Terraform with azure CLI - error building account

8
votes

using the provider block

provider "azurerm" {
  subscription_id = var.subscription_id
  version         = "=1.44"
}

and after successfully logging in with

az login

running

terraform plan

I get the following error:

Error: Error building account: Error getting authenticated object ID: Error parsing json result from the Azure CLI: Error waiting for the Azure CLI: exit status 2

on main.tf line 21, in provider "azurerm":
21: provider "azurerm" {

UPDATE:

If I change the provider block to:

provider "azurerm" {
 version = "~> 1.43"
}

and set the environment variables

ARM_USE_MSI=true
ARM_SUBSCRIPTION_ID=<...>
ARM_TENANT_ID=<...>
HTTP_PROXY=<...>
HTTPS_PROXY=<...>
http_proxy=<...>
https_proxy=<...>

than after executing terraform plan I get the following error:

Connection to 169.254.169.254 failed. No route to host.

which is very strange, as it seems to me, that a service endpoints IP is "hardcoded" into the terraform client.

3
azureterraformterraform-provider-azure
outdated terrafrom\cli? – 4c74356b41
Terraform v0.12.20 + provider.azurerm v1.44.0 + provider.random v2.2.1 azure-cli (2.0.33) – bayerb
Do you use the CLI inside the VM? How do you use login with CLI? VM identity or service principal? – Charles Xu
@CharlesXu: In the meantime I found out, that removing ARM_USE_MSI=true solves my problem. Anyway, thanks for the help! – bayerb
For me another 'az login' helped – Mateusz Migała

3 Answers

4
votes

Even though I was already logged in via az cli, forcing another:

az login

Resolved this for me.

1
votes

Removing variable

ARM_USE_MSI=true

Solved my problem.

This variable tells terraform to use Managed Service Identity. See the docs. The problem was, that the Azure Instance Metadata service endpoint(available on the above mentioned IP), that is used from that point, is only accessible from within a VM, and I was running the terraform from my desktop.

0
votes
az login --tenant TENANT_ID

resolved by using tenant ID

Initially, I tried to log in with "az login" but got a similar error you posted.