I’m looking to setup Azure catalogs and access packages with Terraform and found a handy module created here which I’m trying to use: GitHub - fortytwoservices/terraform-azuread-entitlement-management: This module allows you to simply do Entitlement Management in Azure AD through Catalogs and Access Packages
So far so good, until I try to add resources into the access package and then hit an issue with the association. This is the error I’m getting:
Error: Failed to link resource “fbfeaae9-6bcf-4333-xxxx-xxxxxxxxxxxx”@“AadGroup” with access catalog “023678c2-c22b-4609-xxxx-xxxxxxxxxxxx”.
│
│ with module.catalog.azuread_access_package_resource_catalog_association.resource-catalog-associations[“CatalogName-Aadgroupname”],
│ on .terraform/modules/catalog/modules/azuread/azuread_entitlement_management/main.tf line 152, in resource “azuread_access_package_resource_catalog_association” “resource-catalog-associations”:
│ 152: resource “azuread_access_package_resource_catalog_association” “resource-catalog-associations” {
│
│ AccessPackageResourceRequestClient.BaseClient.Post(): unexpected status 400
│ with OData error: CallerNotResourceOwner: The caller is not the resource
│ owner.
The module itself has this for the azuread_access_package_resource_catalog_association:
resource “azuread_access_package_resource_catalog_association” “resource-catalog-associations” {
for_each = { for resource in local.resource-catalog-associations-filtered : resource.catalog_resource_association_key => resource }catalog_id = azuread_access_package_catalog.entitlement-catalogs[each.value.catalog_key].id
resource_origin_id = each.value.resource_origin_id
resource_origin_system = each.value.resource_origin_systemdepends_on = [
azuread_access_package_catalog.entitlement-catalogs
]
}
This is the resource part of the variable being fed into the module:
resources = [ # List of resources, one resource per object { display_name = "MyAadGroupName" resource_origin_system = "AadGroup" resource_origin_id = "fbfeaae9-6bcf-4333-xxxx-xxxxxxxxxxxx" # The ID of the Azure resource to be added to the Catalog and Access Package } ]
Guess I’m trying to figure out if I’m hitting an API bug or if there’s part of the Terraform I’m not understanding correctly.