Support for planning subscription creation

[Brakistad]

Is there an existing issue for this?

• I have searched the existing issues

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave comments along the lines of "+1", "me too" or "any updates", they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment and review the contribution guide to help.

Description

Is your feature request related to an issue?

When we added a identity for doing "terraform plan" in PR workflow, we got authentication error. The permission we gave it was read on Billing enrollment account:

az role assignment create --role Reader --assignee-principal-type ServicePrincipal --assignee-object-id $AZ_VENDING_PLAN_UMI --scope '/providers/Microsoft.Billing/enrollmentAccounts/$AZ_ENROLLMENT_ACCOUNT'

In addition we gave it "Reader" om the CAF management root structure.

And gave it "Reader" on tenant level during troubleshooting to cover our grounds.

And it throws a error in plan either way:

│ Error: reading Subscription Alias <SUBSCRIPTION NAME>: subscriptions.SubscriptionsClient#AliasGet: Failure responding to request: StatusCode=401 -- Original Error: autorest/azure: Service returned an error. Status=401 Code="UserNotAuthorized" Message="User does not have access Microsoft.Subscription/aliases/write over scope providers/Microsoft.Subscription/aliases/<SUBSCRIPTION NAME>"
│ 
│   with module.lz_vending[<SUBSCRIPTION MANIFEST>].module.subscription[<TF_ID>].azurerm_subscription.this[<TF_ID>],
│   on .terraform/modules/lz_vending/modules/subscription/main.tf line 2, in resource "azurerm_subscription" "this":
│    2: resource "azurerm_subscription" "this" {

Describe the solution you'd like

We want to be able to allow our developer teams to have write permission on our vending machine repository. So that they can contribute and order new subscriptions through PR, and then see the terraform plan in the PR step, without using a identity with permission to perform write on subscription alias as the error message above is referring to.
Also without ant write permission whatsoever, just the way terraform plan seperation is meant to work.

Additional context

We cant say for sure that this is not supported, but we are unable to find any documentation on what minimum level permissions are required for terraform plan.

New or Affected Resource(s)/Data Source(s)

azurerm_subscription

Potential Terraform Configuration

The same, just allow read access instead of write for performing plan.

References

No response

[lmllr]

As far as I can tell, this is a limitation of the API.

I've tested this by sending a request through the Azure CLI (with an actual Subscription UUID of course):
az rest --method get --uri "https://management.azure.com/providers/Microsoft.Subscription/aliases/<UUID>?api-version=2021-10-01"

Which resulted in the following response:
Unauthorized({"error":{"code":"UserNotAuthorized","message":"User does not have access Microsoft.Subscription/aliases/write over scope providers/Microsoft.Subscription/aliases/<UUID>"},"code":"UserNotAuthorized","message":"User does not have access Microsoft.Subscription/aliases/write over scope providers/Microsoft.Subscription/aliases/<UUID>"}).

[sheeeng]

Any workaround for this issue?

[faust64]

Is this issue even related to subscription creation?
As I'm trying to migrate my Terraform code to use workload identities. I have a subscription. It was created outside of Terraform, and we'ld import it into our state. Main purpose being to lifecycle its tags whenever tagging guidelines changes in my company.

Now: I created my user managed identity, pretty much everything works, amazing, ... But: I have that one error left. pretty similar to the one reported here:

Error: unable to build authorizer for Resource Manager API: could not configure AzureCli Authorizer: obtaining subscription ID: obtaining account details: running Azure CLI: exit status 1: ERROR: Please run 'az login' to setup account.

  with provider["registry.terraform.io/hashicorp/azurerm"].safe,
  on _providers.opsgenie.tf line 7, in provider "azurerm":
   7: provider "azurerm" {


Error: reading Subscription Alias "myproduct-dev": subscriptions.SubscriptionsClient#AliasGet: Failure responding to request: StatusCode=401 -- Original Error: autorest/azure: Service returned an error. Status=401 Code="UserNotAuthorized" Message="User does not have access Microsoft.Subscription/aliases/write over scope /providers/Microsoft.Subscription/aliases/myproduct-dev"

  with module.myproduct_subscription.azurerm_subscription.myproduct[0],
  on .terraform/modules/myproduct_subscription/tf_modules/assemblies/myproduct_azure_subscription/subscription.tf line 1, in resource "azurerm_subscription" "myproduct":
   1: resource "azurerm_subscription" "myproduct" {

And it's not just workload identities. I remember a colleague that left my team, previously tried to change the SPN Terraform uses, going with some new naming convention.
I'm pretty sure he got stuck on the exact same error. Plan, somehow requesting write.
Permissions that were granted already, as far as I can tell. Role assignments are managed by Terraform, I duplicated existing assignments granting the same permissions to my SPN.