azuread_group command in azurerm return different value for ID field

[dsczltch]

Is there an existing issue for this?

• I have searched the existing issues

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave comments along the lines of "+1", "me too" or "any updates", they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment and review the contribution guide to help.

Terraform Version

v1.5.7

AzureRM Provider Version

3.109

Affected Resource(s)/Data Source(s)

azuread_group

Terraform Configuration Files

data "azuread_group" "sg_XXXX" {
  display_name     = "SG_XXXX"
  security_enabled = true
}

// Grant XXXX Team access to the storage account in XXX
resource "azurerm_role_assignment" "az-ad-st-assignment-sg-data" {
  count               = var.ENV == "XXX" ? 1 : 0

  scope                = module.storage_account.storage_account_id
  role_definition_name = "Storage Blob Data Reader"
  principal_id         = data.azuread_group.sg_data.id
}

Debug Output/Panic Output

azurerm_role_assignment.az-ad-st-assignment-sg-xxx[0] must be replaced
-/+ resource "azurerm_role_assignment" "az-ad-st-assignment-sg-lclf" {
      ~ id                               = "/subscriptions/SUBSCRIPTION_ID/resourceGroups/ENV-dataprotection-rg/providers/Microsoft.Storage/storageAccounts/ENVXXdpst/providers/Microsoft.Authorization/roleAssignments/43ca987d-XXXX-4b04-XXXX-b4188401a3fc" -> (known after apply)
      ~ name                             = "43ca987d-XXXX-4b04-XXXX-b4188401a3fc" -> (known after apply)
      ~ principal_id                     = "78f2bfaa-XXXX-413e-XXXX-0e461bf43a40" -> "/groups/78f2bfaa-XXXX-413e-XXXX-0e461bf43a40" # forces replacement
      ~ principal_type                   = "Group" -> (known after apply)
      ~ role_definition_id               = "/subscriptions/SUBSCRIPTION_ID/providers/Microsoft.Authorization/roleDefinitions/2a2b9908-6ea1-4ae2-8e65-a410df84e7d1" -> (known after apply)
      + skip_service_principal_aad_check = (known after apply)
        # (2 unchanged attributes hidden)
    }


 Error: authorization.RoleAssignmentsClient#Create: Failure responding to request: StatusCode=400 -- Original Error: autorest/azure: Service returned an error. Status=400 Code="InvalidPrincipalId" Message="The Principal ID '/groups/78f2bfaa-XXX-XXX-XXX-0e461bf4XXXX' is not valid. Principal ID must be a GUID."
│ 
│   with azurerm_role_assignment.az-ad-st-assignment-sg-lclf[0],
│   on main.tf line 99, in resource "azurerm_role_assignment" "az-ad-st-assignment-sg-XXXX":
│   99: resource "azurerm_role_assignment" "az-ad-st-assignment-sg-XXXX" {
│ 
╵

Expected Behaviour

No change should have been detected.

Actual Behaviour

The value of the ID field from azuread_group has changed. It now has the /groups/ value in it.
We know this value is not in the doc since v1 of azuread but we did not get the depreciation message.
Also we only use the azurerm provider and not the azuread provider.

Steps to Reproduce

• get the entra group id of a group
• use this value in principal_id field in azurerm_role_assignment command

Important Factoids

N/A

References

No response

[Noel-Jones]

I'm seeing the same using data.azuread_service_principal. That said, this is an issue with the azuread provider, not azurerm.

hashicorp/terraform-provider-azuread#1505

[mloskot]

I have just observed the same issue using hashicorp/azuread v3.0.1 and hashicorp/azurerm v3.116.0:

# UUID-s anonymised...

Terraform planned the following actions, but then encountered a problem:

  # module.stack_platform.azurerm_role_assignment.avd_customer_as_application_group_user["90239023-9023-9023-9023-902390239023"] must be replaced
-/+ resource "azurerm_role_assignment" "avd_customer_as_application_group_user" {
      ~ id                                     = "/subscriptions/aaaaaaaa-bbbb-cccc-dddd-ffffffffffff/resourceGroups/rg-platform-mloskot-prd/providers/Microsoft.DesktopVirtualization/applicationGroups/dag-plt-uks-prd/providers/Microsoft.Authorization/roleAssignments/d7372b86-9396-57cc-b374-48e671234fa9" -> (known after apply)
      ~ name                                   = "d7372b86-9396-57cc-b374-48e671234fa9" -> (known after apply)
      ~ principal_id                           = "0b8f0b8f-0b8f-0b8f-0b8f-0b8f0b8f0b8f" -> "/groups/0b8f0b8f-0b8f-0b8f-0b8f-0b8f0b8f0b8f" # forces replacement
      ~ principal_type                         = "Group" -> (known after apply)
      ~ role_definition_id                     = "/subscriptions/aaaaaaaa-bbbb-cccc-dddd-ffffffffffff/providers/Microsoft.Authorization/roleDefinitions/1d18fff3-a72a-46b5-b4a9-0b38a3cd7e63" -> (known after apply)
      + skip_service_principal_aad_check       = (known after apply)
        # (6 unchanged attributes hidden)
    }

Plan: 1 to add, 0 to change, 1 to destroy.
╷
│ Error: expected "group_object_id" to be a valid UUID, got /groups/0b8f0b8f-0b8f-0b8f-0b8f-0b8f0b8f0b8f
│
│   with module.stack_platform.azuread_group_member.avd_customer["90239023-9023-9023-9023-902390239023"],
│   on ../../../../modules/mloskot/azure/stack-platform/r-avd-users.tf line 78, in resource "azuread_group_member" "avd_customer":
│   78:   group_object_id  = azuread_group.avd_customer[each.value.ucid].id
│
╵
╷
│ Error: expected "member_object_id" to be a valid UUID, got /users/31783178-3178-3178-3178-317831783178
│
│   with module.stack_platform.azuread_group_member.avd_customer["90239023-9023-9023-9023-902390239023"],
│   on ../../../../modules/mloskot/azure/stack-platform/r-avd-users.tf line 79, in resource "azuread_group_member" "avd_customer":
│   79:   member_object_id = azuread_user.avd_customer[each.key].id
│

That said, there seem to be not an issue with azuread provider as @Noel-Jones mentioned in #27536 (comment) but it looks like it is an expected change which is/will be covered in the migration guide:

• azuread_group_member - group as a member in a group terraform-provider-azuread#1500 (comment)

[dsczltch]

Thank you for your reply.
Indeed, the value of this setting has been moved from id to object_id property.
This information was missing from the upgrade guide and no deprecation message was indicated in the CLI.
More info here.
You can close this ticket.

[rcskosir]

Closing as noted above, thanks!