azurerm_pim_active_role_assignment issues not fixed in #22730 and #22588

[davidng1996]

Is there an existing issue for this?

• I have searched the existing issues

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment and review the contribution guide to help.

Terraform Version

1.5.2

AzureRM Provider Version

3.69

Affected Resource(s)/Data Source(s)

azurerm_pim_active_role_assignment, azurerm_pim_eligible_role_assignment

Terraform Configuration Files

data "azurerm_subscription" "primary" {
}
resource "azurerm_role_definition" "example" {
  name        = "my-custom-role"
  scope       = data.azurerm_subscription.primary.id
  description = "This is a custom role created via Terraform"

  permissions {
    actions     = ["*"]
    not_actions = []
    data_actions = ["*"]
    not_data_actions = []
  }

  assignable_scopes = [
    data.azurerm_subscription.primary.id,
    "/subscriptions/<subscriptionID2>"
  ]

}

resource "azurerm_pim_active_role_assignment" "always_active_azure_role_assignment1" {
  scope              = data.azurerm_subscription.primary.id
  role_definition_id = azurerm_role_definition.example.role_definition_resource_id
  principal_id       = "<principal_id>"
  justification      = "Test1"


  schedule {
    expiration {
      duration_hours = 10
    }
  }
  timeouts {
    read = "1h"
    create = "1h"
  }
}

resource "azurerm_pim_active_role_assignment" "always_active_azure_role_assignment2" {
  scope              = "/subscriptions/<subscriptionID2>"
  role_definition_id = azurerm_role_definition.example.role_definition_resource_id
  principal_id       = "<principal_id>"
  justification      = "Test2"


  schedule {
    expiration {
      duration_hours = 10
    }
  }
  timeouts {
    read = "1h"
    create = "1h"
  }

}

resource "azurerm_pim_eligible_role_assignment" "eligible_azure_role_assignment1" {
  scope              = data.azurerm_subscription.primary.id
  role_definition_id = azurerm_role_definition.example.role_definition_resource_id
  principal_id       = "<principal_id>"
  justification      = "Test3"


  schedule {
    expiration {
      duration_hours = 10
    }
  }
  timeouts {
    read = "1h"
    create = "1h"
  }
}

resource "azurerm_pim_eligible_role_assignment" "eligible_active_azure_role_assignment2" {
  scope              = "/subscriptions/<subscriptionID2>"
  role_definition_id = azurerm_role_definition.example.role_definition_resource_id
  principal_id       = "<principal_id>"
  justification      = "Test4"


  schedule {
    expiration {
      duration_hours = 10
    }
  }
  timeouts {
    read = "1h"
    create = "1h"
  }

}

Debug Output/Panic Output

Error: waiting for Role Management Policy: (Principal Id "<principal_id>" / Scope "/subscriptions/<subscriptionID2>" / Role Definition Id "<data.azurerm_subscription.primary.id>/providers/Microsoft.Authorization/roleDefinitions/<role_definition_id>") to become found: timeout while waiting for state to become 'Found' (last state: 'Missing', timeout: 5m0s)

Error: waiting for Role Management Policy: (Principal Id "<principal_id>" / Scope "/subscriptions/<subscriptionID2>" / Role Definition Id "<data.azurerm_subscription.primary.id>/providers/Microsoft.Authorization/roleDefinitions/<role_definition_id>") to become ready: couldn't find resource (21 retries)

Expected Behaviour

No response

Actual Behaviour

Terraform code is failing but role assignments are created in azure portal

Steps to Reproduce

No response

Important Factoids

No response

References

Bug is not fixed for #22588 and #22730.

You did not fix the timeout issue for azurerm_pim_active_role_assignment
Unable to find role management policy for azurerm_pim_active_role_assignment and azurerm_pim_eligible_role_assignment when the role definition is at a different subscription
Terraform code is failing but all 4 PIM assignments (2x active 2x eligible) are created and can be found in Azure Portal

[rcskosir]

Thank you for taking the time to open this issue. Please follow the PR #22932 that @wuxu92 has opened for this issue.

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.