/serverfarms#2021-01-15' = { name: 'apphostingplanname' location: location properties: { reserved: true } sku: { tier: 'Standard' name: 'S1' } kind: 'linux' } resource resourceName_resource 'Microsoft.Web/sites#2021-02-01' = { name: 'somewebapp72478340' location: location identity: { type: 'SystemAssigned' } tags: { 'hidden-related:${hostingPlan.id}': 'empty' } kind: 'functionapp' properties: { httpsOnly: true reserved: false serverFarmId: hostingPlan.id siteConfig: { alwaysOn: true linuxFxVersion: 'DOTNETCORE|6.0' } } } Result:
Azure bicep Pass Storage Account Connection String to Secret Keyvault loop issue
I have a the following bicep script to perform the following steps: Create storage accounts based on code create a key encrypt storage account with the correct key generate a secret connection string (storage account) into a key vault The infra is splitted into 2 resource groups: rg-shared => where the 2 key vault are (1 keyvault for key and GUID, and 1 keyvault for secrets (connection string) rg-storage-account => where all the storage account get created In azure bicep I have the following scripts: Storage.bicep param ManagedIdentityid string param uri string param kvname string param keyvaultrg string = 'XXXX' //<== SHARED Resource Group var keyVaultKeyPrefix = 'Key-Data-' var storagePrefix = 'sthritesteur' param tenantCodes array = [ 'aabb' 'bbcc' 'ccdd' ] // Create storage accounts resource storageAccount 'Microsoft.Storage/storageAccounts#2021-04-01' = [for tenantCode in tenantCodes: { name: '${storagePrefix}${tenantCode}' location: resourceGroup().location kind: 'StorageV2' sku: { name: 'Standard_RAGRS' } // Assign the identity identity: { type: 'UserAssigned' userAssignedIdentities: { '${ManagedIdentityid}':{} } } properties: { allowCrossTenantReplication: true minimumTlsVersion: 'TLS1_2' allowBlobPublicAccess: false allowSharedKeyAccess: true networkAcls: { bypass: 'AzureServices' virtualNetworkRules: [] ipRules: [] defaultAction: 'Allow' } supportsHttpsTrafficOnly: true encryption: { identity: { // specify which identity to use userAssignedIdentity: ManagedIdentityid } keySource: 'Microsoft.Keyvault' keyvaultproperties: { keyname: '${kvname}-${keyVaultKeyPrefix}${toUpper(tenantCode)}' keyvaulturi:uri } services: { file: { keyType: 'Account' enabled: true } blob: { keyType: 'Account' enabled: true } } } accessTier: 'Hot' } }] resource storage_Accounts_name_default 'Microsoft.Storage/storageAccounts/blobServices#2021-04-01' = [ for (storageName, i) in tenantCodes :{ parent: storageAccount[i] name: 'default' properties: { changeFeed: { enabled: false } restorePolicy: { enabled: false } containerDeleteRetentionPolicy: { enabled: true days: 7 } cors: { corsRules: [] } deleteRetentionPolicy: { enabled: true days: 30 } isVersioningEnabled: true } }] module connectionString 'shared.bicep' = [for (storageName, i) in tenantCodes :{ scope: resourceGroup(keyvaultrg) name: storageName params: { storageAccountString: 'DefaultEndpointsProtocol=https;AccountName=${storageAccount[i].name};AccountKey=${listKeys(storageAccount[i].id, storageAccount[i].apiVersion).keys[0].value};EndpointSuffix=${environment().suffixes.storage}' } }] keyvaultclient.bicep param deploymentIdOne string = newGuid() param deploymentIdTwo string = newGuid() output deploymentIdOne string = '${deploymentIdOne}-${deploymentIdTwo}' output deploymentIdTwo string = deploymentIdTwo param storagerg string = 'XXXX' //<=== Storage Accounts Resource Groups param sharedManagedIdentity string = 'mgn-identity-shared' param keyvaultmain string = 'XXXX' //<=== KeyVault Name where to create GUID AND Keys param tenantCodes array = [ 'aabb' 'bbcc' 'ccdd' ] var clientDataKeyPrefix = 'Key-Data-' resource managedIdentity 'Microsoft.ManagedIdentity/userAssignedIdentities#2018-11-30' = { name: sharedManagedIdentity location: resourceGroup().location } resource keyVaultClients 'Microsoft.KeyVault/vaults#2021-06-01-preview' existing = { name: keyvaultmain } resource kvClientsKey 'Microsoft.KeyVault/vaults/keys#2021-06-01-preview' = [for code in tenantCodes: { parent:keyVaultClients name: '${keyVaultClients.name}-${clientDataKeyPrefix}${toUpper(code)}' properties: { keySize: 2048 kty: 'RSA' // Assign the least permission keyOps: [ 'unwrapKey' 'wrapKey' ] } }] resource