Terraform配置Azure应用注册时Log Analytics API权限分配报错

通过Terraform创建Azure应用注册、密钥、API权限及角色分配时，Microsoft Graph API权限配置成功，但配置Log Analytics API权限时报错。

期望配置的Log Analytics API权限：

收到的错误信息：

Terraform代码如下：

data "azuread_client_config" "current" {}

data "azuread_application_published_app_ids" "well_known" {}

resource "azuread_service_principal" "msgraph" {
  application_id = data.azuread_application_published_app_ids.well_known.result.MicrosoftGraph
  use_existing   = true
  owners         = [data.azuread_client_config.current.object_id]

}

data "azuread_application_published_app_ids" "log" {}

resource "azuread_service_principal" "LogAnalyticsApi" {
  application_id = data.azuread_application_published_app_ids.log.result.LogAnalyticsAPI
  use_existing   = true
  owners         = [data.azuread_client_config.current.object_id]

}


# Retrieve domain information
data "azuread_domains" "domain" {
  only_initial = true
}

# Create an application
resource "azuread_application" "appreg" {
  display_name     = "Demo_App_Registration_Portal"
  owners           = [data.azuread_client_config.current.object_id]
  sign_in_audience = "AzureADMultipleOrgs"

  required_resource_access {
    resource_app_id = data.azuread_application_published_app_ids.well_known.result.MicrosoftGraph

    resource_access {
      id   = azuread_service_principal.msgraph.app_role_ids["User.Read.All"]
      type = "Role"
    }
    resource_access {
      id   = azuread_service_principal.msgraph.app_role_ids["Directory.Read.All"]
      type = "Role"
    }

    resource_access {
      id   = azuread_service_principal.msgraph.app_role_ids["Domain.Read.All"]
      type = "Role"
    }
    resource_access {
      id   = azuread_service_principal.msgraph.app_role_ids["Domain.ReadWrite.All"]
      type = "Role"
    }


    resource_access {
      id   = azuread_service_principal.msgraph.oauth2_permission_scope_ids["User.Read"]
      type = "Scope"
    }

    resource_access {
      id   = azuread_service_principal.msgraph.oauth2_permission_scope_ids["Domain.ReadWrite.All"]
      type = "Scope"
    }


    #####

    resource_access {
      id   = azuread_service_principal.msgraph.app_role_ids["UserAuthenticationMethod.Read.All"]
      type = "Role"
    }

    #####

  }

  #Log Analytic API Data Read Access

   required_resource_access {
    resource_app_id = data.azuread_application_published_app_ids.log.result.LogAnalyticsAPI

    resource_access {
      id   = azuread_service_principal.LogAnalyticsAPI.app_role_ids["Data.Read"]
      type = "Role"
    }
   }

}

#Creating Client Password for the Application
resource "azuread_application_password" "appregpassword" {
  display_name          = "Demo_App_Registration_Portal_Password"
  application_object_id = azuread_application.appreg.object_id


  depends_on = [
    azuread_application.appreg
  ]

}

output "azuread_application_password" {
  value = azuread_application_password.appregpassword.id

}


# Create a service principal
resource "azuread_service_principal" "appregsp" {
  application_id               = azuread_application.appreg.application_id
  app_role_assignment_required = true
  owners                       = [data.azuread_client_config.current.object_id]
}

resource "azuread_app_role_assignment" "example" {
  app_role_id         = azuread_service_principal.msgraph.app_role_ids["User.Read.All"]
  principal_object_id = azuread_service_principal.appregsp.object_id
  resource_object_id  = azuread_service_principal.msgraph.object_id

}

resource "azuread_app_role_assignment" "Directory" {
  app_role_id         = azuread_service_principal.msgraph.app_role_ids["Directory.Read.All"]
  principal_object_id = azuread_service_principal.appregsp.object_id
  resource_object_id  = azuread_service_principal.msgraph.object_id

}
resource "azuread_app_role_assignment" "Domain-Read" {
  app_role_id         = azuread_service_principal.msgraph.app_role_ids["Domain.Read.All"]
  principal_object_id = azuread_service_principal.appregsp.object_id
  resource_object_id  = azuread_service_principal.msgraph.object_id

