0
provider "azurerm" {
  features {}
}

data "azurerm_management_group" "management_group" {
  display_name = var.management_group_display_name
}

resource "azurerm_policy_definition" "deployment_policy_definition" {
  name                = "resources-in-eastus-policy"
  policy_type         = "Custom"
  mode                = "All"
  display_name        = "Allowed to only deploy in East US location"
  management_group_id = data.azurerm_management_group.management_group.id

  policy_rule = <<POLICY_RULE
    {
    "if": {
      "not": {
        "field": "location",
        "in": "[parameters('allowedLocations')]"
      }
    },
    "then": {
      "effect": "audit"
    }
  }
POLICY_RULE

  parameters = <<PARAMETERS
    {
    "allowedLocations": {
      "type": "Array",
      "metadata": {
        "description": "The list of allowed locations for resources.",
        "displayName": "Allowed locations",
        "strongType": "location"
      }
    }
  }
PARAMETERS
}

resource "azurerm_management_group_policy_assignment" "mngmt_grp_dep_pol_assign" {
  name                 = "assign-pol-to-mgmt-grp"
  policy_definition_id = azurerm_policy_definition.deployment_policy_definition.id
  management_group_id  = data.azurerm_management_group.management_group.id
  parameters           = <<PARAMETERS
{
  "allowedLocations": {
    "value": [ "eastus" ]
  }
}
PARAMETERS
}

Error: creating/updating Policy Definition "resources-in-eastus-policy": policy.DefinitionsClient#CreateOrUpdateAtManagementGroup: Failure responding to request: StatusCode=403 -- Original Error: autorest/azure: Service returned an error. Status=403 Code="AuthorizationFailed" Message="The client 'live.com#XXX@gmail.com' with object id '0ab7dad7-dba2-46d9-8cc6-878647e9a5cb' does not have authorization to perform action 'Microsoft.Management/managementGroups/Microsoft.Management/1/Microsoft.Authorization/resources-in-eastus-policy/write' over scope '/providers/Microsoft.Management/managementGroups/providers/Microsoft.Management/managementGroups/1/providers/Microsoft.Authorization/policyDefinitions' or the scope is invalid. If access was recently granted, please refresh your credentials."

Azure Roles added for the owner/user of the azure-cli Azure Roles Assigned To The User

The ID of the target management group where I am trying to create and assign the policy under the Tenant Root Group is 1

kavyaS
  • 8,026
  • 1
  • 7
  • 19
Surajit Barman
  • 19
  • 4

1 Answers1

0

Error:

The client 'live.com#XXX@gmail.com' with object id '0ab7daxxxxxxx-xxxxe9a5cb' does not have authorization to perform action 'Microsoft.Management/managementGroups/Microsoft.Management/1/Microsoft.Authorization/resources-in-eastus-policy/write

  • As the error mentions the client doesn’t have proper RBAC role to perform policy definition creation on management groups.
  • Try to assign that ObjectId mentioned in the error , the proper role like Management Group Contributor OR Management Group Reader role.

Note: The principal/user which is deploying ,must have permissions like Contributor to create resources at the tenant scope and to assign that permission one must have Owner role

Also see below table from management-group-access :

enter image description here

  • From the management group , Go to Access control (IAM), add your client(user/service principal) as an RBAC role

enter image description here

or provide role through powershell:

New-AzRoleAssignment -Scope '/' -RoleDefinitionName 'Owner' -ObjectId <objectidofftheclient>

Then wait for some time for the role to reflect and then try to create policy assignment to management group:

enter image description here

Policy assignment made to management group.

enter image description here

Please make sure if the management group is reflected properly and check the id is correct in terraform, if it is already created in portal. Else import them using terraform import and then perform terraform operations.

kavyaS
  • 8,026
  • 1
  • 7
  • 19
  • Thank you Kavya for taking time to articulate a very detailed response, but the object ID in reference here does have the RBAC permissions (Management Group Contributor, Owner, Contributor, Resource Policy Contributor, User Access Administrator) you have highlighted. The ID of my mgmt group is 1, which is being correctly read. But still 403. The object ID can perform the required just fine using the portal. – Surajit Barman Sep 30 '22 at 13:40
  • Azure CLI Details: azure-cli 2.40.0 core 2.40.0 telemetry 1.0.8 Dependencies: msal 1.18.0b1 azure-mgmt-resource 21.1.0b1 – Surajit Barman Sep 30 '22 at 13:44
  • Please check if you are logged into correct tenant /subscription .Try running `az login --subscription` or check current tenant details. – kavyaS Oct 04 '22 at 13:35