How to fix unable to build authorizer for Resource Manager API in Terraform

First, check if Azure CLI is installed and accessible from your terminal:

az version

If this command returns version information, Azure CLI is installed. If you get "command not found", install Azure CLI following the official guide at https://learn.microsoft.com/en-us/cli/azure/install-azure-cli.

After installation, verify it's in your system PATH by running the command again.

Run az login to authenticate your Azure session:

az login

This opens a browser window to sign in to your Azure account. After successful login, set your default subscription:

az account set --subscription "Your-Subscription-ID"

Verify you're logged in and the subscription is set:

az account show

This should display your account information and current subscription ID.

If you're using service principal credentials (client ID, client secret, tenant ID) instead of interactive login, explicitly disable CLI authentication in your Terraform provider block:

provider "azurerm" {
  features {}

  subscription_id = var.subscription_id
  tenant_id       = var.tenant_id
  client_id       = var.client_id
  client_secret   = var.client_secret
  use_cli         = false  # Explicitly disable CLI authentication
}

The use_cli = false flag tells Terraform to use the provided credentials instead of trying to use Azure CLI.

For GitHub Actions, GitLab CI, or other CI/CD systems, use OIDC (OpenID Connect) authentication instead of storing secrets. Configure your provider without credentials:

provider "azurerm" {
  features {}

  subscription_id = var.subscription_id
  tenant_id       = var.tenant_id
  client_id       = var.client_id
  use_oidc        = true  # Enable OIDC
}

Then set these environment variables in your CI/CD system:

export ARM_USE_OIDC=true
export ARM_OIDC_TOKEN_FILE_PATH=/tmp/oidc.token  # Token path varies by CI system
export ARM_CLIENT_ID=your-client-id
export ARM_TENANT_ID=your-tenant-id
export ARM_SUBSCRIPTION_ID=your-subscription-id

This approach avoids storing secrets and doesn't require Azure CLI in your CI environment.

If using service principal credentials with environment variables instead of provider configuration:

export ARM_CLIENT_ID=your-client-id
export ARM_CLIENT_SECRET=your-client-secret
export ARM_SUBSCRIPTION_ID=your-subscription-id
export ARM_TENANT_ID=your-tenant-id
export ARM_USE_CLI=false  # Disable CLI authentication

Then configure your provider minimally:

provider "azurerm" {
  features {}
}

Terraform will automatically use the environment variables, and the ARM_USE_CLI=false setting prevents it from attempting Azure CLI authentication.

If you need an immediate workaround and cannot modify authentication configuration, you can temporarily downgrade to azurerm provider version 3.43 or earlier:

terraform {
  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "~> 3.43"
    }
  }
}

However, this is only a temporary solution. Upgrade to the latest provider version and follow steps 3-5 to properly configure authentication.