[HOWTO] Fix “Please run ‘az login’ to setup account” error caused by local-exec when executing terraform apply through TerraformCLI task in Azure DevOps pipeline

Last week I discovered the following error in the logs of an Azure DevOps YAML pipeline run.

null_resource.sql_db_initialization (local-exec): ERROR: Please run 'az login' to setup account.

The pipeline task that logged this error message is a task of type TerraformCLI from the Azure Pipelines Terraform Tasks extension which executes the command terraform apply.

        - task: TerraformCLI@1
          displayName: Terraform apply
          inputs:
            command: apply
            commandOptions: -auto-approve -var-file="./vars/${{parameters.backendName}}.${{parameters.environmentCode}}.tfvars"
            environmentServiceName: ${{parameters.serviceConnectionName}}
            workingDirectory: "$(System.DefaultWorkingDirectory)/deploy/iac"

The terraform configuration contains a null_resource resource definition with a local-exec provisioner that executes a PowerShell script.

resource "null_resource" "sql_db_initialization" {
  triggers = {
    sqldb                 = azurerm_mssql_database.sqldb.id
    sqldb_read            = azuread_group.perm_sqldb_read.id
    sqldb_readwrite       = azuread_group.perm_sqldb_readwrite.id
  }

  provisioner "local-exec" {
    command     = ".\\Initialize-SqlDatabase.ps1 -ServerInstance \"tcp:${azurerm_mssql_server.sql.name}.database.windows.net,1433\" -Database ${azurerm_mssql_database.sqldb.name} -ReadGroupName ${format("pm-%s-%s-read", local.sql_srv_name, local.sql_db_name)} -ReadWriteGroupName ${format("pm-%s-%s-readwrite", local.sql_srv_name, local.sql_db_name)}"
    interpreter = ["pwsh", "-Command"]
  }

  depends_on = [
    azurerm_mssql_database.sqldb,
    azuread_group.perm_sqldb_read,
    azuread_group.perm_sqldb_readwrite,
  ]
}

The PowerShell script Initialize-SqlDatabase.ps1 executes the Azure CLI command az account get-access-token which was the root cause for the error.

# get token from current az cli context
$access_token = (az account get-access-token --resource=https://database.windows.net --query accessToken --output tsv)

Interestingly, the Azure DevOps pipeline task was nevertheless successful… I only noticed the error because I had noticed that the changes to the PowerShell script were not applied to the database.

After some investigation and research, I found the section Execute Azure CLI From Local-Exec Provisioner in the overview of the Azure Pipelines Terraform Tasks Extension.

Setting runAzLogin to true fixed the problem!

        - task: TerraformCLI@1
          displayName: Terraform apply
          inputs:
            command: apply
            commandOptions: -auto-approve -var-file="./vars/${{parameters.backendName}}.${{parameters.environmentCode}}.tfvars"
            environmentServiceName: ${{parameters.serviceConnectionName}}
            workingDirectory: "$(System.DefaultWorkingDirectory)/deploy/iac"
            runAzLogin: true