azureterraformazure-keyvaultazure-private-linkazure-private-dns-zone

referencing different subscription resource

I have DEV,NPR and PRD subscriptions. In each environment I have container app's(our own build agents are running) running on VNET + SUBNET. T make DEV AKV private and should accessible inside, creating private endpoint from DEV AKV to NPR subscription.

Is it possible with terraform ? I am reading the NPR VNET & SUBNET as dataset in dev provision. but while creating the private point with terraform getting below error.

The referenced resource not found.

Private Endpoint Name: "akv-private-endpoint"): performing CreateOrUpdate: unexpected status 400 (400 Bad Request) with error: InvalidResourceReference: Resource /subscriptions/NPR_SUB/resourceGroups/NPR-RG/providers/Microsoft.Network/virtualNetworks/NPR-VMSS-NETWORK referenced by resource /subscriptions/DEV_SUB/resourceGroups/DEV-rg/providers/Microsoft.Network/privateEndpoints/DEV-private-endpoint was not found. Please make sure that the referenced resource exists, and that both resources are in the same region.

Do i need to have additional rights from dev service principle to NPR resources ?

Solution

  • Referencing different subscription resource while using terraform

    With the limited Info from the error description, it seems the private endpoint is being created in the DEV subscription, but it references a virtual network in the NPR subscription.

    Basically, when the service principal doesn't have enough permission, you might get the authentication issue due to lack of necessary permissions on the NPR subscription to access or modify the referenced VNET or Subnet.

    we need at least Network Contributor access on the NPR subscription's virtual network and subnet

    Before running the script make sure the private endpoint and the target virtual network/subnet are in the same Azure region.

    Sometimes region differences may cause dependency issue on each other Ultimately causes the issue.

    Refer:

    https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles/networking#network-contributor

    https://learn.microsoft.com/en-us/azure/private-link/private-endpoint-overview