Incorrect rights and GUID for terraform registration for AAD role
Script common_prepare.sh use a hardcoded GUID value for assigning Application.ReadWrite.OwnedBy (824c81eb-e3f8-4ee6-8f6d-de7f50d565b7) which is invalid.
Moreover even if granting terraform app registration Application.ReadWrite.OwnedBy. The deployment fails with this error:
module.graph_account.azurerm_cosmosdb_gremlin_database.cosmos_dbs[0]: Creation complete after 36s [id=/subscriptions/797a3722-248f-4a96-99b4-25dc6afd2a32/resourceGroups/osdu-mvp-crpriv3-c5mq-rg/providers/Microsoft.DocumentDB/databaseAccounts/osdu-mvp-crpriv3-c5mq-graph/gremlinDatabases/osdu-graph]
module.graph_account.azurerm_cosmosdb_gremlin_graph.cosmos_graphs[0]: Creating...
module.graph_account.azurerm_cosmosdb_gremlin_graph.cosmos_graphs[0]: Still creating... [10s elapsed]
module.graph_account.azurerm_cosmosdb_gremlin_graph.cosmos_graphs[0]: Still creating... [20s elapsed]
module.graph_account.azurerm_cosmosdb_gremlin_graph.cosmos_graphs[0]: Still creating... [30s elapsed]
module.graph_account.azurerm_cosmosdb_gremlin_graph.cosmos_graphs[0]: Creation complete after 37s [id=/subscriptions/797a3722-248f-4a96-99b4-25dc6afd2a32/resourceGroups/osdu-mvp-crpriv3-c5mq-rg/providers/Microsoft.DocumentDB/databaseAccounts/osdu-mvp-crpriv3-c5mq-graph/gremlinDatabases/osdu-graph/graphs/Entitlements]
╷
│ Error: Adding password for application with object ID "bba42f65-4c1d-438a-9458-54baf6ce4fc3"
│
│ with module.ad_application.azuread_application_password.main[0],
│ on ../../../modules/providers/azure/ad-application/main.tf line 98, in resource "azuread_application_password" "main":
│ 98: resource "azuread_application_password" "main" {
│
│ ApplicationsClient.BaseClient.Post(): unexpected status 403 with OData error: Authorization_RequestDenied: Insufficient privileges to complete the operation.
╵
After testing minimal rights needed is Application.ReadWrite.All and we weren't able to narrow it down to Application.ReadWrite.OwnedBy.
I need to note that this contradicts Microsoft documentation for the azure ad terraform module. At the moment of writing the note of this rights can be found in README.md file in under infra\modules\providers\azure\ad-application\README.md (after downloading the module).
Edited by Paweł Grudzień