Running Azure AZ login command with Terraform - bash

Question

Issue:
I am trying to execute a bash script in Terraform and its throwing an error
Environment: I am running Terraform in VScode (terminal is bash) on Windows 10.
I've also tried running in standard git bash command terminal and it throws same error.
I've also tried replacing 'program = ["bash",' with 'program = ["az",' but still throws error.
my bash script
#!/bin/bash
# Exit if any of the intermediate steps fail
set -e
# Login
az login --service-principal -u "${ARM_CLIENT_ID}" -p "${ARM_CLIENT_SECRET}" --tenant "${ARM_TENANT_ID}" >/dev/null
# Extract the query json into variables
eval "$(jq -r '#sh "SUBSCRIPTION_NAME=\(.subscription_name)"')"
# Get the subscription id and pass back map
az account list --query "[?name == '${SUBSCRIPTION_NAME}'].id | {id: join(', ', #)}" --output json
my main.tf file
locals {
access_levels = ["read", "write"]
subscription_name = lower(var.subscription_name)
}
# lookup existing subscription
data "azurerm_subscription" "current" {}
# Lookup Subscription
data "external" "lookupByName" {
# Looks up a subscription by its display name and returns id
program = ["bash", "${path.module}/scripts/lookupByName.sh"]
query = {
subscription_name = local.subscription_name
}
}
throws error after running 'terraform plan'
The refreshed state will be used to calculate this plan, but will not be
persisted to local or remote state storage.
data.external.lookupByName: Refreshing state...
data.azurerm_subscription.current: Refreshing state...
Error: failed to execute "bash": usage: az login [-h] [--verbose] [--debug] [--only-show-errors]
[--output {json,jsonc,yaml,yamlc,table,tsv,none}]
[--query JMESPATH] [--username USERNAME] [--password PASSWORD]
[--service-principal] [--tenant TENANT]
[--allow-no-subscriptions] [-i] [--use-device-code]
[--use-cert-sn-issuer]
az login: error: Expecting value: line 1 column 1 (char 0)
on main.tf line 10, in data "external" "lookupByName":
10: data "external" "lookupByName" {

Answer 1

I suppose that you are using Windows Subsystem for Linux (WSL) in Windows 10. From your commend, without hardcoding the ARM_CLIENT_SECRET as a variable, you can store the credentials as Environment Variables in WSL like this:
$ export ARM_CLIENT_ID="00000000-0000-0000-0000-000000000000"
$ export ARM_CLIENT_SECRET="00000000-0000-0000-0000-000000000000"
$ export ARM_TENANT_ID="00000000-0000-0000-0000-000000000000"
You could read Configuring the Service Principal in Terraform for more details.
However, the environment variable is temporarily valid in the current session in this way. If you want to permanently store its value, you can use a share WSLENV environment variables between Windows and WSL. Starting in 17063, WSLENV begins being supported. WSLENV is case sensitive.
For example,
Firstly, you could set the environment variables in Windows 10,
Secondly, set the WSLENV variable in the CMD.
C:\WINDOWS\system32>setx WSLENV ARM_TENANT_ID/u:ARM_CLIENT_ID/u:ARM_CLIENT_SECRET/u
SUCCESS: Specified value was saved.
Thirdly, re-start your VS code, you could check the current WSL environment variable with export.
At last, you should run terraform plan without such error in WSL in VScode.
For more information, you could refer to the following document,
https://learn.microsoft.com/en-us/windows/wsl/interop
https://devblogs.microsoft.com/commandline/share-environment-vars-between-wsl-and-windows/