We get errors (similar to that below) when the module is attempting to make the RBAC assignments in rbac.tf:
╷
│ Error: unexpected status 403 (403 Forbidden) with error: AuthorizationFailed: The client '***' with object id '812affac-4eed-4e06-a8e1-625a1685638e' does not have authorization to perform action 'Microsoft.Authorization/roleAssignments/write' over scope '/providers/Microsoft.Management/managementGroups/17f18161-20d7-4746-87fd-50fe3e3b6619/providers/Microsoft.Authorization/roleAssignments/7a051719-c08a-af79-8c34-2ebc389982b1' or the scope is invalid. If access was recently granted, please refresh your credentials.
│
│ with module.example.azurerm_role_assignment.carbon_optimization_reader,
│ on .terraform/modules/example/rbac.tf line 52, in resource "azurerm_role_assignment" "carbon_optimization_reader":
│ 52: resource "azurerm_role_assignment" "carbon_optimization_reader" {
│
╵
This is because we have constrained our assignment of User Access Administrator to only applying to 'Service Principals' (and not 'Users' nor 'Groups') in accordance with security best practices.
In this case, Terraform requires this property to be set:
Therefore, would you please adjust your code (similar to that below):
We get errors (similar to that below) when the module is attempting to make the RBAC assignments in rbac.tf:
╷
│ Error: unexpected status 403 (403 Forbidden) with error: AuthorizationFailed: The client '***' with object id '812affac-4eed-4e06-a8e1-625a1685638e' does not have authorization to perform action 'Microsoft.Authorization/roleAssignments/write' over scope '/providers/Microsoft.Management/managementGroups/17f18161-20d7-4746-87fd-50fe3e3b6619/providers/Microsoft.Authorization/roleAssignments/7a051719-c08a-af79-8c34-2ebc389982b1' or the scope is invalid. If access was recently granted, please refresh your credentials.
│
│ with module.example.azurerm_role_assignment.carbon_optimization_reader,
│ on .terraform/modules/example/rbac.tf line 52, in resource "azurerm_role_assignment" "carbon_optimization_reader":
│ 52: resource "azurerm_role_assignment" "carbon_optimization_reader" {
│
╵
This is because we have constrained our assignment of User Access Administrator to only applying to 'Service Principals' (and not 'Users' nor 'Groups') in accordance with security best practices.
In this case, Terraform requires this property to be set:
Therefore, would you please adjust your code (similar to that below):