azureterraformazure-rm

AuthorizationFailed error when listing secrets for Static Site after upgrading to Terraform v1.8.0 and azurerm v3.105.0

Terraform Version

Affected Resource(s)

Terraform Configuration Files

provider "azurerm" {
  features {}
}

resource "azurerm_static_site" "example" {
  name                = "example-static-site"
  resource_group_name = "example-rg"
  location            = "West US 2"

  identity {
    type = "SystemAssigned"
  }
}

Error: listing secrets for Static Site: (Name "example-static-site" / Resource Group "example-rg"): web.StaticSitesClient#ListStaticSiteSecrets: Failure responding to request: StatusCode=403 -- Original Error: autorest/azure: Service returned an error. Status=403 Code="AuthorizationFailed" Message="The client 'xxxxxxxxxxxxx' with object id 'xxxxxxxxxxxxx' does not have authorization to perform action"

It is working as expected with the same commit-id in terraform and wasn't facing any issue but suddenly this issue arise

Solution

  • There are few reasons that can cause your issue and are detailed below.

    Usually "client xxx with object xxx doesn't have authorization" error comes when the logged in user or service principal does not have necessary permissions to perform the resource operations.

    Sometimes adding an owner role will work in this scenario.

    After upgrading the terraform provider version, it tries to upgrade the resource providers used in the code automatically and it might lead to these kinds of errors.

    So, once you upgraded, clear the cache with az cache purge command, check the logged in account details using az account show command. If it is not set, authenticate to an Azure and set it to the current subscription as mentioned in this github issue.

    enter image description here

    Include the below terraform provider along with the latest version = "3.106.1" parameter and try executing the code and it worked for me successfully.

    Also add data "azurerm_client_config" "current" {} in the code to avoid terraform authentication issues as it accesses the configuration of the AzureRM provider directly.

    terraform {
  required_providers {
    azurerm = {
      source = "hashicorp/azurerm"
      version = "3.106.1"
    }
  }
}
provider "azurerm"{
features{}
}
data "azurerm_client_config" "current" {}
resource "azurerm_resource_group" "example" {
  name     = "Jahnavi"
  location = "West Europe"
}
resource "azurerm_storage_account" "example" {
  name                     = "samplemine"
  resource_group_name      = azurerm_resource_group.example.name
  location                 = azurerm_resource_group.example.location
  account_tier             = "Standard"
  account_replication_type = "GRS"
}
resource "azurerm_static_web_app" "example" {
  name                = "staticsamplesite"
  resource_group_name = azurerm_resource_group.example.name
  location            = azurerm_resource_group.example.location
  app_settings = {
    "STORAGE_CONNECTION_STRING" = azurerm_storage_account.example.primary_connection_string
  }
}
  output "app_settings" {
     value = azurerm_static_web_app.example.app_settings
     sensitive = true
}

    Output:

    enter image description here

    enter image description here