Azure Subscription creation using Terraform - azure

Question

We are trying to spin up an azure subscription using terraform. But unable to find any exact code which delivers successful subscription creation. Below is the brief description of the possible scenarios we have tried executing.
We used the below code and executed it and the role we had was
Account Owner Role -But the code is successful but we aren't able to
see the subscription in the portal. Link for the code:
https://github.com/aztfmod/terraform-azurerm-caf/tree/5.4.8/modules/subscriptions
Below is the next code we tested with again Account Owner role - But
the error message is below. Link for the code: https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/subscription#example-usage---creating-a-new-alias-and-subscription-for-a-microsoft-customer-account
Error Message: creating new Subscription (Alias "XXXX7"):
subscription.AliasClient#Create: Failure sending request:
StatusCode=0 -- Original Error: Code="InvalidSubCreationScope"
Message="Not a valid subscription creation scope", with
azurerm_subscription.testtf, on main.tf line 31, in resource
"azurerm_subscription" "testtf": 31: resouce
"azurerm_subscription" "testtf" {
Another code we tried executing - But its destroying the older
subscription. Link for the code is same:
https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/subscription#example-usage---creating-a-new-alias-and-subscription-for-a-microsoft-customer-account
Request any suggestions/help at the earliest for the same so can help us.
Thanks in Advance!

Answer 1

Error Message: creating new Subscription (Alias "XXXX7"): subscription.AliasClient#Create: Failure sending request: StatusCode=0
-- Original Error: Code="InvalidSubCreationScope" Message="Not a valid subscription creation scope", with azurerm_subscription.testtf, on main.tf line 31, in resource "azurerm_subscription" "testtf": 31: resouce "azurerm_subscription" "testtf" {
As I have mentioned in comments , The above issue was with the billing scope which was being used for creating the subscription . Instead of Name you should use Billing account No. and Enrollment no. in the billing_account_name & enrollment_account_name Arguments like below :
data "azurerm_billing_enrollment_account_scope" "example" {
billing_account_name = "1234567890"
enrollment_account_name = "0123456"
}
resource "azurerm_subscription" "example" {
subscription_name = "My Example EA Subscription"
billing_scope_id = data.azurerm_billing_enrollment_account_scope.example.id
}
Note: Please make sure that you are using all the correct details which are can be found from EA portal.

Answer 2

i get this recently and the problem was that the identity which is used to call the subscription creation in Terraform does not have the subscription creator role of the new api. my spn had the subscription role of the legacy api.
to grant the subscription role to the spn, use this link:
focus on this section: Assign the subscription creator role to the SPN
https://learn.microsoft.com/en-us/azure/cost-management-billing/manage/assign-roles-azure-service-principals
https://learn.microsoft.com/en-us/rest/api/billing/2019-10-01-preview/enrollment-account-role-assignments/put?tabs=HTTP