Merge pull request #2204 from liemnotliam/role-assignment-retry

Role assignment retry for service principal

azurerm/resource_arm_role_assignment.go

@@ -186,17 +186,19 @@ func retryRoleAssignmentsClient(scope string, name string, properties authorizat
 		roleAssignmentsClient := meta.(*ArmClient).roleAssignmentsClient
 		ctx := meta.(*ArmClient).StopContext
 
-		_, err := roleAssignmentsClient.Create(ctx, scope, name, properties)
-
+		resp, err := roleAssignmentsClient.Create(ctx, scope, name, properties)
 		if err != nil {
 			if utils.ResponseErrorIsRetryable(err) {
 				return resource.RetryableError(err)
-			} else {
-				return resource.NonRetryableError(err)
+			} else if resp.Response.StatusCode == 400 && strings.Contains(err.Error(), "PrincipalNotFound") {
+				// When waiting for service principal to become available
+				return resource.RetryableError(err)
 			}
+
+			return resource.NonRetryableError(err)
 		}
-		return nil
 
+		return nil
 	}
 }
 

azurerm/resource_arm_role_assignment_test.go

@@ -22,6 +22,9 @@ func TestAccAzureRMRoleAssignment(t *testing.T) {
 			"builtin":     testAccAzureRMRoleAssignment_builtin,
 			"custom":      testAccAzureRMRoleAssignment_custom,
 		},
+		"assignment": {
+			"sp": testAccAzureRMActiveDirectoryServicePrincipal_roleAssignment,
+		},
 	}
 
 	for group, m := range testCases {
@@ -218,6 +221,31 @@ func testCheckAzureRMRoleAssignmentDestroy(s *terraform.State) error {
 	return nil
 }
 
+func testAccAzureRMActiveDirectoryServicePrincipal_roleAssignment(t *testing.T) {
+	resourceName := "azurerm_azuread_service_principal.test"
+
+	ri := acctest.RandInt()
+	id := uuid.New().String()
+	config := testAccAzureRMActiveDirectoryServicePrincipal_roleAssignmentConfig(ri, id)
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testCheckAzureRMActiveDirectoryServicePrincipalDestroy,
+		Steps: []resource.TestStep{
+			{
+				Config: config,
+				Check: resource.ComposeTestCheckFunc(
+					testCheckAzureRMActiveDirectoryServicePrincipalExists(resourceName),
+					testCheckAzureRMRoleAssignmentExists("azurerm_role_assignment.test"),
+					resource.TestCheckResourceAttrSet(resourceName, "display_name"),
+					resource.TestCheckResourceAttrSet(resourceName, "application_id"),
+				),
+			},
+		},
+	})
+}
+
 func testAccAzureRMRoleAssignment_emptyNameConfig() string {
 	return `
 data "azurerm_subscription" "primary" {}
@@ -315,3 +343,24 @@ resource "azurerm_role_assignment" "test" {
 }
 `, roleDefinitionId, rInt, roleAssignmentId)
 }
+
+func testAccAzureRMActiveDirectoryServicePrincipal_roleAssignmentConfig(rInt int, roleAssignmentID string) string {
+	return fmt.Sprintf(`
+data "azurerm_subscription" "current" {}
+
+resource "azurerm_azuread_application" "test" {
+  name     = "acctestspa-%d"
+}
+
+resource "azurerm_azuread_service_principal" "test" {
+  application_id = "${azurerm_azuread_application.test.application_id}"
+}
+
+resource "azurerm_role_assignment" "test" {
+  name                 = "%s"
+  scope                = "${data.azurerm_subscription.current.id}"
+  role_definition_name = "Reader"
+  principal_id         = "${azurerm_azuread_service_principal.test.id}"
+}
+`, rInt, roleAssignmentID)
+}