Terraform Cloud/Enterprise and Authenticating using a Service Principal and OpenID Connect

[mw8er]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritise this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritise the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform (and AzureAD Provider) Version

Terraform v1.2.8

AzureAD Provider 2.28

Affected Resource(s)

Authentication of provider running on Terraform Cloud / Enterprise.

Error: could not configure AzureCli Authorizer: could not parse Azure CLI version: launching Azure CLI: exec: "az": executable file not found in $PATH

Terraform Configuration Files

# Copy-paste your Terraform configurations here - for large Terraform configs,
# please use a service like Dropbox and share a link to the ZIP file. For
# security, you can also encrypt the files using our GPG public key: https://keybase.io/hashicorp
terraform {
  required_providers {
    azuread = {
      source  = "hashicorp/azuread"
      version = "~> 2.28"
    }
  }

  cloud {
    organization = "dummy-organization"

    workspaces {
      name = "dummy-workspace"
    }
  }
}

provider "azuread" {
  use_oidc = true
}

data "azuread_client_config" "current" {}

output "object_id" {
  value = data.azuread_client_config.current.object_id
}

Debug Output

Panic Output

Expected Behavior

I would like to be able to use Authenticating using a Service Principal and OpenID Connect in combination with the standard/default Terraform Cloud/Enterprise runners.

Actual Behavior

As mentioned above, the authentication fails

Steps to Reproduce

1. terraform plan

Important Factoids

References

[manicminer]

Hi @mw8er, thanks for requesting this. This is something we are actively working on in conjunction with the relevant TFC/TFE teams. We'll gladly use this issue for tracking this feature.

[manicminer]

Provider work in preparation for this has been released with support for the oidc_token_file_path provider property.

[github-actions[bot]]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues. If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.