<p>Not sure why terraform will not accept the following code below. I keep getting the block is not  expected here error. Please see below main.tf and vairable.tf</p>
<p>Azure Kubernetes cluster =&gt; unsupported block type error</p>
<p>ERROR MESSAGE</p>
<p>az terraform error blocks of type &quot;role_based_access_control&quot; are not expected here.
az terraform error blocks of type &quot;addon_profile&quot; are not expected here.</p>
<pre><code>### MAIN.TF
# Configure the Azure Provider
terraform {
  required_providers {
    azurerm = {
      source = &quot;hashicorp/azurerm&quot;
      version = &quot;&gt;= 2.26&quot;
    }
  }

  backend &quot;azurerm&quot; {
    resource_group_name   = &quot;rg-eastus-services-terraform&quot;
    storage_account_name  = &quot;cchmceuststate9824&quot;
    container_name        = &quot;tfstate&quot;
    key                   = &quot;aks-roadmab.dev.terraform03.tfstate&quot;
  }
}

# Providers

provider &quot;azurerm&quot; {
  features {}
}

# Resource group reference
data &quot;azurerm_resource_group&quot; &quot;example&quot; {
  name     = var.resourcegroup
}

# Resources

resource &quot;azurerm_log_analytics_workspace&quot; &quot;aks&quot; {
  name                = &quot;${var.prefix}-logA-ws&quot;
  location            = data.azurerm_resource_group.example.location
  resource_group_name = data.azurerm_resource_group.example.name
  sku                 = &quot;PerGB2018&quot;
  retention_in_days   = 30
}

resource &quot;azurerm_kubernetes_cluster&quot; &quot;example&quot; {
  name                = var.aksname
  location            = data.azurerm_resource_group.example.location
  resource_group_name = data.azurerm_resource_group.example.name
  dns_prefix          = var.prefix
  kubernetes_version  = var.kubernetes_version
  azure_policy_enabled = true

  default_node_pool {
    name       = &quot;default&quot;
    node_count = 2
    vm_size    = &quot;Standard_D2s_v3&quot;
    enable_auto_scaling = true
    min_count           = &quot;2&quot;
    max_count           = &quot;3&quot;
    os_disk_size_gb     = 30
    type                = &quot;VirtualMachineScaleSets&quot;
    only_critical_addons_enabled = true
  }

  identity {
    type = &quot;SystemAssigned&quot;
  }

 role_based_access_control {
    enabled = true

    azure_active_directory {
      managed = true
      admin_group_object_ids = [&quot;xxxxxxcd-75d2-4186-bac8-0fad5c2e110c&quot;]
    }    
  }

addon_profile {
    oms_agent {
      enabled                    = true
      log_analytics_workspace_id = azurerm_log_analytics_workspace.aks.id
    }
    kube_dashboard {
      enabled = false
    }
    azure_policy {
      enabled = true
    }
  }

  tags = {
    Environment = &quot;Demo&quot;
  }
}

resource &quot;azurerm_kubernetes_cluster_node_pool&quot; &quot;example&quot; {
  name                  = &quot;usernp1&quot;
  kubernetes_cluster_id = azurerm_kubernetes_cluster.example.id
  vm_size               = &quot;Standard_D4s_v3&quot;
  node_count            = 2
  enable_auto_scaling = false
 # min_count           = &quot;1&quot;
 # max_count           = &quot;1&quot;

  tags = {
    Environment = &quot;UserAppPool&quot;
  }
}

output &quot;client_certificate&quot; {
  value = azurerm_kubernetes_cluster.example.kube_config.0.client_certificate
}

output &quot;kube_config&quot; {
  value = azurerm_kubernetes_cluster.example.kube_config_raw
}

### VAIABLES.TF

variable &quot;resourcegroup&quot; {
  description = &quot;The Azure AD group that will be a cluster admin&quot;
  default = &quot;rg-eastus-services-roadmab&quot;
}

variable &quot;prefix&quot; {
  description = &quot;A dns prefix used for the k8s api&quot;
  default = &quot;sb-roadmabaks03-dns&quot;
}

variable &quot;aksname&quot; {
  description = &quot;The AKS Name of the cluster&quot;
  default = &quot;sb-roadmab3AKS&quot;
}

variable &quot;kubernetes_version&quot; {
  description = &quot;The kubernetes version to deploy&quot;
  default = &quot;1.26.3&quot;
}

variable &quot;aad_group_name&quot; {
  description = &quot;The Azure AD group that will be a cluster admin&quot;
  default = &quot;az-aksadmins&quot;
}
</code></pre>

user2808625
<p>This is because there is no block argument with that name in the <code>azurerm_kubernetes_cluster</code> resource for the latest version of the <code>azurerm</code> provider (v3.58.0). There is an argument with name <code>role_based_access_control_enabled</code> which is by default set to <code>true</code>. It seems you actually want <code>azure_active_directory_role_based_access_control</code> block. The <code>addon_profile</code> block does not exist, but there are some arguments which seem to do what you want. To summarize, here is how the offending part should look like:</p>
<pre><code>resource &quot;azurerm_kubernetes_cluster&quot; &quot;example&quot; {
 ... rest of the code ...
 azure_policy_enabled = true # this is already configured, there is no argument azure_policy

 azure_active_directory_role_based_access_control {
      managed                = true
      admin_group_object_ids = [&quot;xxxxxxcd-75d2-4186-bac8-0fad5c2e110c&quot;]
 }

 oms_agent {
   log_analytics_workspace_id = azurerm_log_analytics_workspace.aks.id
 }

  tags = {
    Environment = &quot;Demo&quot;
  }
}
</code></pre>
<p>However, I did not manage to find any reference for the <code>kube_dashboard</code> argument.</p>
