Fails to add azuread_group owners, resource not found

[ThomasStubergh]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform (and AzureAD Provider) Version

Terraform v0.12.21
AzureAD v0.7.0

Affected Resource(s)

• azuread_group

Terraform Configuration Files

resource "azuread_group" "main" {
  count  = length(local.aad_group_names)
  name   = local.aad_group_names[count.index]
  owners = local.aad_group_owners
}

locals {
keyvault_name            = "${substr(data.azurerm_resource_group.main.name, 0, length(data.azurerm_resource_group.main.name) - 2)}kv"
aad_group_names          = var.keyvault_name == "" ? ["ag.${local.keyvault_name}.admin", "ag.${local.keyvault_name}.modify", "ag.${local.keyvault_name}.read"] : ["ag.${var.keyvault_name}.admin", "ag.${var.keyvault_name}.modify", "ag.${var.keyvault_name}.read"]
aad_owners_pre_id_lookup = length(var.aad_group_owners) == 0 ? [local.tag_owner] : concat(list(local.tag_owner), var.aad_group_owners)
aad_group_owners         = flatten([data.azuread_user.aad_group_owners.*.object_id])
tag_owner                = data.azurerm_resource_group.main.tags["owner"]

Debug Output

https://gist.github.com/ThomasStubergh/ead1875689a43517b4867898cfcf62f8

Panic Output

Expected Behavior

Owners fetched from resource group tag and owners added through input parameter should be added to the owner attribute in the Azure AD Groups created. This sometimes work, but also sometimes fails.

Actual Behavior

Sometimes the terraform apply runs without error, but a lot of the times it fails with the linked error log. As a consequence all AAD groups which get the error are marked as tainted, forcing a recreate when terraform apply is run again. It seems when terraform runs the second time it usually completes without error.

Steps to Reproduce

This can be a bit tricky to reproduce, as it seems it's more likely to happen when owners have to be looked up through data sources in order to get the object ID and then add to owners attribute. It seems to happen because sometimes creating the AAD group and adding the owners run in several steps, forcing terraform to do an extra query on the AAD group which was just created, and sometimes Azure AD internal sync is not completed, which in turn makes terraform not being able to get the AAD group and therefore fails.

1. terraform apply

Important Factoids

The hcl listed above is just a small part of the bigger terraform codew hich is run.
I think this error happens because of internal AAD sync and if there was a wait/retry in fetching AAD group after creating, this error would probably go away.
I have also seen similar incidents on other resources which are created in Azure AD. #4

References

• #0000

[manicminer]

@ThomasStubergh thanks for reporting this! I believe the likely cause of the error is that we weren't waiting for replication before attempting to add owners/members to newly created groups. I've opened #290 which moves this check to happen right after initial group creation.

[ghost]

This has been released in version 0.11.0 of the provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading. As an example:

provider "azuread" {
    version = "~> 0.11.0"
}
# ... other configuration ...

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. If you feel I made an error 🤖 🙉 , please reach out to my human friends 👉 [email protected]. Thanks!