ServicePrincipalsClient.BaseClient.Post()：意外状态 403，带有 OData 错误

Question

我正在拼命寻找解决方案，

当我应用 terraform 配置文件时，我收到此错误消息。尝试了所有可能的解决方案，但仍然无法解决，请您提供建议吗？这是 tf 文件。

# Create Azure AD App Registration
resource "azuread_application" "app" {
  display_name = "my-app"
  owners       = [local.current_user_id]

}

# Create Service Principal
resource "azuread_service_principal" "app" {
  application_id               = azuread_application.app.application_id
  app_role_assignment_required = true
  owners                       = [local.current_user_id]
 
}

# Create Service Principal password
resource "azuread_service_principal_password" "app" {
  service_principal_id = azuread_service_principal.app.id
}

# Sleep for 300 seconds to allow for propagation
# of the Service Principal creation before attempting
# to create the AKS cluster.
resource "time_sleep" "wait_300_seconds" {
  create_duration = "300s"

  depends_on = [azuread_service_principal_password.app]
}

# Output the Service Principal and password
output "sp" {
  value     = azuread_service_principal.app.id
  sensitive = true
}

output "sp_password" {
  value     = azuread_service_principal_password.app.value
  sensitive = true
}

Answer 1

在 Entra ID 中为 terraform 执行用户创建所需的服务主体

Application Administrator

角色。

Entra ID -> 用户 -> 您的用户名 -> 添加分配 -> 应用程序 管理员

[ 或

如果您在应用程序注册范围内

Entra ID -> 应用注册 -> YourAppName -> Api 权限 -> 添加 许可

并根据您的要求通过 Microsoft Graph ->

Application.ReadWrite.All

或

Application.ReadWrite.Ownedby

选择相关权限。