constellation/terraform/infrastructure/iam/azure/main.tf
renovate[bot] bdfb74f6ca
deps: update Terraform dependencies (#3200)
* deps: update Terraform dependencies

* upgrade random provider

* deps: tidy all modules

---------

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: Adrian Stobbe <stobbe.adrian@gmail.com>
Co-authored-by: edgelessci <edgelessci@users.noreply.github.com>
2024-06-27 09:14:10 +02:00

71 lines
2.1 KiB
HCL

terraform {
required_providers {
azurerm = {
source = "hashicorp/azurerm"
version = "3.109.0"
}
azuread = {
source = "hashicorp/azuread"
version = "2.52.0"
}
}
}
# Configure Azure resource management provider
provider "azurerm" {
features {
resource_group {
prevent_deletion_if_contains_resources = false
}
}
}
# Configure Azure active directory provider
provider "azuread" {
tenant_id = data.azurerm_subscription.current.tenant_id
}
# Access current subscription (available via Azure CLI)
data "azurerm_subscription" "current" {}
# Access current AzureAD configuration
data "azuread_client_config" "current" {}
# Create base resource group
resource "azurerm_resource_group" "base_resource_group" {
name = var.resource_group_name
location = var.location
}
# Create identity resource group
resource "azurerm_resource_group" "identity_resource_group" {
name = "${var.resource_group_name}-identity"
location = var.location
}
# Create managed identity
resource "azurerm_user_assigned_identity" "identity_uami" {
location = var.location
name = var.service_principal_name
resource_group_name = azurerm_resource_group.identity_resource_group.name
}
# Assign roles to managed identity
resource "azurerm_role_assignment" "virtual_machine_contributor_role" {
scope = azurerm_resource_group.base_resource_group.id
role_definition_name = "Virtual Machine Contributor"
principal_id = azurerm_user_assigned_identity.identity_uami.principal_id
}
resource "azurerm_role_assignment" "application_insights_component_contributor_role" {
scope = azurerm_resource_group.base_resource_group.id
role_definition_name = "Application Insights Component Contributor"
principal_id = azurerm_user_assigned_identity.identity_uami.principal_id
}
resource "azurerm_role_assignment" "uami_owner_role" {
scope = azurerm_resource_group.base_resource_group.id
role_definition_name = "Owner"
principal_id = azurerm_user_assigned_identity.identity_uami.principal_id
}