msgraph_resource applications/{application_id}/federatedIdentityCredentials tf state issues, causing graph api call errors when applying #55
Description
Hi ms tf devs,
I'm attempting to create federated credentials for azure service principals using the the msgraph provider resource msgraph_resource making a request to applications/{application_id}/federatedIdentityCredentials beta version. We need to use the beta version to be able to create a claimsMatchingExpression on the federated credentials. Somehow this resource is being created but simply errors every time for some service principals (works fine for other sps) due to what we think to be a state tracking issue.
Our theory for this error is this...
- Initial create happens, federated credential doesnt exist yet, federated credential gets created and put into state
- TF refresh occurs on next run, due to some error in the API (were guessing), it attempts to see if the federated credential exists, it fails when calling some api to determine if it exists, attempts to recreate and errors
Since it's only happening to some service principals we think it might be something like a region issue? Or maybe something with us using the beta api?
Can someone look into this? Any ides? Let me know! Thanks.
example error:
`
Error: Failed to create resource
POST:
https://graph.microsoft.com/beta/applications/application_id/federatedIdentityCredentials
RESPONSE 409: 409 Conflict
ERROR CODE: Request_MultipleObjectsWithSameKeyValue
{
"error": {
"code": "Request_MultipleObjectsWithSameKeyValue",
"message": "FederatedIdentityCredential with name name already exists."
"innerError": {
"date": date
"request-id": request id
"client-request-id": client request id
}
}
`
example resource:
resource "msgraph_resource" "federated_identity_credential" { url = "applications/{var.application_id}/federatedIdentityCredentials" api_version = "beta" body = { name = "foo" description = "bar" audiences = ["api://AzureADTokenExchange"] issuer = "https://token.actions.githubusercontent.com" claimsMatchingExpression = "expression" } }