assign an logic apps system assigned managed identity to a role with terraform and arm template

%3CLINGO-SUB%20id%3D%22lingo-sub-1337715%22%20slang%3D%22en-US%22%3Eassign%20an%20logic%20apps%20system%20assigned%20managed%20identity%20to%20a%20role%20with%20terraform%20and%20arm%20template%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1337715%22%20slang%3D%22en-US%22%3E%3CDIV%3E%3CFONT%3EHi%20there%2C%20%3C%2FFONT%3E%3C%2FDIV%3E%3CDIV%3E%3CFONT%3Ei%20am%20trying%20to%20assign%20an%20logic%20apps%20system%20assigned%20managed%20identity%20to%20a%20role%20for%20starting%2Fstopping%20a%20virtual%20machine.%20%3C%2FFONT%3E%3CFONT%3Ei%20use%20terraform%20to%20deploy%20the%20logic%20app%20template%20like%20this%3A%20%3C%2FFONT%3E%3C%2FDIV%3E%3CDIV%3E%26nbsp%3B%3C%2FDIV%3E%3CDIV%3E%26nbsp%3B%3C%2FDIV%3E%3CDIV%3E%3CFONT%3E%26nbsp%3Bresource%20%22azurerm_template_deployment%22%20%22myterraformscheduledvmdown%22%20%7B%3CBR%20%2F%3E%26nbsp%3B%26nbsp%3B%20name%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%20%3D%20%22scheduledvmdown%22%3CBR%20%2F%3E%26nbsp%3B%26nbsp%3B%20resource_group_name%20%3D%20%22j14t23resources%22%3C%2FFONT%3E%3C%2FDIV%3E%3CDIV%3E%3CFONT%3E%26nbsp%3B%26nbsp%3B%20template_body%20%3D%20%26lt%3B%3CDEPLOY%3E%3C%2FDEPLOY%3E%3C%2FFONT%3E%3C%2FDIV%3E%3CDIV%3E%3CFONT%3E%26nbsp%3B%7B%3CBR%20%2F%3E%26nbsp%3B%26nbsp%3B%22%24schema%22%3A%20%22%3CA%20href%3D%22https%3A%2F%2Fschema.management.azure.com%2Fschemas%2F2019-04-01%2FdeploymentTemplate.json%23%22%20target%3D%22_blank%22%20rel%3D%22noopener%20nofollow%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fschema.management.azure.com%2Fschemas%2F2019-04-01%2FdeploymentTemplate.json%23%3C%2FA%3E%22%2C%3CBR%20%2F%3E%26nbsp%3B%26nbsp%3B%22contentVersion%22%3A%20%221.0.0.0%22%2C%3CBR%20%2F%3E%26nbsp%3B%26nbsp%3B%22parameters%22%3A%20%7B%3CBR%20%2F%3E%26nbsp%3B%26nbsp%3B%7D%2C%3CBR%20%2F%3E%26nbsp%3B%26nbsp%3B%22variables%22%3A%20%7B%3CBR%20%2F%3E%26nbsp%3B%26nbsp%3B%7D%2C%3CBR%20%2F%3E%26nbsp%3B%26nbsp%3B%22resources%22%3A%20%5B%3CBR%20%2F%3E%26nbsp%3B%26nbsp%3B%26nbsp%3B%7B%3CBR%20%2F%3E%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%22type%22%3A%20%22Microsoft.Logic%2Fworkflows%22%2C%3CBR%20%2F%3E%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%22apiVersion%22%3A%20%222019-05-01%22%2C%3CBR%20%2F%3E%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%22name%22%3A%20%22scheduledvmdown%22%2C%3CBR%20%2F%3E%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%22location%22%3A%20%22westus2%22%2C%3CBR%20%2F%3E%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%22identity%22%3A%20%7B%3CBR%20%2F%3E%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%22type%22%3A%20%22SystemAssigned%22%3CBR%20%2F%3E%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%7D%2C%3CBR%20%2F%3E%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%22properties%22%3A%20....%3CBR%20%2F%3E%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%7D%3CBR%20%2F%3E%26nbsp%3B%26nbsp%3B%26nbsp%3B%7D%3C%2FFONT%3E%3C%2FDIV%3E%3CDIV%3E%3CFONT%3E%26nbsp%3B%26nbsp%3B%5D%2C%3CBR%20%2F%3E%26nbsp%3B%26nbsp%3B%22outputs%22%3A%20%7B%3CBR%20%2F%3E%26nbsp%3B%26nbsp%3B%26nbsp%3B%22appid%22%3A%20%7B%3CBR%20%2F%3E%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%22type%22%3A%20%22string%22%2C%3CBR%20%2F%3E%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%22value%22%3A%20%22%5Breference(resourceId('Microsoft.Logic%2Fworkflows%2F'%2C%20'scheduledvmdown')%2C%20'2019-05-01'%2C%20'Full').Identity.tenantId%5D%22%3CBR%20%2F%3E%26nbsp%3B%26nbsp%3B%26nbsp%3B%7D%3CBR%20%2F%3E%26nbsp%3B%26nbsp%3B%7D%3CBR%20%2F%3E%26nbsp%3B%7D%3C%2FFONT%3E%3C%2FDIV%3E%3CDIV%3E%3CFONT%3E%3CBR%20%2F%3E%26nbsp%3BDEPLOY%3C%2FFONT%3E%3C%2FDIV%3E%3CDIV%3E%3CFONT%3E%26nbsp%3B%26nbsp%3B%20parameters%20%3D%20%7B%3CBR%20%2F%