azuread_access_package_resource_catalog_association runs in 400 The specified resource is already onboarded to ELM

[cveld]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritise this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritise the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform (and AzureAD Provider) Version

Terraform v1.14.7
on windows_amd64

• provider registry.terraform.io/hashicorp/azuread v3.8.0
• provider registry.terraform.io/hashicorp/azurerm v4.68.0

Affected Resource(s)

• azuread_access_package_resource_catalog_association

Terraform Configuration Files

# Copy-paste your Terraform configurations here - for large Terraform configs,
# please use a service like Dropbox and share a link to the ZIP file. For
# security, you can also encrypt the files using our GPG public key: https://keybase.io/hashicorp

resource "azuread_access_package_resource_catalog_association" "group" {
  for_each = { for k, v in local.access_package_catalog_associations : k => v if !try(var.groups[v.group_key].use_existing, false) }

  catalog_id = coalesce(
    try(azuread_access_package_catalog.this[each.value.catalog_key].id, null),
    try(data.azuread_access_package_catalog.this[each.value.catalog_key].id, null)
  )
  resource_origin_id = coalesce(
    each.value.object_id,
    try(azuread_group.this[each.value.group_key].object_id, null),
    try(data.azuread_group.this[each.value.group_key].object_id, null),
    try(azuread_group_without_members.this[each.value.group_key].object_id, null),
    try(var.external_groups[each.value.group_key], null)
  )
  resource_origin_system = "AadGroup"
}

Debug Output

Panic Output

Expected Behavior

The resource should be associated with the access package catalog without errors.

Actual Behavior

We provisioned few resources (entra groups) to a catalog, and 1 of these errored out with this 400 error.

400 The specified resource is already onboarded to ELM

Perhaps it is just flaky behavior of the upstream Microsoft Graph API but who knows. At least this issue can be used as a central spot where people can add their related experiences.

Steps to Reproduce

1. terraform apply

Important Factoids

References

• #0000