Terraform - 即使应用了 terraform 的后端的一部分，资源组也已经存在答案

【问题标题】：Terraform - Rescource group already exists even though part of backend with terraform applyTerraform - 即使应用了 terraform 的后端的一部分，资源组也已经存在
【发布时间】：2021-04-07 18:06:19
【问题描述】：

我扩展了我通过 Azure 管道运行的 terraform 定义。 terraform init 任务在定义资源组 medquality-aks 的管道上有一个后端配置，但似乎存在问题。我什至不确定，因为一次有 3 个错误。

之前我认为存在权限问题，因此我将创建权限添加到 Microsoft Graph API for terraform。

但在运行管道之前资源组不存在。

2020-12-30T20:30:05.2720640Z [0m[1mrandom_id.log_analytics_workspace_name_suffix: Creating...[0m[0m
2020-12-30T20:30:05.2726774Z [0m[1mrandom_string.sp-aks-password: Creating...[0m[0m
2020-12-30T20:30:05.2763813Z [0m[1mrandom_string.sp-aks-secret: Creating...[0m[0m
2020-12-30T20:30:05.2769915Z [0m[1mrandom_string.sp-aks-password: Creation complete after 0s [id=i<50H)EbQENB::#nf>Z4Af@k][0m[0m
2020-12-30T20:30:05.2786026Z [0m[1mrandom_id.log_analytics_workspace_name_suffix: Creation complete after 0s [id=qByINuQDrlg][0m[0m
2020-12-30T20:30:05.2806341Z [0m[1mrandom_string.sp-aks-secret: Creation complete after 0s [id=kLLI(=aZ4K[+%kN[%xay-E9h][0m[0m
2020-12-30T20:30:05.5417261Z [0m[1mazuread_group.aks_administrators: Creating...[0m[0m
2020-12-30T20:30:05.5463857Z [0m[1mazuread_application.sp-aks: Creating...[0m[0m
2020-12-30T20:30:09.4043339Z [0m[1mazurerm_resource_group.mq-aks: Creating...[0m[0m
2020-12-30T20:30:09.4519178Z [31m
2020-12-30T20:30:09.4521407Z [1m[31mError: [0m[0m[1mgraphrbac.ApplicationsClient#Create: Failure responding to request: StatusCode=403 -- Original Error: autorest/azure: Service returned an error. Status=403 Code="Unknown" Message="Unknown service error" Details=[{"odata.error":{"code":"Authorization_RequestDenied","date":"2020-12-30T20:30:05","message":{"lang":"en","value":"Insufficient privileges to complete the operation."},"requestId":"27125e18-2100-43b3-970b-9be30bed427e"}}][0m
2020-12-30T20:30:09.4522796Z 
2020-12-30T20:30:09.4523723Z [0m  on aks-ad-sp.tf line 11, in resource "azuread_application" "sp-aks":
2020-12-30T20:30:09.4524357Z   11: resource "azuread_application" "sp-aks" [4m{[0m
2020-12-30T20:30:09.4524725Z [0m
2020-12-30T20:30:09.4524971Z [0m[0m
2020-12-30T20:30:09.4525228Z [31m
2020-12-30T20:30:09.4526780Z [1m[31mError: [0m[0m[1mcreating Group ("aks-administrators"): graphrbac.GroupsClient#Create: Failure responding to request: StatusCode=403 -- Original Error: autorest/azure: Service returned an error. Status=403 Code="Unknown" Message="Unknown service error" Details=[{"odata.error":{"code":"Authorization_RequestDenied","date":"2020-12-30T20:30:05","message":{"lang":"en","value":"Insufficient privileges to complete the operation."},"requestId":"30882842-8926-4eee-8d45-847759849087"}}][0m
2020-12-30T20:30:09.4528021Z 
2020-12-30T20:30:09.4528543Z [0m  on aks-administrators-group.tf line 1, in resource "azuread_group" "aks_administrators":
2020-12-30T20:30:09.4529197Z    1: resource "azuread_group" "aks_administrators" [4m{[0m
2020-12-30T20:30:09.4529531Z [0m
2020-12-30T20:30:09.4529922Z [0m[0m
2020-12-30T20:30:09.4530174Z [31m
2020-12-30T20:30:09.4531284Z [1m[31mError: [0m[0m[1mA resource with the ID "/subscriptions/ae250472-5313-4abf-a081-3f746e68c88f/resourceGroups/medquality-aks" already exists - to be managed via Terraform this resource needs to be imported into the State. Please see the resource documentation for "azurerm_resource_group" for more information.[0m
2020-12-30T20:30:09.4532029Z 
2020-12-30T20:30:09.4532489Z [0m  on aks-rg.tf line 1, in resource "azurerm_resource_group" "mq-aks":
2020-12-30T20:30:09.4532999Z    1: resource "azurerm_resource_group" "mq-aks" [4m{[0m
2020-12-30T20:30:09.4533300Z [0m
2020-12-30T20:30:09.4533543Z [0m[0m
2020-12-30T20:30:09.4545723Z 
2020-12-30T20:30:09.4679091Z ##[error]Terraform command 'apply' failed with exit code '1'.:  graphrbac.ApplicationsClient#Create: Failure responding to request: StatusCode=403 -- Original Error: autorest/azure: Service returned an error. Status=403 Code="Unknown" Message="Unknown service error" Details=[{"odata.error":{"code":"Authorization_RequestDenied","date":"2020-12-30T20:30:05","message":{"lang":"en","value":"Insufficient privileges to complete the operation."},"requestId":"27125e18-2100-43b3-970b-9be30bed427e"}}] |  creating Group ("aks-administrators"): graphrbac.GroupsClient#Create: Failure responding to request: StatusCode=403 -- Original Error: autorest/azure: Service returned an error. Status=403 Code="Unknown" Message="Unknown service error" Details=[{"odata.error":{"code":"Authorization_RequestDenied","date":"2020-12-30T20:30:05","message":{"lang":"en","value":"Insufficient privileges to complete the operation."},"requestId":"30882842-8926-4eee-8d45-847759849087"}}] |  A resource with the ID "/subscriptions/ae250472-5313-4abf-a081-3f746e68c88f/resourceGroups/medquality-aks" already exists - to be managed via Terraform this resource needs to be imported into the State. Please see the resource documentation for "azurerm_resource_group" for more information.
2020-12-30T20:30:09.9560347Z ##[section]Finishing: terraform apply

