Error: Client error when reading _security_roles

[tschubach]

Describe the bug

When attempting to retrieve the security roles for an imported environment, Terraform Plan stage is failing with the following error:

Planning failed. Terraform encountered an error while generating this plan.

╷
│ Warning: Error when reading default currency for environment f85cc3c3-f068-e0fa-b93c-1552ec488d1e
│ 
│   with module.sample.powerplatform_environment.sample_import,
│   on submodules/sample/component.tf line 9, in resource "powerplatform_environment" "sample_import":
│    9: resource "powerplatform_environment" "sample_import" {
│ 
│ Error making GET request to . Get
│ "https://org9dc32b93.crm.dynamics.com/api/data/v9.2/organizations": EOF
╵
╷
│ Error: Client error when reading _security_roles
│ 
│   with module.sample.data.powerplatform_security_roles.sample_import,
│   on submodules/sample/component.tf line 19, in data "powerplatform_security_roles" "sample_import":
│   19: data "powerplatform_security_roles" "sample_import" {
│ 
│ Error making GET request to . Get
│ "https://org9dc32b93.crm.dynamics.com/api/data/v9.2/roles": EOF

Sample Terraform Code

main.tf

import {
  to = module.sample.powerplatform_environment.sample_import
  id = "f85cc3c3-f068-e0fa-b93c-1552ec488d1e"
}
module "sample" {
  source   = "./submodules/sample"
}

submodules/sample/component.tf

variable "location" {
  type        = string
  description = "Location of your resources (unitedstates, europe, etc.)"
  default     = "unitedstates"
}

resource "powerplatform_environment" "sample_import" {
  display_name     = "Sample-Import"
  location         = var.location
  environment_type = "Sandbox"

  lifecycle {
    ignore_changes = [dataverse]
  }
}

data "powerplatform_security_roles" "sample_import" {
  environment_id = powerplatform_environment.sample_import.id
}

output "sample_import_roles" {
  value = data.powerplatform_security_roles.sample_import.security_roles
}

Expected behavior

The security roles available in the environment should be output

System Information

• Provider Version: microsoft/power-platform 3.5
• OS & Version: DotNet vsts Agent, v3.248.0

[mattdot]

@mawasile please take a look at this one.

[mawasile]

@tschubach I am assuming you are using service principal authentication in your example. Your service principal has to be registered as service admin (https://learn.microsoft.com/en-us/power-platform/admin/powerplatform-api-create-service-principal#registering-an-admin-management-application).
If you are using user authentication, then the user has to have some permissions in the dataverse, so that it can read records.

Normally, when you created an environment with an SP then it will get added to the environment with System Administrator role automatically but for environment that already exists and you want to import them this is not the case.
Please confirm that your user/service principal is added to the dataverse and has correct permissions.

BTW. your example uses location as variable with a default, keep in mind that if you won't specify location or specify different than the existing environment, you will delete your environment while running terraform, because if location attribute changes that forces environment re-creation.

[tschubach]

@mawasile After adding the SP with the System Administrator role to the environment to be imported, I continue to get this error:

Planning failed. Terraform encountered an error while generating this plan.

╷
│ Warning: Error when reading default currency for environment f85cc3c3-f068-e0fa-b93c-1552ec488d1e
│ 
│   with module.sample.powerplatform_environment.sample_import,
│   on submodules/sample/component.tf line 12, in resource "powerplatform_environment" "sample_import":
│   12: resource "powerplatform_environment" "sample_import" {
│ 
│ Error making GET request to . Get
│ "https://org9dc32b93.crm.dynamics.com/api/data/v9.2/organizations": EOF
╵
╷
│ Error: Client error when reading _security_roles
│ 
│   with module.sample.data.powerplatform_security_roles.sample_import,
│   on submodules/sample/component.tf line 40, in data "powerplatform_security_roles" "sample_import":
│   40: data "powerplatform_security_roles" "sample_import" {
│ 
│ Error making GET request to . Get
│ "https://org9dc32b93.crm.dynamics.com/api/data/v9.2/roles": EOF

For additional info, these are the API permissions currently set for the SP:

Dynamics CRM
   user_impersonation

Microsoft Graph
   Domain.Read.All
   Group.Read.AllUser.Read.All
   User.Read.All

Power Platform API
   AppManagement.ApplicationPackages.Install
   AppManagement.ApplicationPackages.Read
   EnvironmentManagement.Environments.Read
   EnvironmentManagement.Groups.Read
   EnvironmentManagement.Groups.ReadWrite
   EnvironmentManagement.Settings.Read
   EnvironmentManagement.Settings.ReadWrite
   Licensing.Allocations.Read
   Licensing.Allocations.Read
   Licensing.Allocations.ReadWrite
   Licensing.BillingPolicies.Read
   Licensing.BillingPolicies.ReadWrite
   Licensing.IsvContracts.Read
   Licensing.IsvContracts.ReadWrite

PowerApps Runtime Service
   user_impersonation

PowerApps Service
   User

[mawasile]

@tschubach Did you executed this PUT request: https://learn.microsoft.com/en-us/power-platform/admin/powerplatform-api-create-service-principal#registering-an-admin-management-application or used azuread_application_registration resource to elevate your SP to admin?

Can you also confirm that it works when you use your use account, for example login interactively with device code: az login --use-device-code

[tschubach]

@mawasile The SP is registered as an admin. Running with the SP is our only option

[mawasile]

@mawasile The SP is registered as an admin. Running with the SP is our only option

ok, but are you sure that the PUT operation that I've mentioned in the comment above was done or not, can you please confirm?

[tschubach]

@mawasile Yes, the PUT operation was run. I presume it only needs to be run once, correct?

[mawasile]

@tschubach can you run the it again with export TF_LOG=DEBUG and share the log. Please validate if there aren't any information in the output that you would not like to share, for example the log will output subscriptionId and evinronmentids.