ADO: TerraformCLI@1 Init task asking for az login

Using the following task within an ADO YAML pipeline:

- task: TerraformCLI@1
  displayName: 'Terraform Init'
  inputs:
    provider: 'azurerm'
    command: 'init'
    workingDirectory: '$(Pipeline.Workspace)/ProjectFiles'
    backendServiceArm: "ado-sub-Contributor-${{ parameters.ServiceConnectionBU }}-${{ env.name }}-$(System.TeamProject)"
    commandOptions: '-backend-config=$(Pipeline.Workspace)/ProjectFiles/${{ env.backendConfigFile }}'

causes ADO to error with:

Error: Error building ARM Config: obtain subscription(4b730757-1457-4ab7-9091-7f9ce3e26c46) from Azure CLI: parsing json result from the Azure CLI: waiting for the Azure CLI: exit status 1: ERROR: Please run 'az login' to setup account.

Using the Azure Pipelines Terraform Tasks by Jason Johnson DevOps extension states that this should be a valid method of connecting. However, regardless of the configuration, including trying environmentServiceName and runAzLogin: true result in the exact same error message.

Any thoughts or suggestions on why ADO fails to authenticate with my preconfigured service connection? Note that if I run an AzureCLI@2 task to do an az account show, the service connection works without fault. Running Windows VM, latest PS, TF, and azcli installers.

Based on your task definition, you are using the Terraform CLI task from extension: Azure Pipelines Terraform Tasks.

The cause of the issue is that the task syntax is not correct. The provider filed in the task is invalid. In this case, it will not ignore the azurerm type setting and change to use default type: local. Then it will not read the authentication info in the service connection

You need to change the task argument:

From:

provider: 'azurerm'

To:

backendType: 'azurerm'

Task example:

- task: TerraformCLI@1
  displayName: 'Terraform Init'
  inputs:
    backendType: 'azurerm'
    command: 'init'
    workingDirectory: '$(Pipeline.Workspace)/ProjectFiles'
    backendServiceArm: "ado-sub-Contributor-${{ parameters.ServiceConnectionBU }}-${{ env.name }}-$(System.TeamProject)"
    commandOptions: '-backend-config=$(Pipeline.Workspace)/ProjectFiles/${{ env.backendConfigFile }}'