accesspackage.azuread_access_package_resource_catalog_association - cannot add group from catalog as a resource role

[oehanire10x]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritise this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritise the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform (and AzureAD Provider) Version

Affected Resource(s)

• azuread_access_package_resource_catalog_association

Terraform Configuration Files

# Copy-paste your Terraform configurations here - for large Terraform configs,
# please use a service like Dropbox and share a link to the ZIP file. For
# security, you can also encrypt the files using our GPG public key: https://keybase.io/hashicorp
data "azuread_access_package_catalog" "catalog" {
    display_name = var.catalog_name
}

data "azuread_group" "resource_group" {
    object_id   = "01000000-0000-0000-0000-000000000000" /* "NAME OF THE RESOURCE AAD GROUP" */
}

data "azuread_group" "dyn_it" {
    object_id = "02000000-0000-0000-0000-000000000000" /* "NAME OF THE GROUP SCOPED FOR THE ACCESS PACKAGE" */
}

resource "azuread_access_package" "access_package" {
    catalog_id   = data.azuread_access_package_catalog.catalog.id
    description  = var.description
    display_name = var.name
    hidden       = false
}

resource "azuread_access_package_resource_catalog_association" "resource_catalog_association" {
    catalog_id             = data.azuread_access_package_catalog.catalog.id
    resource_origin_id     = data.azuread_group.resource_group.object_id
    resource_origin_system = "AadGroup"
}

resource "azuread_access_package_resource_package_association" "example" {
    access_package_id               = azuread_access_package.access_package.id
    catalog_resource_association_id = azuread_access_package_resource_catalog_association.resource_catalog_association.id
}

resource "azuread_access_package_assignment_policy" "access_package_policy" {
    access_package_id = azuread_access_package.access_package.id
    display_name      = "Initial Policy"
    description       = "Initial Policy"
    duration_in_days  = var.duration

    approval_settings {
      approval_required   = false
    }

    requestor_settings {
        scope_type        = "SpecificDirectorySubjects"
        requests_accepted = true

        requestor {  
          object_id    = data.azuread_group.dyn_it.object_id
          subject_type = "groupMembers"
          backup       = false
        }
    }
    question {
        text {
            default_text = "Provide justification"
        }
    }
}

Debug Output

Panic Output

Expected Behavior

Associate the security group, that is part of the catalog, as a resource role

Actual Behavior

module.accesspackage.azuread_access_package_resource_catalog_association.resource_catalog_association: Creating...
╷
│ Error: A resource with the ID "01000000-0000-0000-0000-000000000000/01000000-0000-0000-0000-000000000000" already exists
│ 
│   with module.accesspackage.azuread_access_package_resource_catalog_association.resource_catalog_association,
│   on modules/accesspackage/main.tf line 47, in resource "azuread_access_package_resource_catalog_association" "resource_catalog_association":
│   47: resource "azuread_access_package_resource_catalog_association" "resource_catalog_association" {
│ 
│ To be managed via Terraform, this resource needs to be imported into the State. Please see
│ the resource documentation for "azuread_access_package_resource_catalog_association" for
│ more information.

Steps to Reproduce

1. terraform apply

Important Factoids

References

• #0000