azure - 使用 terraform 创建新的 azure 资源组时出错

Question

我正在尝试使用 terraform 在 azure 中创建新资源组，但出现以下错误

Error checking for presence of existing resource group:resources.GroupsClient#Get: Failure responding to request:StatusCode=403 -- Original Error: autorest/azure: Service returned anerror. Status=403 Code="AuthorizationFailed" Message="The client'xxxxx' with object id 'xxxxx' does not have authorization to performaction 'Microsoft.Resources/subscriptions/resourcegroups/read' overscope '/subscriptions/***/resourcegroups/stage-group' or the scopeis invalid. If access was recently granted, please refresh yourcredentials.

这是代码示例

terraform {
  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "=2.7.0"
    }
  }
}

provider "azurerm" {
  features {}
}

#Create resource group
resource "azurerm_resource_group" "resource_group" {
  name     = "stage-group"
  location = "eastus"
}

我通过 github actions 运行它并传递 ARM_CLIENT_ID,ARM_CLIENT_SECRET, ARM_SUBSCRIPTION_ID ,ARM_TENANT_ID 。对现有资源运行相同的操作时，我没有遇到问题。

Answer 1

你必须assign a proper role到更高范围的服务主体 - 订阅或管理组级别，并有权创建资源组 (Microsoft.Resources/subscriptions/resourceGroups/write)。

大多数时候，Contributor非常适合，但您可以根据自己的需要寻找更细化的职位。