<p>I want to create a cluster inside a VNET, so that later I can create a connection to the on-premise resources.
I have following problem:</p>
<p><code>│ Error: Unsupported argument │ │   on main.tf line 130, in resource &quot;azurerm_kubernetes_cluster&quot; &quot;aks&quot;: │  130:     user_assigned_identity_id = azurerm_user_assigned_identity.identity.id │ │ An argument named &quot;user_assigned_identity_id&quot; is not expected here.</code></p>
<p>My main.tf:</p>
<p>`</p>
<pre><code>data &quot;azurerm_resource_group&quot; &quot;aks-rg&quot; {
  name     = var.resource_group_name
}

resource &quot;azurerm_role_assignment&quot; &quot;role_acrpull&quot; {
  scope                            = azurerm_container_registry.acr.id
  role_definition_name             = &quot;AcrPull&quot;
  principal_id                     = azurerm_kubernetes_cluster.aks.kubelet_identity.0.object_id
  #skip_service_principal_aad_check = true
}

resource &quot;azurerm_container_registry&quot; &quot;acr&quot; {
  name                = var.acr_name
  resource_group_name = data.azurerm_resource_group.aks-rg.name
  location            = var.location
  sku                 = &quot;Standard&quot;
  admin_enabled       = false
}

resource &quot;azurerm_network_security_group&quot; &quot;pusg&quot; {
  name                = &quot;Public_Security_Group&quot;
  location            = var.location
  resource_group_name = data.azurerm_resource_group.aks-rg.name
}

resource &quot;azurerm_virtual_network&quot; &quot;puvnet&quot; {
  name                = &quot;Public_VNET&quot;
  location            = var.location
  resource_group_name = data.azurerm_resource_group.aks-rg.name
  address_space       = [&quot;10.19.0.0/16&quot;]
  dns_servers         = [&quot;10.19.0.4&quot;, &quot;10.19.0.5&quot;]
}

resource &quot;azurerm_subnet&quot; &quot;osubnet&quot; {
  name                 = &quot;Outer_Subnet&quot;
  resource_group_name  = data.azurerm_resource_group.aks-rg.name
  address_prefixes     = [&quot;10.19.1.0/24&quot;]
  virtual_network_name = azurerm_virtual_network.puvnet.name
}

resource &quot;azurerm_subnet&quot; &quot;isubnet&quot; {
  name                 = &quot;Inner_Subnet&quot;
  resource_group_name  = data.azurerm_resource_group.aks-rg.name
  address_prefixes     = [&quot;10.19.2.0/24&quot;]
  virtual_network_name = azurerm_virtual_network.puvnet.name
}

resource &quot;azurerm_subnet&quot; &quot;firewall_subnet&quot; {
  name                 = &quot;AzureFirewallSubnet&quot;
  resource_group_name  = data.azurerm_resource_group.aks-rg.name
  virtual_network_name = azurerm_virtual_network.puvnet.name
  address_prefixes     = [&quot;10.19.3.0/24&quot;]
}

resource &quot;azurerm_user_assigned_identity&quot; &quot;identity&quot; {
  resource_group_name = data.azurerm_resource_group.aks-rg.name
  location            = var.location
  name                = &quot;identityh&quot;
}

resource &quot;azurerm_role_assignment&quot; &quot;networkRole&quot; {
  scope                = data.azurerm_resource_group.aks-rg.id
  role_definition_name = &quot;Network Contributor&quot;
  principal_id         = azurerm_user_assigned_identity.identity.principal_id
}

resource &quot;azurerm_route_table&quot; &quot;routeTable&quot; {
  name                = &quot;rt-FWall&quot;
  location            = var.location
  resource_group_name = data.azurerm_resource_group.aks-rg.name
}

resource &quot;azurerm_route&quot; &quot;route1&quot; {
  name                   = &quot;dg-route1&quot;
  resource_group_name    = data.azurerm_resource_group.aks-rg.name
  route_table_name       = azurerm_route_table.routeTable.name
  address_prefix         = &quot;0.0.0.0/0&quot;
  next_hop_type          = &quot;VirtualAppliance&quot;
  next_hop_in_ip_address = azurerm_firewall.firewall.ip_configuration.0.private_ip_address
}

resource &quot;azurerm_subnet_route_table_association&quot; &quot;base&quot; {
  subnet_id      = azurerm_subnet.osubnet.id
  route_table_id = azurerm_route_table.routeTable.id
}

resource &quot;azurerm_public_ip&quot; &quot;firewall_public_ip&quot; {
  name                = &quot;pip-firewall&quot;
  location            = var.location
  resource_group_name = data.azurerm_resource_group.aks-rg.name
  allocation_method   = &quot;Static&quot;
  sku                 = &quot;Standard&quot;
}

resource &quot;azurerm_firewall&quot; &quot;firewall&quot; {
  name                = &quot;public_firewall&quot;
  location            = var.location
  resource_group_name = data.azurerm_resource_group.aks-rg.name
  sku_name            = &quot;AZFW_VNet&quot;
  sku_tier            = &quot;Standard&quot;

  ip_configuration {
    name                 = &quot;ipconfig&quot;
    subnet_id            = azurerm_subnet.firewall_subnet.id
    public_ip_address_id = azurerm_public_ip.firewall_public_ip.id
  }
}

resource &quot;azurerm_kubernetes_cluster&quot; &quot;aks&quot; {
  name                = var.cluster_name
  kubernetes_version  = var.kubernetes_version
  location            = var.location
  resource_group_name = data.azurerm_resource_group.aks-rg.name
  dns_prefix          = var.cluster_name

  network_profile {
    network_plugin = &quot;azure&quot;
    outbound_type  = &quot;userDefinedRouting&quot;
  }

  default_node_pool {
    name                = &quot;system&quot;
    node_count          = var.system_node_count
    vm_size             = &quot;Standard_DS2_v2&quot;
    vnet_subnet_id = azurerm_subnet.osubnet.id
  }

  identity {
    type                      = &quot;UserAssigned&quot;
    user_assigned_identity_id = azurerm_user_assigned_identity.identity.id
  }
}
</code></pre>
<p>`</p>
<p>Region is Germany West Central. Kubernetes version 1.24.3, Azurerm 3.33, Terraform 1.3</p>
<p>I have tried different approaches I found over internet, but none seemed to work. Best case scenario is when creation takes too long and terraform stops without creating cluster.</p>

<p>That argument does not seem to be a part of the identity block. The argument that can be used inside of the identity block is <code>identity_ids</code> [1]:</p>
<pre><code>resource &quot;azurerm_kubernetes_cluster&quot; &quot;aks&quot; {
  name                = var.cluster_name
  kubernetes_version  = var.kubernetes_version
  location            = var.location
  resource_group_name = data.azurerm_resource_group.aks-rg.name
  dns_prefix          = var.cluster_name

  network_profile {
    network_plugin = &quot;azure&quot;
    outbound_type  = &quot;userDefinedRouting&quot;
  }

  default_node_pool {
    name                = &quot;system&quot;
    node_count          = var.system_node_count
    vm_size             = &quot;Standard_DS2_v2&quot;
    vnet_subnet_id = azurerm_subnet.osubnet.id
  }

  identity {
    type         = &quot;UserAssigned&quot;
    identity_ids = [azurerm_user_assigned_identity.identity.id]
  }
}
</code></pre>
<p>Note that the <code>identity_ids</code> argument is a list, hence the square brackets around the identity.</p>
<hr />
<p>[1] <a href="https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/kubernetes_cluster#identity_ids" rel="nofollow noreferrer">https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/kubernetes_cluster#identity_ids</a></p>