}

resource "azuread_app_role_assignment" "Domain-Read-Write" {
  app_role_id         = azuread_service_principal.msgraph.app_role_ids["Domain.ReadWrite.All"]
  principal_object_id = azuread_service_principal.appregsp.object_id
  resource_object_id  = azuread_service_principal.msgraph.object_id


}

####
resource "azuread_app_role_assignment" "UserAuthenticationMethod-Read-All" {
  app_role_id         = azuread_service_principal.msgraph.app_role_ids["UserAuthenticationMethod.Read.All"]
  principal_object_id = azuread_service_principal.appregsp.object_id
  resource_object_id  = azuread_service_principal.msgraph.object_id

}
####

resource "azuread_service_principal_delegated_permission_grant" "example" {
  service_principal_object_id          = azuread_service_principal.appregsp.object_id
  resource_service_principal_object_id = azuread_service_principal.msgraph.object_id
  claim_values                         = ["User.Read", "Domain.ReadWrite.All"]
}

##Log Analytics API Role Assignment
resource "azuread_app_role_assignment" "LogAnalytics-Read" {
  app_role_id         = azuread_service_principal.LogAnalyticsAPI.app_role_ids["Data.Read"]
  principal_object_id = azuread_service_principal.appregsp.object_id
  resource_object_id  = azuread_service_principal.LogAnalyticsAPI.object_id

}


#Role Assigning to the App

data "azurerm_subscription" "primary" {
}

data "azurerm_client_config" "appregclient" {
}

resource "azurerm_role_assignment" "example" {
  scope                = data.azurerm_subscription.primary.id
  role_definition_name = "Reader"
  principal_id         = azuread_service_principal.appregsp.object_id
  depends_on = [
    azuread_application.appreg
  ]

}

关键问题分析 #

1. azuread_application_published_app_ids数据源仅包含微软官方知名应用（如Microsoft Graph），Log Analytics API不在其列表中，无法通过该数据源获取应用ID
2. 目标Data.Read权限属于委托权限（Scope），而非应用角色（Role），原代码错误使用了Role类型和app_role_ids引用

修正后的完整代码 #

data "azuread_client_config" "current" {}

data "azuread_application_published_app_ids" "well_known" {}

resource "azuread_service_principal" "msgraph" {
  application_id = data.azuread_application_published_app_ids.well_known.result.MicrosoftGraph
  use_existing   = true
  owners         = [data.azuread_client_config.current.object_id]
}

# 直接指定Log Analytics API的固定官方应用ID
resource "azuread_service_principal" "LogAnalyticsApi" {
  application_id = "0b07f429-9f4b-4714-9392-cc5e8e80c8b0"
  use_existing   = true
}

# Retrieve domain information
data "azuread_domains" "domain" {
  only_initial = true
}

# Create an application
resource "azuread_application" "appreg" {
  display_name     = "Demo_App_Registration_Portal"
  owners           = [data.azuread_client_config.current.object_id]
  sign_in_audience = "AzureADMultipleOrgs"

  required_resource_access {
    resource_app_id = data.azuread_application_published_app_ids.well_known.result.MicrosoftGraph

    resource_access {
      id   = azuread_service_principal.msgraph.app_role_ids["User.Read.All"]
      type = "Role"
    }
    resource_access {
      id   = azuread_service_principal.msgraph.app_role_ids["Directory.Read.All"]
      type = "Role"
    }

    resource_access {
      id   = azuread_service_principal.msgraph.app_role_ids["Domain.Read.All"]
      type = "Role"
    }
    resource_access {
      id   = azuread_service_principal.msgraph.app_role_ids["Domain.ReadWrite.All"]
      type = "Role"
    }

    resource_access {
      id   = azuread_service_principal.msgraph.oauth2_permission_scope_ids["User.Read"]
      type = "Scope"
    }

    resource_access {
      id   = azuread_service_principal.msgraph.oauth2_permission_scope_ids["Domain.ReadWrite.All"]
      type = "Scope"
    }

    resource_access {
      id   = azuread_service_principal.msgraph.app_role_ids["UserAuthenticationMethod.Read.All"]
      type = "Role"
    }
  }

