azurerm_role_definition - swap to go-azure-sdk

[ziyeqf]

swap from azure-sdk-for-go to go-azure-sdk, keep the same API version.
In next PR, it will be upgraded to 2022-05-01-preview, for feature request.

And one more question is about the id of azurerm_role_definition, I made on #23679 (but removed from it):

The customized resource Id was invovled in #6107, at that time, the resource id set to state file came from Azure, and in some case the scope was not included in the resource ID, e.g: role definition with scope of management group.

But for go-azure-sdk, the id is ScopedRoledefinitionId which always contain a scope, maybe we do not need to use the customized resource Id? If the answer is yes, I will be glad to open another PR to change the resource id.

Test

terraform-provider-azurerm tengzh/rbac/sdk_swap ≡3s 
❯ tftest authorization TestAccRoleDefinition     
=== RUN   TestAccRoleDefinitionDataSource_basic
=== PAUSE TestAccRoleDefinitionDataSource_basic
=== RUN   TestAccRoleDefinitionDataSource_basicByName
=== PAUSE TestAccRoleDefinitionDataSource_basicByName
=== RUN   TestAccRoleDefinitionDataSource_builtIn_contributor
=== PAUSE TestAccRoleDefinitionDataSource_builtIn_contributor
=== RUN   TestAccRoleDefinitionDataSource_builtIn_owner
=== PAUSE TestAccRoleDefinitionDataSource_builtIn_owner
=== RUN   TestAccRoleDefinitionDataSource_builtIn_reader
=== PAUSE TestAccRoleDefinitionDataSource_builtIn_reader
=== RUN   TestAccRoleDefinitionDataSource_builtIn_virtualMachineContributor
=== PAUSE TestAccRoleDefinitionDataSource_builtIn_virtualMachineContributor
=== RUN   TestAccRoleDefinition_basic
=== PAUSE TestAccRoleDefinition_basic
=== RUN   TestAccRoleDefinition_requiresImport
=== PAUSE TestAccRoleDefinition_requiresImport
=== RUN   TestAccRoleDefinition_complete
=== PAUSE TestAccRoleDefinition_complete
=== RUN   TestAccRoleDefinition_update
=== PAUSE TestAccRoleDefinition_update
=== RUN   TestAccRoleDefinition_updateEmptyId
=== PAUSE TestAccRoleDefinition_updateEmptyId
=== RUN   TestAccRoleDefinition_emptyName
=== PAUSE TestAccRoleDefinition_emptyName
=== RUN   TestAccRoleDefinition_emptyPermissions
=== PAUSE TestAccRoleDefinition_emptyPermissions
=== RUN   TestAccRoleDefinition_managementGroup
=== PAUSE TestAccRoleDefinition_managementGroup
=== RUN   TestAccRoleDefinition_assignToSmallerScope
=== PAUSE TestAccRoleDefinition_assignToSmallerScope
=== RUN   TestAccRoleDefinition_noAssignableScope
=== PAUSE TestAccRoleDefinition_noAssignableScope
=== CONT  TestAccRoleDefinitionDataSource_basic
=== CONT  TestAccRoleDefinition_complete
=== CONT  TestAccRoleDefinition_emptyPermissions
=== CONT  TestAccRoleDefinition_requiresImport
=== CONT  TestAccRoleDefinition_assignToSmallerScope
=== CONT  TestAccRoleDefinition_noAssignableScope
=== CONT  TestAccRoleDefinitionDataSource_builtIn_reader
=== CONT  TestAccRoleDefinitionDataSource_basicByName
--- PASS: TestAccRoleDefinitionDataSource_builtIn_reader (20.41s)
=== CONT  TestAccRoleDefinition_managementGroup
    testcase.go:113: Step 1/2 error: Error running apply: exit status 1
        
        Error: unable to create Management Group "e271adc4-1e3b-4e42-a376-3cfafc1a2eba": managementgroups.Client#CreateOrUpdate: Failure sending request: StatusCode=400 -- Original Error: Code="BadRequest" Message="Permission to Microsoft.Management/managementGroups on resources of type 'Write' is required on the management group or its ancestors." Details=[{"raw":"Management Group ID: '/providers/Microsoft.Management/managementGroups/72f988bf-86f1-41af-91ab-2d7cd011db47'"}]
        
          with azurerm_management_group.test,
          on terraform_plugin_test.tf line 24, in resource "azurerm_management_group" "test":
          24: resource "azurerm_management_group" "test" {
        
--- FAIL: TestAccRoleDefinition_managementGroup (11.76s)
=== CONT  TestAccRoleDefinition_updateEmptyId
--- PASS: TestAccRoleDefinition_requiresImport (237.98s)
=== CONT  TestAccRoleDefinition_emptyName
--- PASS: TestAccRoleDefinition_emptyPermissions (323.85s)
=== CONT  TestAccRoleDefinition_basic
--- PASS: TestAccRoleDefinition_assignToSmallerScope (327.99s)
=== CONT  TestAccRoleDefinition_update
--- PASS: TestAccRoleDefinitionDataSource_basic (387.61s)
=== CONT  TestAccRoleDefinitionDataSource_builtIn_virtualMachineContributor
--- PASS: TestAccRoleDefinitionDataSource_builtIn_virtualMachineContributor (17.68s)
=== CONT  TestAccRoleDefinitionDataSource_builtIn_owner
--- PASS: TestAccRoleDefinitionDataSource_builtIn_owner (17.12s)
=== CONT  TestAccRoleDefinitionDataSource_builtIn_contributor
--- PASS: TestAccRoleDefinitionDataSource_builtIn_contributor (20.01s)
--- PASS: TestAccRoleDefinition_complete (454.16s)
--- PASS: TestAccRoleDefinition_emptyName (236.10s)
--- PASS: TestAccRoleDefinition_noAssignableScope (485.73s)
--- PASS: TestAccRoleDefinitionDataSource_basicByName (562.71s)
--- PASS: TestAccRoleDefinition_updateEmptyId (595.59s)
--- PASS: TestAccRoleDefinition_basic (321.54s)
--- PASS: TestAccRoleDefinition_update (673.80s)
FAIL
FAIL	github.com/hashicorp/terraform-provider-azurerm/internal/services/authorization	1001.871s
FAIL

rerun the failed one on another subscription

terraform-provider-azurerm tengzh/rbac/sdk_swap*​ ≡
❯ tftest authorization TestAccRoleDefinition_managementGroup
=== RUN   TestAccRoleDefinition_managementGroup
=== PAUSE TestAccRoleDefinition_managementGroup
=== CONT  TestAccRoleDefinition_managementGroup
--- PASS: TestAccRoleDefinition_managementGroup (703.00s)
PASS
ok  	github.com/hashicorp/terraform-provider-azurerm/internal/services/authorization	703.059s

azurerm_role_assignment also affected

[magodo]

Can we be more specific here that the modification is needed to workaround the issue: hashicorp/pandora#3257 for roledefinitions.ParseScopedRoleDefinitionID for the roles assigned at the tenant level (both for tenant scope and mgmt group scope)?

[ziyeqf]

I believe the CI failure is not caused by this PR..

[magodo]

LGTM!

[tombuildsstuff]

Can we remove the workaround, since this is no longer needed?

[tombuildsstuff]

These fields are available in the newer API version which is already used by the Provider - as such I believe this workaround is no longer needed?

[ziyeqf]

I planed to remove them in another PR, and do the API version upgrade at that PR, how do you think?

[mbfrahry]

LGTM! thanks for this @ziyeqf

[github-actions]

I'm going to lock this pull request because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active contributions.
If you have found a problem that seems related to this change, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.