Hey all, I am hoping someone can help guide with where/how to resolve or troubleshoot this issue. Ultimately, I am trying to create the code to create cloud resource landing zones through an Azure DevOps pipeline. I am using an Azure enrollment account and an SP designated as a subscription creator under that enrollment account. That all works fine for new subscription.
The part I am struggling to figure out, is how to import/manage existing subscriptions. My code either creates a brand new subscription if no Subscription ID is given, or “imports” or creates an alias if a Subscription ID is given. But the code is failing with one of several error messages:
Error: multiple Aliases for Subscription "BLAH" already exist - to be managed via Terraform only one Alias can exist and this resource needs to be imported into the State. Please see the resource documentation for "azurerm_subscription" for more information
Error: checking for existence of Subscription by Alias "<alias>": subscription.AliasClient#Get: Failure responding to request: StatusCode=401 -- Original Error: autorest/azure: Service returned an error. Status=401 Code="UserNotAuthorized" Message="User does not have access Microsoft.Subscription/aliases/read over scope providers/Microsoft.Subscription/aliases/<alias>"
I don’t think this issue is a code problem, as running the az account alias commands don’t actually show me any aliases to any of these subscriptions, if run under the EA Owner account or the Terraform SP account.
Any help or guidance would be greatly appreciated.