我当前为 API 设置的权限：

更新：

在处理了一些关于如何创建服务主体的问题后，我知道在角色分配配置方面存在问题，以前的问题现在看起来很好，这是策略角色的问题吗？我在 hashcorp 文档中没有看到任何内容：

2021-01-05T02:32:19.0757008Z [0m[1mazurerm_kubernetes_cluster_node_pool.user: Creation complete after 4m10s [id=/subscriptions/ae250472-5313-4abf-a081-3f746e68c88f/resourcegroups/medquality-aks/providers/Microsoft.ContainerService/managedClusters/medquality-aks/agentPools/user][0m[0m
2021-01-05T02:32:19.0846822Z [31m
2021-01-05T02:32:19.0853022Z [1m[31mError: [0m[0m[1mauthorization.RoleAssignmentsClient#Create: Failure responding to request: StatusCode=403 -- Original Error: autorest/azure: Service returned an error. Status=403 Code="AuthorizationFailed" Message="The client '0595a82d-0ef5-4dce-a526-a348ad51ce6d' with object id '0595a82d-0ef5-4dce-a526-a348ad51ce6d' does not have authorization to perform action 'Microsoft.Authorization/roleAssignments/write' over scope '/subscriptions/ae250472-5313-4abf-a081-3f746e68c88f/resourceGroups/medquality-aks/providers/Microsoft.Network/virtualNetworks/medquality-aks-network/providers/Microsoft.Authorization/roleAssignments/c81c31c4-fa80-d98b-887f-b1d44852e7ce' or the scope is invalid. If access was recently granted, please refresh your credentials."[0m
2021-01-05T02:32:19.0855355Z 
2021-01-05T02:32:19.0856617Z [0m  on aks-rbac.tf line 1, in resource "azurerm_role_assignment" "sp-aks-network":
2021-01-05T02:32:19.0858454Z    1: resource "azurerm_role_assignment" "sp-aks-network" [4m{[0m
2021-01-05T02:32:19.0858855Z [0m
2021-01-05T02:32:19.0859142Z [0m[0m
2021-01-05T02:32:19.1005049Z 
2021-01-05T02:32:19.1063551Z ##[error]Terraform command 'apply' failed with exit code '1'.:  authorization.RoleAssignmentsClient#Create: Failure responding to request: StatusCode=403 -- Original Error: autorest/azure: Service returned an error. Status=403 Code="AuthorizationFailed" Message="The client '0595a82d-0ef5-4dce-a526-a348ad51ce6d' with object id '0595a82d-0ef5-4dce-a526-a348ad51ce6d' does not have authorization to perform action 'Microsoft.Authorization/roleAssignments/write' over scope '/subscriptions/ae250472-5313-4abf-a081-3f746e68c88f/resourceGroups/medquality-aks/providers/Microsoft.Network/virtualNetworks/medquality-aks-network/providers/Microsoft.Authorization/roleAssignments/c81c31c4-fa80-d98b-887f-b1d44852e7ce' or the scope is invalid. If access was recently granted, please refresh your credentials."
2021-01-05T02:32:19.4811396Z ##[section]Finishing: terraform apply

