Azure Vnet Peering across subscriptions using Terraform

Question

I was wondering if someone could help me with setting up Vnet Peerings across subscriptions in Azure using Terraform. Each subscription is within the same tenant, but they have different service principals. I keep getting errors suggesting that the service principal cannot see the resource group in the other subscription. This is despite giving that service principal contributor access to the other subscription.

This is an example of the code I have:

resource "azurerm_virtual_network_peering" "dev-to-test" {
  name                      = "dev-to-test"
  resource_group_name       = "gl-dev-rg"
  virtual_network_name      = "gl-dev-vnet"
  remote_virtual_network_id = "/subscriptions/subscriptionid/resourceGroups/gl-test-rg/providers/Microsoft.Network/virtualNetworks/gl-test-vnet"
  allow_virtual_network_access = true
  allow_forwarded_traffic   = true
}

resource "azurerm_virtual_network_peering" "test-to-dev" {
  name                      = "test-to-dev"
  resource_group_name       = "gl-test-rg"
  virtual_network_name      = "gl-test-vnet"
  remote_virtual_network_id = "/subscriptions/subscriptionid/resourceGroups/gl-dev-rg/providers/Microsoft.Network/virtualNetworks/gl-dev-vnet"
  allow_virtual_network_access = true
  allow_forwarded_traffic   = true
}

Any help would be really appreciated!

Further information can be found here: https://github.com/terraform-providers/terraform-provider-azurerm/issues/1253

You pointed that the sp cannot access the rgs. Did you assign a contributor role in both subscriptions? — Wayne Yang
Yes, the one subscription does have access to the other one. I seem to hit the issue when building the first peering. Which is the one where dev sp has access to the test subscription — Chris.Gray
This is being addressed in the related GitHub issue for this here. We will repost the final solution once the issue is resolved. — Arun Chandrasekhar

Christian Pearce Christian Pearce · Accepted Answer · 2020-07-20T16:31:48

The question was asked and answered in this issue. The TL;DR is terraform has an alias parameter for providers. This allows two separate service principals to reference different resources in a single terraform run.

Azure Vnet Peering across subscriptions using Terraform

1 Answers