New azd login flow and provisioning via Terraform

[lechnerc77]

We tried the azd with the new logon flow (no Azure CLI) and tried to provision the infrastructure via Terraform.
Doing so results in an error message stating that the Azure CLI is needed:

Is there any additional configuration that we need to apply so that the azd-only login flow is used when providing the infrastructure via Terraform? Or do we have to switch to the fallback to Azure CLI for login?

Using .bicep works with the known limitations i.e. for an organizational Azure account.

[rajeshkamal5050]

@lechnerc77 Yes, in order to run Terraform IaC based templates. You still need Az CLI. This is because of the underlying Terraform CLI implementation requiring Az CLI as a dependency for its execution.

Is there any additional configuration that we need to apply so that the azd-only login flow is used when providing the infrastructure via Terraform? Or do we have to switch to the fallback to Azure CLI for login?

I believe you might have to fallback to Az CLI for login and run it.
@wbreza @ellismg or do we have any other options so that only azd provisioning runs using Az CLI?

[ellismg]

The issues is that the AzureRM terraform provider uses the AZ CLI by default for authentication. There are other methods that can be used (the terraform documentation is here but they all require some additional effort from the user (e.g. creating a service principal).

If we want to be able to have terraform use the identity of the logged in user, I think what we would need to do is run them in a way such that we exploit the fact that the AzureRM provider can use something like MSI and have us expose an MSI compatible endpoint that it uses to delegate auth back to azd.

[lechnerc77]

Thanks for the answers and explanations. Will adjust my repo accordingly.