【问题讨论】：

Code="Unknown" Message="Unknown service error" "Authorization_RequestDenied" "Insufficient privileges to complete the operation." - 听起来你 / terraform 缺少权限/特权。对于已经存在的资源，您需要手动删除资源并再次运行 terraform 或import 它，请查看 terraform 文档。
您提到的问题是由于 tf 文件中的剩余组。现在我需要创建 azuread_group 并找到这样做的适当权限，
嗨@1174。这张票有更新吗？如果答案可以解决此问题，请随时告诉我。
嗨@KevinLu-MSFT 我今天试过了，但我似乎错过了“选择应用程序（用于创建 Azure Devops 服务连接）”，因为我不需要 terraform 管道。我在“拥有的应用程序”下有 terraform 并已按照概述设置了权限，但我认为这是不对的，我将在哪里使用服务连接并将其映射到我一直在使用的 terraform 管道？
好的，谢谢。我有几个 CompanyName-ProjectName-ProjectHash 形式的应用程序，它们假设映射到管道。我是否能够找出它是哪个实际管道，因为我在一个项目中有多个管道？

标签： azure azure-devops terraform terraform-provider-azure

【解决方案1】：

##[error]Terraform 命令“应用”失败，退出代码为“1”。：graphrbac.ApplicationsClient#Create：响应请求失败：StatusCode=403

根据错误信息表明你没有权限这样做。

你可以参考这个关于terraform permission的文档：

如果您使用服务主体进行身份验证，则它必须具有读取和写入所有（或拥有的）应用程序和登录和读取用户配置文件的权限在 Windows Azure Active Directory API 中。

您需要授予 Azure Active Directory Graph 权限而不是 Microsoft Graph 权限。

您可以导航到Azure Active Directory -> App registrations -> Select the APP(used to create Azure Devops Service connection) -> API permissions -> Azure Active Directory Graph。

委派权限 -> 登录并阅读用户个人资料(User.Read)

应用程序权限 -> 读取和写入所有（或拥有）应用程序 (Application.ReadWrite.All) 和读取和写入目录数据 (Directory.ReadWrite.All )

此外，您还可以在订阅中授予此应用贡献者角色。

这里是关于grant Contributor role的详细步骤的文档。

【讨论】：

谢谢@Kevin Lu-MSFT，最后一步是为 azurerm_role_assignment 资源分配服务主体的所有者角色，但您的回答确实帮助我找到了正确的路径。我必须说 Azure 中的许可非常麻烦，这是迄今为止我唯一可以说的部分。例如，只能通过提供全名来找到服务主体以进行角色分配。但是，是的，游戏的一部分。
太棒了！很高兴知道您找到了解决此问题的方法。我确实遇到过你提到的同样的问题（例如提供全名），所以我和你的感觉一样。
另一方面，如果答案能给你一些帮助，你可以考虑接受它作为答案。谢谢。