accessPolicy 'Microsoft.KeyVault/vaults/accessPolicies#2021-06-01-preview' = { parent:keyVaultClients name: 'add' properties: { accessPolicies: [ { tenantId: subscription().tenantId objectId: managedIdentity.properties.principalId permissions: { // minimum required permission keys: [ 'get' 'unwrapKey' 'wrapKey' ] } } ] } } resource clientLearnersGuid 'Microsoft.KeyVault/vaults/secrets#2021-06-01-preview' = [for tenant in tenantCodes: { parent:keyVaultClients name: '${keyVaultClients.name}${tenant}' properties: { contentType: 'GUID Key' value: '${deploymentIdOne}-${deploymentIdTwo}' } dependsOn:kvClientsKey }] module StorageAccount 'storage.bicep' = [for (storageName, i) in tenantCodes :{ scope: resourceGroup(storagerg) name: storageName params: { ManagedIdentityid:managedIdentity.id kvname:keyVaultClients.name uri:keyVaultClients.properties.vaultUri } dependsOn:clientLearnersGuid }] shared.bicep param keyvaultshared string = 'XXXX' //<=== Key Vault Where to Store the Storage Connection String Secret param storageAccountString string param tenantCodes array = [ 'aabb' 'bbcc' 'ccdd' ] resource keyVaultShared 'Microsoft.KeyVault/vaults#2021-06-01-preview' existing = { name: keyvaultshared } resource storageAccountConnectionString 'Microsoft.KeyVault/vaults/secrets#2021-06-01-preview' = [for tenant in tenantCodes: { parent:keyVaultShared name: '${keyVaultShared.name}-test${tenant}' properties:{ contentType: '${tenant} Storage Account Connection String' value: storageAccountString } }] Those script performs all the steps I needed based on the tenantCode. Which is just perfect. If I have only 1 tenantCode declared, everything goes smooth and perfect, but the issue I am facing raises when I try to declare more than 1. And this is the problem in details. When I declare more than 1 code, the script still created all the resources I needed: Storage accounts,Keys,Encryptions, GUID and ConnectionStrings Secrets. But it fails anyway on the ConnectionStrings Secret. The reason why it fails it because in those files at this block of code: Shared.bicep resource storageAccountConnectionString 'Microsoft.KeyVault/vaults/secrets#2021-06-01-preview' = [for tenant in tenantCodes: { parent:keyVaultShared name: '${keyVaultShared.name}-test${tenant}' properties:{ contentType: '${tenant} Storage Account Connection String' value: storageAccountString } }] and keuvaultsclient.bicep* module StorageAccount 'storage.bicep' = [for (storageName, i) in tenantCodes :{ scope: resourceGroup(storagerg) name: storageName params: { ManagedIdentityid:managedIdentity.id kvname:keyVaultClients.name uri:keyVaultClients.properties.vaultUri } dependsOn:clientLearnersGuid }] I have a multiple loop, on which I realised that in my shared keyvault under secrets, I have the correct amount of secrets (with 3 tenant codes I have 3 secrets) and under each secret I have 3 versions (for each tenant code it generate a new version for each secret). This looping error causes bicep script to fail with the following message: {"status":"Failed","error":{"code":"DeploymentFailed","message":"At least one resource deployment operation failed. Please list deployment operations for details. Please see https://aka.ms/DeployOperations for usage details.","details":[{"code":"Conflict","message":"{\r\n \"status\": \"Failed\",\r\n \"error\": {\r\n \"code\": \"ResourceDeploymentFailure\",\r\n \"message\": \"The resource operation completed with terminal provisioning state 'Failed'.\",\r\n \"details\": [\r\n {\r\n \"code\": \"DeploymentFailed\",\r\n \"message\": \"At least one resource deployment operation failed. Please list deployment operations for details. Please see https://aka.ms/DeployOperations for usage details.\",\r\n \"details\": [\r\n {\r\n \"code\": \"Conflict\",\r\n \"message\": \"{\\r\\n \\\"error\\\": {\\r\\n \\\"code\\\": \\\"StorageAccountOperationInProgress\\\",\\r\\n \\\"message\\\": \\\"An operation is currently performing on this storage account that requires exclusive access.\\\"\\r\\n }\\r\\n}\"\r\n },\r\n {\r\n \"code\": \"Conflict\",\r\n \"message\": \"{\\r\\n \\\"error\\\": {\\r\\n \\\"code\\\": \\\"StorageAccountOperationInProgress\\\",\\r\\n \\\"message\\\": \\\"An operation is currently performing on this storage account that requires exclusive access.\\\"\\r\\n }\\r\\n}\"\r\n }\r\n ]\r\n }\r\n ]\r\n }\r\n}"}]}} I am totally blocked at this stage and as I am a bicep beginner, I run out of all options and test to try to solve this issue. How to reproduce Create 2 resource groups(one for the key vaults and one for the storage accounts) Update parameters with the correct kv names In all files add atleast 2 tenantCode on each file execute the command az deployment group create -f ./keyvaultsclient.bicep -g <rg-where-keyvaults-are> I hope I explained clearly enough the issue I am facing and please if you need more details just let me know. Thank you so much for your time and help