3E%26nbsp%3B%26nbsp%3B%20%7D%3C%2FFONT%3E%3C%2FDIV%3E%3CDIV%3E%3CFONT%3E%26nbsp%3B%26nbsp%3B%20deployment_mode%20%3D%20%22Incremental%22%3CBR%20%2F%3E%26nbsp%3B%7D%3C%2FFONT%3E%3C%2FDIV%3E%3CDIV%3E%3CFONT%3E%26nbsp%3Boutput%20%22appid%22%20%7B%3CBR%20%2F%3E%26nbsp%3B%26nbsp%3B%20value%20%3D%20%22%24%7Blookup(azurerm_template_deployment.myterraformscheduledvmdown.outputs%2C%20%22appid%22)%7D%22%3CBR%20%2F%3E%26nbsp%3B%7D%3C%2FFONT%3E%3C%2FDIV%3E%3CDIV%3E%3CFONT%3E%26nbsp%3Bresource%20%22azurerm_role_assignment%22%20%22scheduletovmdown%22%20%7B%3CBR%20%2F%3E%26nbsp%3B%26nbsp%3B%20scope%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%20%3D%20azurerm_linux_virtual_machine.myterraformvm.id%3CBR%20%2F%3E%26nbsp%3B%26nbsp%3B%20role_definition_name%20%3D%20%22Virtual%20Machine%20Contributor%22%3CBR%20%2F%3E%26nbsp%3B%26nbsp%3B%20principal_id%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%20%3D%20azurerm_template_deployment.myterraformscheduledvmdown.outputs%5B%22appid%22%5D%3CBR%20%2F%3E%26nbsp%3B%7D%3C%2FFONT%3E%3C%2FDIV%3E%3CDIV%3E%3CFONT%3E%3CBR%20%2F%3Ei%20get%20the%20following%20error%20message%20while%20trying%20to%20deploy%3A%3C%2FFONT%3E%3C%2FDIV%3E%3CDIV%3E%26nbsp%3B%3C%2FDIV%3E%3CDIV%3E%3CFONT%3E%26nbsp%3BError%3A%20authorization.RoleAssignmentsClient%23Create%3A%20Failure%20responding%20to%20request%3A%20StatusCode%3D400%20--%20Original%20Error%3A%20autorest%2Fazure%3A%20Service%20returned%20an%20error.%20Status%3D400%20Code%3D%22PrincipalNotFound%22%20Message%3D%22Principal%20xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx%20does%20not%20exist%20in%20the%20directory%20xxxxx-x-x-x-xxxx.%22%3C%2FFONT%3E%3C%2FDIV%3E%3CDIV%3E%26nbsp%3B%3C%2FDIV%3E%3CDIV%3E%26nbsp%3B%3C%2FDIV%3E%3CDIV%3E%3CFONT%3Emy%20assumption%20is%2C%20that%20i%20do%20not%20get%20the%20right%20id%20with%20the%20templates%20Output%3A%3CBR%20%2F%3E%26nbsp%3B%3CBR%20%2F%3E%26nbsp%3B%22%5Breference(resourceId('Microsoft.Logic%2Fworkflows%2F'%2C%20'scheduledvmdown')%2C%20'2019-05-01'%2C%20'Full').Identity.tenantId%5D%22%26nbsp%3B%3C%2FFONT%3E%3C%2FDIV%3E%3CDIV%3E%26nbsp%3B%3C%2FDIV%3E%3CDIV%3E%3CFONT%3Edo%20you%20have%20any%20idea%20what%20i%20did%20wrong%3F%20or%20a%20nicer%20approach%20to%20assign%20the%20apps%20generated%20identity%20to%20a%20vm%3F%26nbsp%3B%3CBR%20%2F%3E%26nbsp%3B%3CBR%20%2F%3Ethanks%3CBR%20%2F%3Etbz%3C%2FFONT%3E%3C%2FDIV%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-1337715%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3Earm%20template%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3ELogic%20App%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3ETerraform%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1337956%22%20slang%3D%22en-US%22%3ERe%3A%20assign%20an%20logic%20apps%20system%20assigned%20managed%20identity%20to%20a%20role%20with%20terraform%20and%20arm%20template%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1337956%22%20slang%3D%22en-US%22%3Ewith%20a%20Little%20help%20from%20%3CA%20href%3D%22https%3A%2F%2Fstackoverflow.com%2Fquestions%2F61429421%2Fhow-to-assign-an-azure-logic-apps-system-assigned-managed-identity-to-a-role-wit%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fstackoverflow.com%2Fquestions%2F61429421%2Fhow-to-assign-an-azure-logic-apps-system-assigned-managed-identity-to-a-role-wit%3C%2FA%3E%3CBR%20%2F%3E%3CBR%20%2F%3Eit%20should%20be%20principalId%2C%20not%20tenantId%3A%3CBR%20%2F%3E%22%5Breference(resourceId('Microsoft.Logic%2Fworkflows%2F'%2C%20'scheduledvmdown')%2C%20'2019-05-01'%2C%20'Full').Identity.principalId%5D%22%3C%2FLINGO-BODY%3E
Highlighted
New Contributor
Hi there,
i am trying to assign an logic apps system assigned managed identity to a role for starting/stopping a virtual machine. i use terraform to deploy the logic app template like this:
 
