assign an logic apps system assigned managed identity to a role with terraform and arm template

Question

Hi there, i am trying to assign an logic apps system assigned managed identity to a role for starting/stopping a virtual machine. i use terraform to deploy the logic app template like this: &nbsp;&nbsp;&nbsp;resource "azurerm_template_deployment" "myterraformscheduledvmdown" {&nbsp;&nbsp; name&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; = "scheduledvmdown"&nbsp;&nbsp; resource_group_name = "j14t23resources"&nbsp;&nbsp; template_body = &lt;&lt;DEPLOY&nbsp;{&nbsp;&nbsp;"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",&nbsp;&nbsp;"contentVersion": "1.0.0.0",&nbsp;&nbsp;"parameters": {&nbsp;&nbsp;},&nbsp;&nbsp;"variables": {&nbsp;&nbsp;},&nbsp;&nbsp;"resources": [&nbsp;&nbsp;&nbsp;{&nbsp;&nbsp;&nbsp;&nbsp;"type": "Microsoft.Logic/workflows",&nbsp;&nbsp;&nbsp;&nbsp;"apiVersion": "2019-05-01",&nbsp;&nbsp;&nbsp;&nbsp;"name": "scheduledvmdown",&nbsp;&nbsp;&nbsp;&nbsp;"location": "westus2",&nbsp;&nbsp;&nbsp;&nbsp;"identity": {&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"type": "SystemAssigned"&nbsp;&nbsp;&nbsp;&nbsp;},&nbsp;&nbsp;&nbsp;&nbsp;"properties": ....&nbsp;&nbsp;&nbsp;&nbsp;}&nbsp;&nbsp;&nbsp;}&nbsp;&nbsp;],&nbsp;&nbsp;"outputs": {&nbsp;&nbsp;&nbsp;"appid": {&nbsp;&nbsp;&nbsp;&nbsp;"type": "string",&nbsp;&nbsp;&nbsp;&nbsp;"value": "[reference(resourceId('Microsoft.Logic/workflows/', 'scheduledvmdown'), '2019-05-01', 'Full').Identity.tenantId]"&nbsp;&nbsp;&nbsp;}&nbsp;&nbsp;}&nbsp;}&nbsp;DEPLOY&nbsp;&nbsp; parameters = {&nbsp;&nbsp; }&nbsp;&nbsp; deployment_mode = "Incremental"&nbsp;}&nbsp;output "appid" {&nbsp;&nbsp; value = "${lookup(azurerm_template_deployment.myterraformscheduledvmdown.outputs, "appid")}"&nbsp;}&nbsp;resource "azurerm_role_assignment" "scheduletovmdown" {&nbsp;&nbsp; scope&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; = azurerm_linux_virtual_machine.myterraformvm.id&nbsp;&nbsp; role_definition_name = "Virtual Machine Contributor"&nbsp;&nbsp; principal_id&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; = azurerm_template_deployment.myterraformscheduledvmdown.outputs["appid"]&nbsp;}i get the following error message while trying to deploy:&nbsp;&nbsp;Error: authorization.RoleAssignmentsClient#Create: Failure responding to request: StatusCode=400 -- Original Error: autorest/azure: Service returned an error. Status=400 Code="PrincipalNotFound" Message="Principal xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx does not exist in the directory xxxxx-x-x-x-xxxx."&nbsp;&nbsp;my assumption is, that i do not get the right id with the templates Output:&nbsp;&nbsp;"[reference(resourceId('Microsoft.Logic/workflows/', 'scheduledvmdown'), '2019-05-01', 'Full').Identity.tenantId]"&nbsp;&nbsp;do you have any idea what i did wrong? or a nicer approach to assign the apps generated identity to a vm?&nbsp;&nbsp;thankstbz

tigabeatz · Answer

with a Little help from https://stackoverflow.com/questions/61429421/how-to-assign-an-azure-logic-apps-system-assigned-managed-identity-to-a-role-wit

it should be principalId, not tenantId:
"[reference(resourceId('Microsoft.Logic/workflows/', 'scheduledvmdown'), '2019-05-01', 'Full').Identity.principalId]"

Forum Discussion

assign an logic apps system assigned managed identity to a role with terraform and arm template

1 Reply

Resources