provider = "azuredns" is less debuggable than provider = "azure"

[stdedos]

I am relatively new to Terraform / ACME / Lego, so this doubles as a newcomer DX report.

I have been trying to use the azuredns provider for several days, getting:

│ [some.domain.name.com] [some.domain.name.com] acme: error presenting token: 2 errors occurred:
│ 	* rpc error: code = Unknown desc = azuredns: could not find zone (from discovery): domain.name.com
│ 	* error encountered while presenting token for DNS challenge: rpc error: code = Unknown desc = azuredns: could not find zone (from discovery): domain.name.com

│ [some.domain.name.com] [some.domain.name.com] acme: error presenting token: 2 errors occurred:
│ 	* rpc error: code = Unknown desc = azuredns: could not find zone (from discovery): domain.name.com
│ 	* error encountered while presenting token for DNS challenge: rpc error: code = Unknown desc = azuredns: could not find zone (from discovery): domain.name.com

I was confident my credentials had access -- the same identity creates azurerm_dns_a_record resources in the same plan. I tried everything I could think of before switching to the deprecated azure provider as the only solution.

With this simple change:

@@ -29,12 +46,14 @@ resource "acme_certificate" "some" {
   certificate_p12_password = ""
 
   dns_challenge {
-    provider = "azuredns"
+    provider = "azure"
     config = {
+      LEGO_AZURE_BYPASS_DEPRECATION = "true"
       AZURE_CLIENT_ID       = local.arm_bridge["client_id"]
       AZURE_CLIENT_SECRET   = local.arm_bridge["client_secret"]
       AZURE_TENANT_ID       = local.arm_bridge["tenant_id"]
       AZURE_SUBSCRIPTION_ID = data.azurerm_subscription.current.subscription_id
       AZURE_RESOURCE_GROUP  = var.dns_zone.resource_group_name
       AZURE_ZONE_NAME       = var.dns_zone.name
     }

The real problem was immediately surfaced:

│ [some.domain.name.com] [some.domain.name.com] acme: error presenting token: 2 errors occurred:
│ 	* rpc error: code = Unknown desc = azure: dns.RecordSetsClient#Get: Failure responding to request: StatusCode=403 -- Original Error: autorest/azure: Service returned an error. Status=403 Code="AuthorizationFailed"                                                             Message="The client '2c1d6411-fe6f-491f-9d60-df0ef7dd93e0' with object id 'b658beaa-e710-4392-b6cf-1e3e14d0e985' does not have authorization to perform action 'Microsoft.Network/dnsZones/TXT/read' over scope '/subscriptions/1bacb854-5f88-432f-8e20-2e3eb97b4058/resourceGroups/system_team/providers/Microsoft.Network/dnsZones/domain.name.com/TXT/_acme-challenge.validation-service' or the scope is invalid. If access was recently granted, please refresh your credentials."
│ 	* error encountered while presenting token for DNS challenge: rpc error: code = Unknown desc = azure: dns.RecordSetsClient#Get: Failure responding to request: StatusCode=403 -- Original Error: autorest/azure: Service returned an error. Status=403 Code="AuthorizationFailed" Message="The client '2c1d6411-fe6f-491f-9d60-df0ef7dd93e0' with object id 'b658beaa-e710-4392-b6cf-1e3e14d0e985' does not have authorization to perform action 'Microsoft.Network/dnsZones/TXT/read' over scope '/subscriptions/1bacb854-5f88-432f-8e20-2e3eb97b4058/resourceGroups/system_team/providers/Microsoft.Network/dnsZones/domain.name.com/TXT/_acme-challenge.validation-service' or the scope is invalid. If access was recently granted, please refresh your credentials."

which lead to

@@ -29,12 +46,14 @@ resource "acme_certificate" "some" {
   certificate_p12_password = ""
 
   dns_challenge {
-    provider = "azuredns"
+    provider = "azure"
     config = {
+      LEGO_AZURE_BYPASS_DEPRECATION = "true"
       AZURE_CLIENT_ID       = local.arm_bridge["client_id"]
       AZURE_CLIENT_SECRET   = local.arm_bridge["client_secret"]
       AZURE_TENANT_ID       = local.arm_bridge["tenant_id"]
       AZURE_SUBSCRIPTION_ID = data.azurerm_subscription.current.subscription_id
+       ARM_SUBSCRIPTION_ID  = data.azurerm_subscription.current.subscription_id
       AZURE_RESOURCE_GROUP  = var.dns_zone.resource_group_name
       AZURE_ZONE_NAME       = var.dns_zone.name
     }

immediately working (This is also because of a "known issue" in vancluever/terraform-provider-acme#428)

So the underlying issue: azuredns zone discovery swallows HTTP 403 and reports it as "could not find zone." The azure provider surfaces the actual status code. This made a 5-minute fix into a multi-day debugging session.

Request: Could zone discovery in azuredns surface the actual HTTP error (or at least log it) instead of collapsing it into the generic "could not find zone" message?

PS: I am using https://github.com/vancluever/terraform-provider-acme, but I believe the error originates in lego. Let me know if this should be filed elsewhere.

[ldez]

There are several differences between the 2 implementations.
The main one is not related to lego but to azure sdk: the azure uses the old, archived SDK.

The 2 SDKs don't work in the same way, and I cannot change that.

All the available information are displayed when we have them, but in this case there is no information available.

[stdedos]

The gist of the issue is

Message="The client '2c1d6411-fe6f-491f-9d60-df0ef7dd93e0' with object id 'b658beaa-e710-4392-b6cf-1e3e14d0e985' does not have authorization to perform action 'Microsoft.Network/dnsZones/TXT/read' over scope '/subscriptions/1bacb854-5f88-432f-8e20-2e3eb97b4058/resourceGroups/system_team/providers/Microsoft.Network/dnsZones/domain.name.com/TXT/_acme-challenge.validation-service' or the scope is invalid.

If I knew that the "new" SDK was using 1bacb854-5f88-432f-8e20-2e3eb97b4058 (instead of the correct one), I would've spotted the problem. Anyway the subscription UUID is not private information.

(or that ARM_SUBSCRIPTION_ID trumps AZURE_SUBSCRIPTION_ID even if AZURE_SUBSCRIPTION_ID is given at the input, but that's vancluever/terraform-provider-acme#428)

[ldez]

The new SDK works completely differently, the design is completely different.
The requests are not done in the same order than before because of that.

I'm not a magician: the Azure environment is a configuration hell, the Azure SDK is also a hell to use.

There is neither hidden error nor hidden details: lego displays all the available information inside the errors.

[stdedos]

Of course, of course - I am not saying that anything is done wrong, or intentionally 😅

But if it is hell for you, imagine a newbie, shouting "Eureka!" for the first time!
... regardless of how otherwise nonsense it is 😅

Thank you for your time, patience, and quick response 😊