 
 resource "azurerm_template_deployment" "myterraformscheduledvmdown" {
   name                = "scheduledvmdown"
   resource_group_name = "j14t23resources"
   template_body = <<DEPLOY
 {
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
  },
  "variables": {
  },
  "resources": [
   {
    "type": "Microsoft.Logic/workflows",
    "apiVersion": "2019-05-01",
    "name": "scheduledvmdown",
    "location": "westus2",
    "identity": {
     "type": "SystemAssigned"
    },
    "properties": ....
    }
   }
  ],
  "outputs": {
   "appid": {
    "type": "string",
    "value": "[reference(resourceId('Microsoft.Logic/workflows/', 'scheduledvmdown'), '2019-05-01', 'Full').Identity.tenantId]"
   }
  }
 }

 DEPLOY
   parameters = {
   }
   deployment_mode = "Incremental"
 }
 output "appid" {
   value = "${lookup(azurerm_template_deployment.myterraformscheduledvmdown.outputs, "appid")}"
 }
 resource "azurerm_role_assignment" "scheduletovmdown" {
   scope                = azurerm_linux_virtual_machine.myterraformvm.id
   role_definition_name = "Virtual Machine Contributor"
   principal_id         = azurerm_template_deployment.myterraformscheduledvmdown.outputs["appid"]
 }

i get the following error message while trying to deploy:
 
 Error: authorization.RoleAssignmentsClient#Create: Failure responding to request: StatusCode=400 -- Original Error: autorest/azure: Service returned an error. Status=400 Code="PrincipalNotFound" Message="Principal xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx does not exist in the directory xxxxx-x-x-x-xxxx."
 
 
my assumption is, that i do not get the right id with the templates Output:
 
 "[reference(resourceId('Microsoft.Logic/workflows/', 'scheduledvmdown'), '2019-05-01', 'Full').Identity.tenantId]" 
 
do you have any idea what i did wrong? or a nicer approach to assign the apps generated identity to a vm? 
 
thanks
tbz
1 Reply
Highlighted
with a Little help from https://stackoverflow.com/questions/61429421/how-to-assign-an-azure-logic-apps-system-assigned-manag...

it should be principalId, not tenantId:
"[reference(resourceId('Microsoft.Logic/workflows/', 'scheduledvmdown'), '2019-05-01', 'Full').Identity.principalId]"