NSG rule across subscription in azure via terraform

Question

#provider azurem.mgmt is Subscription A.
#prodiver azurem.corpapps is Subscription B.

I am trying to create nsg rule in Subscription A with Provider azurerm.mgmt. Here the destination application security group is in Subscription B with Provider azurerm.corpapps in this subscription.

provider "azurerm" {
    client_id       = "${var.client_id}"
    client_secret   = "${var.client_secret}"
    tenant_id       = "${var.tenant_id}"
    subscription_id = "${var.subscription}"
    alias           = "mgmt"
}

provider "azurerm" {
    client_id       = "${var.client_id}"
    client_secret   = "${var.client_secret}"
    tenant_id       = "${var.tenant_id}"
    subscription_id = "${var.subscription_B}"
    alias           = "corpapps"
}

Then i use the provider to get my asg from Subscription B as shown:

Then i use that reference in my nsg rule

However, i get error - saying the ASG is not found:

But, in azure portal the resource is already there as shown:

Answer 1

I have tried to assign the SP which has owner role on both subscriptions or using Azure account with CLI but it's no luck. Also, as the comment points out, there is a limitation that NSG does not reference ASG in different location. After my validation, you can not add the ASG from another subscription even it's in the same region as the NSG or targets VNet.

Moreover, when you add this ASG as the target source or destination in the NSG rules, you will see

Select an application security group (ASG) as the security rule source. ASGs enable fine-grained network security policies based on workloads or applications instead of IP addresses or CIDR blocks. Rules specifying an application security group are only applied to network interfaces that are members of the application security group on the same virtual network.