azurerm_pim_active_role_assignment failing when the azurerm_role_definition is provisioned at a different subscription

[davidng1996]

Is there an existing issue for this?

• I have searched the existing issues

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment and review the contribution guide to help.

Terraform Version

1.5.2

AzureRM Provider Version

3.67

Affected Resource(s)/Data Source(s)

azurerm_pim_active_role_assignment, azurerm_pim_eligible_role_assignment

Terraform Configuration Files

data "azurerm_subscription" "primary" {
}
resource "azurerm_role_definition" "example" {
  name        = "my-custom-role"
  scope       = data.azurerm_subscription.primary.id
  description = "This is a custom role created via Terraform"

  permissions {
    actions     = ["*"]
    not_actions = []
    data_actions = ["*"]
    not_data_actions = []
  }

  assignable_scopes = [
    data.azurerm_subscription.primary.id,
    "/subscriptions/<subscriptionID2>"
  ]

}

resource "azurerm_pim_active_role_assignment" "always_active_azure_role_assignment1" {
  scope              = data.azurerm_subscription.primary.id
  role_definition_id = azurerm_role_definition.example.role_definition_resource_id
  principal_id       = "<principal_id>"
  justification      = "Test1"


  schedule {
    expiration {
      duration_hours = 10
    }
  }
  timeouts {
    read = "1h"
    create = "1h"
  }
}

resource "azurerm_pim_active_role_assignment" "always_active_azure_role_assignment2" {
  scope              = "/subscriptions/<subscriptionID2>"
  role_definition_id = azurerm_role_definition.example.role_definition_resource_id
  principal_id       = "<principal_id>"
  justification      = "Test2"


  schedule {
    expiration {
      duration_hours = 10
    }
  }
  timeouts {
    read = "1h"
    create = "1h"
  }

}

resource "azurerm_pim_eligible_role_assignment" "eligible_azure_role_assignment1" {
  scope              = data.azurerm_subscription.primary.id
  role_definition_id = azurerm_role_definition.example.role_definition_resource_id
  principal_id       = "<principal_id>"
  justification      = "Test3"


  schedule {
    expiration {
      duration_hours = 10
    }
  }
  timeouts {
    read = "1h"
    create = "1h"
  }
}

resource "azurerm_pim_eligible_role_assignment" "eligible_active_azure_role_assignment2" {
  scope              = "/subscriptions/<subscriptionID2>"
  role_definition_id = azurerm_role_definition.example.role_definition_resource_id
  principal_id       = "<principal_id>"
  justification      = "Test4"


  schedule {
    expiration {
      duration_hours = 10
    }
  }
  timeouts {
    read = "1h"
    create = "1h"
  }

}

Debug Output/Panic Output

Error: waiting for Role Management Policy: (Principal Id "<principal_id>" / Scope "/subscriptions/<subscriptionID2>" / Role Definition Id "<data.azurerm_subscription.primary.id>/providers/Microsoft.Authorization/roleDefinitions/<role_definition_id>") to become found: timeout while waiting for state to become 'Found' (last state: 'Missing', timeout: 5m0s)

Error: waiting for Role Management Policy: (Principal Id "<principal_id>" / Scope "/subscriptions/<subscriptionID2>" / Role Definition Id "<data.azurerm_subscription.primary.id>/providers/Microsoft.Authorization/roleDefinitions/<role_definition_id>") to become ready: couldn't find resource (21 retries)

Expected Behaviour

No response

Actual Behaviour

Terraform code is failing but role assignments are created in azure portal

Steps to Reproduce

No response

Important Factoids

No response

References

Bug is not fixed for #22588.

• You did not fix the timeout issue for azurerm_pim_active_role_assignment
• Unable to find role management policy for azurerm_pim_active_role_assignment and azurerm_pim_eligible_role_assignment when the role definition is at a different subscription

Terraform code is failing but all 4 PIM assignments (2x active 2x eligible) are created and can be found in Azure Portal.

[bardholthe]

Check #22756

Context deadline check was checking the wrong status value for error. This caused the "Delete" operation to always fail with the error message internal error: context has no deadline.

Awaiting approval

[davidng1996]

@tombuildsstuff @rcskosir This is not fixed. v3.68 still throwing out the same error.

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.