Race condition with msi.UserAssignedIdentity and role.Assignment

[mpp-oliverh]

If I create a new UserAssignedIdentity then immediately try to assign it a role it complains that the principalId doesn't exist in the directory.

I assume this is a bug / peculiarity with Azure itself because the dependency chain looks fine... is there a way of working around this?

Thanks,

export function createManagedIdentity(
    name: string,
    resourceGroup: azure.core.ResourceGroup,
    location: string | Output<string>
) {
    const azIdentity = new azure.msi.UserAssignedIdentity(
        `msi-${name}`,
        {
            name: `msi-${name}`,
            location: location,
            resourceGroupName: resourceGroup.name
        }
    );
    return {
        identity: azIdentity
    }
}

    const name = "app";
    const msi = createManagedIdentity(name, resourceGroup, config.location);

    new azure.role.Assignment(`${name}-kv-role`, {
        principalId: msi.identity.principalId,
        scope: keyVault.id,
        roleDefinitionName: "Reader"
    });

2018-11-08T15:36:56.3485999Z  +  azure:msi:UserAssignedIdentity msi-app creating 
2018-11-08T15:36:57.8096273Z  +  azure:msi:UserAssignedIdentity msi-app created 
2018-11-08T15:36:58.0442362Z  +  azure:role:Assignment app-kv-role creating 
2018-11-08T15:37:00.1007517Z  +  azure:role:Assignment app-kv-role creating error: Plan apply failed: authorization.RoleAssignmentsClient#Create: Failure responding to request: StatusCode=400 -- Original Error: autorest/azure: Service returned an error. Status=400 Code="PrincipalNotFound" Message="Principal 12bd9f9c9c1541b8a727c892ed19e1f2 does not exist in the directory ***."
2018-11-08T15:37:00.1014845Z  +  azure:role:Assignment app-kv-role **creating failed** error: Plan apply failed: authorization.RoleAssignmentsClient#Create: Failure responding to request: StatusCode=400 -- Original Error: autorest/azure: Service returned an error. Status=400 Code="PrincipalNotFound" Message="Principal 12bd9f9c9c1541b8a727c892ed19e1f2 does not exist in the directory ***."

[mpp-oliverh]

I should add that when I ran pulumi up the second time it worked fine.

[lukehoban]

This looks like the same issue as #103, which is itself ultimately https://github.com/terraform-providers/terraform-provider-azurerm/issues/1635 in the upstream Terraform AzureRM provider. As soon as that issue is fixed and merged, we'll bring it into the @pulumi/azure provider.

[lukehoban]

Actually - appears this was just fixed a couple days ago - and will be in the next release: hashicorp/terraform-provider-azurerm#2204