Using ansible to create Azure resource group, throws “403 client error”

0
votes

Right now I am using ansible playbooks to create azure resource group on Centos 7.0, and I created a credential file like this:

[default]
subscription_id=my_subscription_id
client_id=<the application ID>
secret=<the password>
tenant=<my aad id>

and it throws an error like this:

{"changed": false, "msg": "Error checking for existence of name ansible-rg - 403 Client Error: Forbidden for url: https://management.azure.com/subscriptions/my_subscription_id/resourcegroups/ansible-rg?api-version=2017-05-10"}

I know maybe it is because my lack permission of my subscription, but I am not sure what I should do about this.

2
azureansible
did you grant your service principal permissions? also, how did you install ansible? this doesnt look like a permissions error on azure side – 4c74356b41
Seems your service principal does not have the permission to create the resource group. Try: navigate to your subscription in the portal -> Access control (IAM) -> Add -> Add role assignment -> add your service principal as a role(e.g. owner) in the subscription. – Joy Wang-MSFT
Thanks @JoyWang, I will try it. – joe huang
@JoyWang no, this error doesnt look like that at all – 4c74356b41
@4c74356b41 Thanks for your help. I have tried what Joy said before, and seems it works well right now...I should add service principal to the subscription. – joe huang

2 Answers

0
votes

Seems your service principal does not have the permission to create the resource group.

Try: navigate to your subscription in the portal -> Access control (IAM) -> Add -> Add role assignment -> add your service principal as a role(e.g. owner) in the subscription.

0
votes

For others that might have this error, make sure to also check that your current subscription is not on Pay-As-You-Go, as you will see the same error:

FAILED! => {"changed": false, "msg": "Error checking for existence of name * - 403 Client Error: Forbidden for url: https://management.azure.com/subscriptions/*/resourcegroups/rg-cs-ansible?api-version=2017-05-10"}

See screenshot sample as seen in azure