Unable to deploy AKS cluster with aci_connector_linux through terraform

Question

We are trying to deploy a simple AKS cluster with virtual nodes, aci connector linux. We are using this terraform example almost identical. It gets all the way to the end and when it tries to build the role assignment we get the following error:

 Error: authorization.RoleAssignmentsClient#Create: Failure responding to request: StatusCode=403 -- Original Error: autorest/azure: Service returned an error. Status=403 Code="AuthorizationFailed" Message="The client '385fa3dd-9da5-437e-82a6-9dc167eac3a2' with object id '385fa3dd-9da5-437e-82a6-9dc167eac3a2' does not have authorization or an ABAC condition not fulfilled to perform action 'Microsoft.Authorization/roleAssignments/write' over scope '/subscriptions/***/resourceGroups/gh-aks-services/providers/Microsoft.Network/virtualNetworks/vnet/subnets/default/providers/Microsoft.Authorization/roleAssignments/2637b837-8d6a-a98b-5f6d-79fdb595cfe6' or the scope is invalid. If access was recently granted, please refresh your credentials."
│ 
│   with azurerm_role_assignment.example,
│   on main.tf line 147, in resource "azurerm_role_assignment" "example":
│  147: resource "azurerm_role_assignment" "example" {
│ 

Example of role being created

resource "azurerm_role_assignment" "example" {
  scope                = azurerm_subnet.example-aci.id
  role_definition_name = "Network Contributor"
  principal_id         = azurerm_kubernetes_cluster.example.identity.0.principal_id
}

Terraform

provider "azurerm" {
  features {}
}

resource "azurerm_resource_group" "example" {
  name     = "${var.prefix}-k8s-rg"
  location = var.location
}

resource "azurerm_virtual_network" "example" {
  name                = "${var.prefix}-vnet"
  location            = azurerm_resource_group.example.location
  resource_group_name = azurerm_resource_group.example.name
  address_space       = ["10.10.0.0/16"]
}

resource "azurerm_subnet" "example-nodepool" {
  name                 = "default"
  virtual_network_name = azurerm_virtual_network.example.name
  resource_group_name  = azurerm_resource_group.example.name
  address_prefixes     = ["10.10.1.0/24"]
}

resource "azurerm_subnet" "example-aci" {
  name                 = "aci"
  virtual_network_name = azurerm_virtual_network.example.name
  resource_group_name  = azurerm_resource_group.example.name
  address_prefixes     = ["10.10.3.0/24"]

  delegation {
    name = "aciDelegation"
    service_delegation {
      name    = "Microsoft.ContainerInstance/containerGroups"
      actions = ["Microsoft.Network/virtualNetworks/subnets/action"]
    }
  }
}

resource "azurerm_kubernetes_cluster" "example" {
  name                = "${var.prefix}-k8s"
  location            = azurerm_resource_group.example.location
  resource_group_name = azurerm_resource_group.example.name
  dns_prefix          = "${var.prefix}-k8s"

  default_node_pool {
    name           = "default"
    node_count     = 1
    vm_size        = "Standard_DS2_v2"
    vnet_subnet_id = azurerm_subnet.example-nodepool.id
  }

  network_profile {
    network_plugin    = "azure"
    network_policy    = "azure"
    load_balancer_sku = "standard"
  }

  identity {
    type = "SystemAssigned"
  }

  aci_connector_linux {
    subnet_name = azurerm_subnet.example-aci.name
  }

  azure_policy_enabled             = false
  http_application_routing_enabled = false
}

resource "azurerm_role_assignment" "example" {
  scope                = azurerm_subnet.example-aci.id
  role_definition_name = "Network Contributor"
  principal_id         = azurerm_kubernetes_cluster.example.identity.0.principal_id
}

Answer 1

Hello David Simpson

Welcome to Microsoft Q&A Platform, thanks for posting your query here.

Based on the error message shared, it indicates that the client does not have authorization to perform the action 'Microsoft.Authorization/roleAssignments/write' over the specified scope. This error can occur if the client does not have the required permissions to create a role assignment.

Below are few troubleshooting steps that can help resolve the issue:

• Verify that the client ID and client secret used to authenticate the Terraform provider have the required permissions to create a role assignment. You can check this by ensuring that the client ID and client secret have the 'Owner' or 'Contributor' role assigned to them at the subscription or resource group level.
• Ensure that the 'Network Contributor' role is assigned to the client ID and client secret at the subscription or resource group level. This role is required to create a role assignment for the subnet. You can use Azure CLI or Azure PowerShell to assign the role programmatically. Here's an example using Azure CLI:

az role assignment create --assignee-object-id <client-object-id> --role "Network Contributor" --scope <scope>

Verify that the subnet specified in the 'azurerm_role_assignment' resource exists and is valid. You can check this by running the following command:

az network vnet subnet show --ids <subnet_id>

Replace <subnet_id> with the ID of the subnet specified in the 'azurerm_role_assignment' resource.

• If the subnet exists and is valid, try creating the role assignment manually using the Azure portal or Azure CLI. This can help you identify any issues with the client ID and client secret or the subnet.
• After ensuring that the client has the necessary permissions and the role assignment is correctly set up, retry the Terraform deployment. It should now be able to create the role assignment without encountering the "AuthorizationFailed" error.

If you continue to experience issues, double-check your configuration and make sure that all the necessary prerequisites, such as subscription access and role assignments, are in place before running Terraform again.

Hope this helps.