Cannot create role definition and assign to mgmn group

[magnus78boy]

We are getting problem to create new roles.

We are trying to add to new role definitions.
One for netops and secops.

We are trying to assign to root.

Ex of netops:
{
"name": "88888888-8888-8888-8888-888888888888",
"type": "Microsoft.Authorization/roleDefinitions",
"apiVersion": "2018-01-01-preview",
"properties": {
"roleName": "ES-NetOps",
"description": "Enterprise-scale custom Role Definition. Grants access for network operations",
"type": "customRole",
"permissions": [
{
"actions": [
"/read",
"Microsoft.Network/vpnGateways/",
"Microsoft.Network/routeTables/write",
"Microsoft.Network/vpnSites/*"
],
"notActions": [],
"dataActions": [],
"notDataActions": []
}
],
"assignableScopes": [
"/"
]
}
}

In archetype_definition_es_root:
"role_definitions": [
"ES-NetOps",
"ES-SecOps"
]

First time the create of roles:

Error message:
Error: authorization.RoleDefinitionsClient#Get: Failure responding to request: StatusCode=404 -- Original Error: autorest/azure: Service returned an error. Status=404 Code="RoleDefinitionDoesNotExist" Message="The specified role definition with ID '**' does not exist."

Re-Run(without updates to code):
Error: A resource with the ID "/providers/Microsoft.Authorization/roleDefinitions/**/providers/Microsoft.Management/managementGroups/es" already exists - to be managed via Terraform this resource needs to be imported into the State. Please see the resource documentation for "azurerm_role_definition" for more information.

Reflection of error:
Could it have something to do with it uuidv5?
#7

Do you have any suggestions on what we do wrong?

[krowlandson]

Unfortunately this is a known issue related to Azure and the way the AzureRM provider works. It's being investigated internally and is also logged here:

hashicorp/terraform-provider-azurerm#10442

The cause appears to be related to a front end cache in Azure which only updates every 10 minutes and can result in the above errors.

If you look in your environment you should see the role definition is successfully created so you need to follow the instructions in the 2nd error to import this to your state file. This can also fail if you don't wait for the cache to update so please allow 10 minutes after creation before trying.

Also please be careful to use the correct resource ID format resource_id|scope as specified in the error message.

Hopefully there will be a fix soon but please add your comments to the provider issue as this is being tracked by MS support.