Terraform Version

1.11.0

Terraform Configuration Files

providers.tf

  backend "azurerm" {
    subscription_id      = xxx
    resource_group_name  = yyy
    storage_account_name = zzz
    container_name       = ...
    key                  = "terraform.tfstate"
    use_azuread_auth     = true
  }
}

env vars set in my github actions workflow:

  ARM_CLIENT_ID: ${{vars.AZURE_OIDC_CLIENT_ID}}
  ARM_USE_OIDC: true
  ARM_TENANT_ID: ${{vars.TENANT_ID}}

Debug Output

Error: retrieving Storage Account (Subscription: "xxxxxxxx"
Resource Group Name: yyyyyy"
Storage Account Name: "aaaaa"): unexpected status 403 (403 Forbidden) with error: AuthorizationFailed: The client '.... does not have authorization to perform action 'Microsoft.Storage/storageAccounts/read' over scope `resourceid to storage account `or the scope is invalid. If access was recently granted, please refresh your credentials.

Expected Behavior

OIDC authentication towards azurerm backend should work without breaking changes

Actual Behavior

Seems that this PR broke OIDC auth towards azurerm backends(?) and the release notes do not mention breaking changes.
#36258

It is not immediately obvious how to fix this apart from downgrading to version 1.10.x

Steps to Reproduce

terraform init

Additional Context

No response

References

No response

Generative AI / LLM assisted development?

No response