  # 修正Log Analytics API权限配置：使用Scope类型和正确的权限ID引用
  required_resource_access {
    resource_app_id = "0b07f429-9f4b-4714-9392-cc5e8e80c8b0"

    resource_access {
      id   = azuread_service_principal.LogAnalyticsApi.oauth2_permission_scope_ids["Data.Read"]
      type = "Scope"
    }
  }
}

#Creating Client Password for the Application
resource "azuread_application_password" "appregpassword" {
  display_name          = "Demo_App_Registration_Portal_Password"
  application_object_id = azuread_application.appreg.object_id

  depends_on = [
    azuread_application.appreg
  ]
}

output "azuread_application_password" {
  value = azuread_application_password.appregpassword.id
}

# Create a service principal
resource "azuread_service_principal" "appregsp" {
  application_id               = azuread_application.appreg.application_id
  app_role_assignment_required = true
  owners                       = [data.azuread_client_config.current.object_id]
}

resource "azuread_app_role_assignment" "example" {
  app_role_id         = azuread_service_principal.msgraph.app_role_ids["User.Read.All"]
  principal_object_id = azuread_service_principal.appregsp.object_id
  resource_object_id  = azuread_service_principal.msgraph.object_id
}

resource "azuread_app_role_assignment" "Directory" {
  app_role_id         = azuread_service_principal.msgraph.app_role_ids["Directory.Read.All"]
  principal_object_id = azuread_service_principal.appregsp.object_id
  resource_object_id  = azuread_service_principal.msgraph.object_id
}

resource "azuread_app_role_assignment" "Domain-Read" {
  app_role_id         = azuread_service_principal.msgraph.app_role_ids["Domain.Read.All"]
  principal_object_id = azuread_service_principal.appregsp.object_id
  resource_object_id  = azuread_service_principal.msgraph.object_id
}

resource "azuread_app_role_assignment" "Domain-Read-Write" {
  app_role_id         = azuread_service_principal.msgraph.app_role_ids["Domain.ReadWrite.All"]
  principal_object_id = azuread_service_principal.appregsp.object_id
  resource_object_id  = azuread_service_principal.msgraph.object_id
}

resource "azuread_app_role_assignment" "UserAuthenticationMethod-Read-All" {
  app_role_id         = azuread_service_principal.msgraph.app_role_ids["UserAuthenticationMethod.Read.All"]
  principal_object_id = azuread_service_principal.appregsp.object_id
  resource_object_id  = azuread_service_principal.msgraph.object_id
}

resource "azuread_service_principal_delegated_permission_grant" "example" {
  service_principal_object_id          = azuread_service_principal.appregsp.object_id
  resource_service_principal_object_id = azuread_service_principal.msgraph.object_id
  claim_values                         = ["User.Read", "Domain.ReadWrite.All"]
}

# 替换原app_role_assignment，使用委托权限授予资源分配Log Analytics权限
resource "azuread_service_principal_delegated_permission_grant" "log_analytics" {
  service_principal_object_id          = azuread_service_principal.appregsp.object_id
  resource_service_principal_object_id = azuread_service_principal.LogAnalyticsApi.object_id
  claim_values                         = ["Data.Read"]
}

#Role Assigning to the App
data "azurerm_subscription" "primary" {}

data "azurerm_client_config" "appregclient" {}

resource "azurerm_role_assignment" "example" {
  scope                = data.azurerm_subscription.primary.id
  role_definition_name = "Reader"
  principal_id         = azuread_service_principal.appregsp.object_id
  depends_on = [
    azuread_application.appreg
  ]
}

核心修正点 #

1. 直接使用Log Analytics API的固定应用ID：0b07f429-9f4b-4714-9392-cc5e8e80c8b0
2. 将Log Analytics权限的type从Role改为Scope，并将权限ID引用从app_role_ids改为oauth2_permission_scope_ids
3. 删除错误的azuread_app_role_assignment资源，改用azuread_service_principal_delegated_permission_grant完成委托权限的授予

内容的提问来源于stack exchange，提问作者Mohan Kumar G