I tested the same code by doing some changes, Please try doing the same changes in the .bicep files : keyvaultclient.bicep: Removed the loop for module as its creating 2 modules for the same thing. module StorageAccount './storage.bicep' = { scope: resourceGroup(storagerg) name: 'NestedStorage' params: { ManagedIdentityid:managedIdentity.id kvname:keyVaultClients.name uri:keyVaultClients.properties.vaultUri } dependsOn:clientLearnersGuid } storage.bicep: Removed the loop for module and added the loop for only storage connection string which will store the outputs in array and pass it to the next module. module connectionString './shared.bicep'={ scope: resourceGroup(keyvaultrg) name: 'KeyvaultNested' params: { storageAccountString: [for (tenant,i) in tenantCodes :{ id:'DefaultEndpointsProtocol=https;AccountName=${storageAccount[i].name};AccountKey=${listKeys(storageAccount[i].id, storageAccount[i].apiVersion).keys[0].value};EndpointSuffix=${environment().suffixes.storage}' }] } } shared.bicep: Changed the parameter type of StorageAccountString from string to array and added [for (tenant,i) in tenantCodes in the secret part so that I can give the value as storageAccountString[i].id . param storageAccountString array resource storageAccountConnectionString 'Microsoft.KeyVault/vaults/secrets#2021-06-01-preview' = [for (tenant,i) in tenantCodes: { parent:keyVaultShared name: '${keyVaultShared.name}-test${tenant}' properties:{ contentType: '${tenant} Storage Account Connection String' value: storageAccountString[i].id } }] Outputs:
Creating AKS cluster with Managed Identity to give it access to a subnet - Error: authorization.RoleAssignmentsClient
I configured an AKS cluster to use a system-assigned managed identity to access to other Azure resources resource "azurerm_subnet" "aks" { name = var.aks_subnet_name resource_group_name = azurerm_resource_group.main.name virtual_network_name = module.network.vnet_name address_prefix = var.aks_subnet service_endpoints = ["Microsoft.KeyVault"] } resource "azurerm_kubernetes_cluster" "aks_main" { name = module.aks_name.result depends_on = [azurerm_subnet.aks] location = azurerm_resource_group.main.location resource_group_name = azurerm_resource_group.main.name dns_prefix = "aks-${local.name}" kubernetes_version = var.k8s_version addon_profile { oms_agent { # For monitoring containers enabled = var.addons.oms_agent log_analytics_workspace_id = azurerm_log_analytics_workspace.example.id } kube_dashboard { enabled = true } azure_policy { # If we want to enfore policy definitions in the future # Check requirements https://learn.microsoft.com/en-ie/azure/governance/policy/concepts/policy-for-kubernetes enabled = var.addons.azure_policy } } default_node_pool { name = "default" orchestrator_version = var.k8s_version node_count = var.default_node_pool.node_count vm_size = var.default_node_pool.vm_size type = "VirtualMachineScaleSets" availability_zones = var.default_node_pool.zones # availability_zones = ["1", "2", "3"] max_pods = 250 os_disk_size_gb = 128 vnet_subnet_id = azurerm_subnet.aks.id node_labels = var.default_node_pool.labels enable_auto_scaling = var.default_node_pool.cluster_auto_scaling min_count = var.default_node_pool.cluster_auto_scaling_min_count max_count = var.default_node_pool.cluster_auto_scaling_max_count enable_node_public_ip = false } # Configuring AKS to use a system-assigned managed identity to access identity { type = "SystemAssigned" } network_profile { load_balancer_sku = "standard" outbound_type = "loadBalancer" network_plugin = "azure" # if non-azure network policies # https://azure.microsoft.com/nl-nl/blog/integrating-azure-cni-and-calico-a-technical-deep-dive/ network_policy = "calico" dns_service_ip = "10.0.0.10" docker_bridge_cidr = "172.17.0.1/16" service_cidr = "10.0.0.0/16" } lifecycle { ignore_changes = [ default_node_pool, windows_profile, ] } } I want to use that managed identity (the service principal created inside AKS cluster section code) to give it roles like this Network Contributor over a subnet: resource "azurerm_role_assignment" "aks_subnet" { # Giving access to AKS SP identity created to akssubnet by assigning it # a Network Contributor role scope = azurerm_subnet.aks.id role_definition_name = "Network Contributor" principal_id = azurerm_kubernetes_cluster.aks_main.identity[0].principal_id # principal_id = azurerm_kubernetes_cluster.aks_main.kubelet_identity[0].object_id # principal_id = data.azurerm_user_assigned_identity.test.principal_id # skip_service_principal_aad_check = true } But the output I got after terraform apply is: Error: authorization.RoleAssignmentsClient#Create: Failure responding to request: StatusCode=403 -- Original Error: autorest/azure: Service returned an error. Status=403 Code="AuthorizationFailed" Message="The client 'afd5bd09-c294-4597-9c90-e1ee293e5f3a' with object id 'afd5bd09-c294-4597-9c90-e1ee293e5f3a' does not have authorization to perform action 'Microsoft.Authorization/roleAssignments/write' over scope '/subscriptions/77dfff95-fbd3-4a15-b97a-b7182939e61a/resourceGroups/rhd-spec-prod-main-6loe4lpkr0hd8/providers/Microsoft.Network/virtualNetworks/rhd-spec-prod-main-wdaht6cn7s3s8/subnets/aks-subnet/providers/Microsoft.Authorization/roleAssignments/8733864c-a5f7-a6a9-a61d-6393989f0ad1' or the scope is invalid. If access was recently granted, please refresh your credentials." on aks.tf line 23, in resource "azurerm_role_assignment" "aks_subnet": 23: resource "azurerm_role_assignment" "aks_subnet" { It seems the service principal is being created does not have enough privileges to perform a role assignment over the subnet, or maybe I have wrong the scope attribute. I am passing there, the aks subnet id. What am I doing wrong? UPDATE Checking the way Managed Identities has role assigneds, looks like we can only assign it roles related with Subscriptions, Resource Groups, Storage services, SQL services, and KeyVault. Reading here Before you can use the managed identity, it has to be configured. There are two steps: Assign a role for the identity, associating it with the subscription that will be used to run Terraform. This step gives the identity permission to access Azure Resource Manager (ARM) resources. Configure access control for one or more Azure resources. For example, if you use a key vault and a storage account, you will need to configure the vault and container separately. Before you can create a resource with a managed identity and then assign an RBAC role, your account needs sufficient permissions. You need to be a member of the account Owner role, or have Contributor plus User Access Administrator roles. Trying to proceed accordingly, I defined this section code: resource "null_resource" "wait_for_resource_to_be_ready" { provisioner "local-exec" { command = "sleep 60" } depends_on = [ azurerm_kubernetes_cluster.aks_main ] } data "azurerm_subscription" "current" {} # FETCHING THE IDENTITY CREATED ON AKS CLUSTER data "azurerm_user_assigned_identity" "test" { name = "${azurerm_kubernetes_cluster.aks_main.name}-agentpool" resource_group_name = azurerm_kubernetes_cluster.aks_main.node_resource_group } data "azurerm_role_definition" "contributor" { name = "Network Contributor" } resource "azurerm_role_assignment" "aks_subnet" { # Giving access to AKS SP identity created to akssubnet by assigning it # a Network Contributor role # name = azurerm_kubernetes_cluster.aks_main.name # scope = var.aks_subnet_name # azurerm_subnet.aks.id var.aks_subnet scope = data.azurerm_subscription.current.id #role_definition_name = "Network Contributor" role_definition_id = "${data.azurerm_subscription.current.id}${data.azurerm_role_definition.contributor.id}" # principal_id = azurerm_kubernetes_cluster.aks_main.identity[0].principal_id # principal_id = azu rerm_kubernetes_cluster.aks_main.kubelet_identity[0].object_id principal_id = data.azurerm_user_assigned_identity.test.principal_id skip_service_principal_aad_check = true depends_on = [ null_resource.wait_for_resource_to_be_ready ] } The terraform workflow try to create the role ... > terraform_0.12.29 apply "prod_Infrastructure.plan" null_resource.wait_for_resource_to_be_ready: Creating... null_resource.wait_for_resource_to_be_ready: Provisioning with 'local-exec'... null_resource.wait_for_resource_to_be_ready (local-exec): Executing: ["/bin/sh" "-c" "sleep 60"] null_resource.wait_for_resource_to_be_ready: Still creating... [10s elapsed] null_resource.wait_for_resource_to_be_ready: Still creating... [20s elapsed] null_resource.wait_for_resource_to_be_ready: Still creating... [30s elapsed] null_resource.wait_for_resource_to_be_ready: Still creating... [40s elapsed] null_resource.wait_for_resource_to_be_ready: Still creating... [50s elapsed] null_resource.wait_for_resource_to_be_ready: Still creating... [1m0s elapsed] null_resource.wait_for_resource_to_be_ready: Creation complete after 1m0s [id=8505830187297683728] azurerm_role_assignment.aks_subnet: Creating... but finally got the same AuthorizationFailed error this time over the subscription passed. Error: authorization.RoleAssignmentsClient#Create: Failure responding to request: StatusCode=403 -- Original Error: autorest/azure: Service returned an error. Status=403 Code="AuthorizationFailed" Message="The client 'afd5bd09-c294-4597-9c90-e1ee293e5f3a' with object id 'afd5bd09-c294-4597-9c90-e1ee293e5f3a' does not have authorization to perform action 'Microsoft.Authorization/roleAssignments/write' over scope '/subscriptions/77dfff95-fbd3-4a15-b97a-b7182939e61a' or the scope is invalid. If access was recently granted, please refresh your credentials." on aks.tf line 145, in resource "azurerm_role_assignment" "aks_subnet": 145: resource "azurerm_role_assignment" "aks_subnet" { Not sure at all how to verify this statement Before you can create a resource with a managed identity and then assign an RBAC role, your account needs sufficient permissions. You need to be a member of the account Owner role, or have Contributor plus User Access Administrator roles. By the way, I have the owner role in the subscription I am working with. UPDATE 2 The object id referenced on both error messages above, belong to a service principal within my tenant. It is az ad sp show --id afd5bd09-c294-4597-9c90-e1ee293e5f3a { "accountEnabled": "True", "addIns": [], "alternativeNames": [], "appDisplayName": "Product-xxxx-ServicePrincipal-Production", "appId": "ff9c642c-06b9-47e2-9565-e3f6e782e14f", "appOwnerTenantId": "xxxxxxxx", "appRoleAssignmentRequired": false, "appRoles": [], "applicationTemplateId": null, "deletionTimestamp": null, "displayName": "Product-xxxx-ServicePrincipal-Production", "errorUrl": null, "homepage": null, "informationalUrls": { "marketing": null, "privacy": null, "support": null, "termsOfService": null }, "keyCredentials": [], "logoutUrl": null, "notificationEmailAddresses": [], "oauth2Permissions": [], # THIS IS THE OBJECT ID "objectId": "afd5bd09-c294-4597-9c90-e1ee293e5f3a", "objectType": "ServicePrincipal", "odata.metadata": "https://graph.windows.net/15f996bf-aad1-451c-8d17-9b95d025eafc/$metadata#directoryObjects/#Element", "odata.type": "Microsoft.DirectoryServices.ServicePrincipal", "passwordCredentials": [], "preferredSingleSignOnMode": null, "preferredTokenSigningKeyEndDateTime": null, "preferredTokenSigningKeyThumbprint": null, "publisherName": "xxxxxxx", "replyUrls": [], "samlMetadataUrl": null, "samlSingleSignOnSettings": null, "servicePrincipalNames": [ "ff9c642c-06b9-47e2-9565-e3f6e782e14f" ], "servicePrincipalType": "Application", "signInAudience": "AzureADMyOrg", "tags": [ "WindowsAzureActiveDirectoryIntegratedApp" ], "tokenEncryptionKeyId": null } Regarding permissions, not sure if it has sufficient, I would say yes, since it is used for multiple stuff in the subscription What about Users Consent permissions? I don't have anything there But on the other hand, why the process is trying to assign the role by using this service principal? I mean, the use of a managed identity, is intended to move away the use of service principals, but perhaps, the workflow procees use this SP just to assign the role to the managed identity and from that in forward the access will be granted by the managed identity (?)
