Conditional access error refreshing state when resource deleted outside of terraform

[alexwilcox9]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritise this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritise the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform (and AzureAD Provider) Version

terraform_version | Terraform v1.0.6 on linux_amd64 + provider registry.terraform.io/hashicorp/azuread v2.2.0

Affected Resource(s)

• azuread_conditional_access_policy

Terraform Configuration Files

resource "azuread_conditional_access_policy" "block_legacy" {
  display_name = "Deny Legacy Auth"
  state        = "disabled"
  conditions {
    applications {
      included_applications = ["All"]
    }
    client_app_types = ["other"]
    users {
      included_users = ["All"]
    }
  }
  grant_controls {
    built_in_controls = ["block"]
    operator          = "OR"
  }
}

Output

│ Error: Retrieving Conditional Access Policy with object ID "b9c0b6f1-8a29-4f27-91ba-267818baf021"
│ 
│   with azuread_conditional_access_policy.block_legacy,
│   on legacy_auth.tf line 1, in resource "azuread_conditional_access_policy" "block_legacy":
│    1: resource "azuread_conditional_access_policy" "block_legacy" {
│ 
│ ConditionalAccessPolicyClient.BaseClient.Get(): Get
│ "https://graph.microsoft.com/beta/TENANT_ID/identity/conditionalAccess/policies/b9c0b6f1-8a29-4f27-91ba-267818baf021":
│ GET
│ https://graph.microsoft.com/beta/TENANT_ID/identity/conditionalAccess/policies/b9c0b6f1-8a29-4f27-91ba-267818baf021
│ giving up after 9 attempt(s)

Expected Behaviour

When the policy has been removed outside of Terraform Terraform should attempt to re-create it

Actual Behaviour

Terraform is unable to read the Policy and errors after 9 attempts

Steps to Reproduce

1. terraform apply
2. Delete the policy via the portal/API outside of Terraform
3. terraform apply

Important Factoids

Running using a Service Principal

References

[manicminer]

Thanks for reporting @alexwilcox9. This seems to be a bug in the error handling in Hamilton that likely affects multiple resources.

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.