Terraform-provider-azurerm: Unable to update existing azurerm_role_definition - error 409

[mlcooper]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform Version

Terraform v0.11.7
+ provider.azurerm v1.12.0

Affected Resource(s)

• azurerm_role_definition

Terraform Configuration Files

Original code:

resource "azurerm_role_definition" "register-resource-providers" {
  name        = "Register Resource Providers"
  scope       = "${data.azurerm_subscription.current.id}"
  description = "This is a custom role created via Terraform to allow users to register resource providers"

  permissions {
    actions = ["*/register/action"]
  }

  assignable_scopes = [
    "/subscriptions/00000000-0000-0000-0000-000000000001"
  ]
}

Update I'm trying to make (see additional assignable_scopes):

resource "azurerm_role_definition" "register-resource-providers" {
  name        = "Register Resource Providers"
  scope       = "${data.azurerm_subscription.current.id}"
  description = "This is a custom role created via Terraform to allow users to register resource providers"

  permissions {
    actions = ["*/register/action"]
  }

  assignable_scopes = [
    "/subscriptions/00000000-0000-0000-0000-000000000001"
    "/subscriptions/00000000-0000-0000-0000-000000000002"
    "/subscriptions/00000000-0000-0000-0000-000000000003"
  ]
}

Debug Output

An execution plan has been generated and is shown below.
Resource actions are indicated with the following symbols:
  ~ update in-place

Terraform will perform the following actions:

  ~ azurerm_role_definition.register-resource-providers
      assignable_scopes.#: "1" => "3"
      assignable_scopes.0: "/subscriptions/00000000-0000-0000-0000-000000000001" => "/subscriptions/00000000-0000-0000-0000-000000000001"
      assignable_scopes.1: "" => "/subscriptions/00000000-0000-0000-0000-000000000002"
      assignable_scopes.2: "" => "/subscriptions/00000000-0000-0000-0000-000000000003"


Plan: 0 to add, 1 to change, 0 to destroy.

Do you want to perform these actions?
  Terraform will perform the actions described above.
  Only 'yes' will be accepted to approve.

  Enter a value: yes

azurerm_role_definition.register-resource-providers: Modifying... (ID: /subscriptions/00000000-0000-0000-0000-...s/01408bce-1618-f81b-bb34-0d60a3c5d0b3)
  assignable_scopes.#: "1" => "3"
  assignable_scopes.0: "/subscriptions/00000000-0000-0000-0000-000000000001" => "/subscriptions/00000000-0000-0000-0000-000000000002"
  assignable_scopes.1: "" => "/subscriptions/00000000-0000-0000-0000-000000000001"
  assignable_scopes.2: "" => "/subscriptions/00000000-0000-0000-0000-000000000003"
Releasing state lock. This may take a few moments...

Error: Error applying plan:

1 error(s) occurred:

* azurerm_role_definition.register-resource-providers: 1 error(s) occurred:

* azurerm_role_definition.register-resource-providers: authorization.RoleDefinitionsClient#CreateOrUpdate: Failure responding to request: StatusCode=409 -- Original Error: autorest/azure: Service returned an error. Status=409 Code="RoleDefinitionWithSameNameExists" Message="A role definition cannot be updated with a name that already exists."

Expected Behavior

Since I was able to successfully update the assignableScopes via the Azure CLI, I would have expected Terraform to do the same and not get the error code 409 as shown above.

Via the Azure CLI I successfully updated the role defintion with this command:

az role definition update --role-definition custom_role.json --subscription 00000000-0000-0000-0000-000000000001

In the custom_role.json file I simply added the additional subscription ID's to assignableScopes.

Actual Behavior

Terraform tried to update the existing role definition and got this error:

1 error(s) occurred:

* azurerm_role_definition.register-resource-providers: 1 error(s) occurred:

* azurerm_role_definition.register-resource-providers: authorization.RoleDefinitionsClient#CreateOrUpdate: Failure responding to request: StatusCode=409 -- Original Error: autorest/azure: Service returned an error. Status=409 Code="RoleDefinitionWithSameNameExists" Message="A role definition cannot be updated with a name that already exists."

Steps to Reproduce

1. Create a custom role definition via Terraform.
2. Add additional assignableScopes to the custom role definition.
3. terraform apply

Important Factoids

Running in Azure West US.

References

• #0000

[dbilleci-lightstream]

Hit this today too!

[A141864]

At first glance, this looks like an issue with the Azure SDK for Go.

@tombuildsstuff @JunyiYi, what is the preferred approach in this scenario? Do we wait for the issue to be resolved up-stream, or try to find a workaround?

[alastairtree]

If you delete the role, give the role a role_definition_id of a random guid, apply, and then do the update and apply that it seems to succeed. lesson is - do not omit role_definition_id.

[ranokarno]

@alastairtree , could you post here your workaround.
is it some sort of script (az cli) or update via terraform code ?

[alastairtree]

You need to delete the role from azure/terraform state, and then recreate is using terraform but be sure to specify a role_definition_id as a random and static guid.

[lrosenman]

This is getting long in the tooth, and I'd love to see it fixed sooner than later.

[qmarc]

In my case I now have multiple user groups associated with the custom role I have created, and Terraform wants to delete and re-create it which is no longer permitted due to the dependencies. It should be possible to suggest that a resource is left alone and carry on! Using you can add things like lifecycle deletion prevention, but all that does is fails your running script when it gets to that resource with the lifecycle property in place.

[Grant-Rc]

like @qmarc i have "global" roles that i have to update now and then. To get around this issue i apply the change via powershell
$RoleDef = Get-AzureRmRoleDefinition -Name <Def_Name> $RoleDef.AssignableScopes = $SubscriptionsId $RoleDef.Actions = $RoleDef.Actions + "Microsoft.Resources/deployments/write" $RoleDef | Set-AzureRmRoleDefinition
re-running terraform is now says "No changes. Infrastructure is up-to-date."

[MarkKharitonov]

Hit this issue today with the latest plugin version.

Are there any plans to address it?