terraform-provider-azuread | Terraform provider for Azure Active Directory | Azure library

I got suddenly and unexpectedly following error when executing terraform plan.

How can I allow a Kubernetes cluster in Azure to talk to an Azure Container Registry via terraform?

I want to load custom images from my Azure Container Registry. Unfortunately, I encounter a permissions error at the point where Kubernetes is supposed to download the image from the ACR.

It all works perfectly after I attach the acr to the aks via az cli:

az aks update -n myAKSCluster -g myResourceGroup --attach-acr

This is my terraform configuration; I have stripped some other stuff out. It works in itself.

I have a most of my Azure infrastructure managed with Terraform. However, I am quickly finding that a lot of the small details are missing.

e.g. client secrets aren't fully supported https://github.com/terraform-providers/terraform-provider-azuread/issues/95

It doesn't seem possible to add an Active Directory Provider to APIM How Do I Add Active Directory To APIM Using Terraform?

Creating the APIM leaves demo products on it that can't be removed How Can I Remove Demo Products From APIM Created With Terraform?

etc, etc.

Solutions to these seems to be utilising the cli

e.g. https://docs.microsoft.com/en-us/cli/azure/ad/app/permission?view=azure-cli-latest#az-ad-app-permission-add

Or falling back to the REST API: e.g. https://docs.microsoft.com/en-us/rest/api/apimanagement/2019-01-01/apis/delete

How can I mix terraform with the CLI and REST API?

Can they be embedded in terraform?

Or do I just run some commands to run them after terraform has finished?

Is there a way to do these commands in a cross platform way?

Will running the CLI and REST API after terraform cause the state to be wrong and likely cause problems the next time terraform is run?