From docs: https://learn.microsoft.com/en-us/azure/role-based-access-control/role-assignments-rest#add-a-role-assignment To call this API, you must have access to the Microsoft.Authorization/roleAssignments/write operation. Of the built-in roles, only Owner and User Access Administrator are granted access to this operation. So your service principal must have the role owner or user access administrator. Or you have to create a custom role with sufficient permissions. Regarding the workflow, I agree. It is quiet counter intuitive. old answer There is this bug (?) where azure states that the resource has been created but not all services have access it. You can have it wait for a minute with something like this: resource "null_resource" "wait_for_resource_to_be_ready" { provisioner "local-exec" { command = "sleep 60" } depends_on = [ azurerm_kubernetes_cluster.aks_main ] } Add a depends_on statment to your "azurerm_role_assignment" "aks_subnet" resource: depends_on = [ null_resource.wait_for_resource_to_be_ready ] Now first your cluster will be created, then terrform will wait for 60 seconds. Then your role_assignment will take place and will hopefully be able to grant the role.
DSC error for post deployment SQL configuration
I am deploying SQL server 2016 with ARM to Azure. Trying to implement post deployment configuration with DSC module. DSC config: xSQLServerSetup 'InstallDefaultInstance' { InstanceName = 'MSSQLSERVER' SQLCollation = 'SQL_Latin1_General_CP1_CI_AS' SQLSysAdminAccounts = $SqlInstallCredential SourcePath = 'C:\SQLServerFull\' DependsOn = '[WindowsFeature]NetFramework35','[WindowsFeature]NetFramework45', '[xDisk]TVolume' } And get the following: "error": { "code": "DeploymentFailed", "message": "At least one resource deployment operation failed. Please list deployment operations for details. Please see https://aka.ms/arm-debug for usage details.", "details": [ { "code": "Conflict", "message": "{\r\n \"status\": \"Failed\",\r\n \"error\": {\r\n \"code\": \"ResourceDeploymentFailure\",\r\n \"message\": \"The resource operation completed with terminal provisioning state 'Failed'.\",\r\n \"details\": [\r\n {\r\n \"code\": \"VMExtensionProvisioningError\",\r\n \"message\": \"VM has reported a failure when processing extension 'Microsoft.Powershell.DSC'. Error message: \\\"DSC Configuration 'Main' completed with error(s). Following are the first few: The network name cannot be found. Cannot bind argument to parameter 'Path' because it is an empty string. Cannot bind argument to parameter 'Path' because it is an empty string.\\\".\"\r\n }\r\n ]\r\n }\r\n}" Any suggestions?
Moving resources failed because resource group has active deployments
When I try to change a website's resource group in Azure Powershell, I get the following error: "Error": { "Code": "MultipleErrorsOccurred", "Message": "Multiple error occurred: Conflict,Conflict. Please see details.", "Target": null, "Details": [ { "Code": "DeploymentActive", "Message": "Moving resources failed because resource group 'rg1' has active deployments.", "Target": null, "Details": null }, { "Code": "DeploymentActive", "Message": "Moving resources failed because resource group 'rg1' has active deployments.", "Target": null, "Details": null } } I use the following commands: $webapp = Get-AzureResource -ResourceGroupName "rg1" -ResourceName resourceName -ResourceType Microsoft.Web/sites Move-AzureResource -DestinationResourceGroupName "rg2" -ResourceId $webapp.ResourceId One solution is to delete and recreate the website but is there any other way that we can sort this problem out without deleting anything?
Move-AzureResource is obsolete now. Try using Move-AzureRmResource. For the error, you will have to wait till an ongoing deployment in rg1 is complete. You could retry once the deployment is complete. Cheers!