Azure : Create Azure AD Groups along with Role using Terraform - azure

Question

I’m trying to create list of Azure AD Groups along with Role using Terraform
I have followed approach in such a way it would first create the required AD groups and then later it will assign the Role
# Required Provider
terraform {
required_providers {
azurerm = {
source = "hashicorp/azurerm"
version = "~> 3.0.2"
}
}
required_version = ">= 1.1.0"
}
# Configure the Microsoft Azure Provider
provider "azurerm" {
features {}
....
....
}
data "azuread_client_config" "current" {}
# Variables
variable "ad_groups" {
description = "Azure AD groups to be added"
type = list(object({
display_name = string,
description = string,
scope = string,
role = string
}))
default = [
{
display_name = "Group1"
description = "some description",
scope = "/providers/Microsoft.Management/managementGroups/xxxxx",
role = "Owner"
},
{
display_name = "Group2"
description = "some description",
scope = "/providers/Microsoft.Management/managementGroups/xxxxx",
role = "Contributor"
}
]
}
# Create AD Groups and add the Current User
resource "azuread_group" "this"{
count = length(var.ad_groups)
display_name = var.ad_groups[count.index].display_name
description = var.ad_groups[count.index].description
security_enabled = true
# prevent_duplicate_names = true
owners = [data.azuread_client_config.current.object_id]
}
# Assign Permission to the AD Group
resource "azurerm_role_assignment" "sp-tenant-global-admin-user-access-role-assignment" {
count = length(var.ad_groups)
scope = var.ad_groups[count.index].scope
role_definition_name = var.ad_groups[count.index].role
principal_id = azuread_group.this[count.index].object_id
depends_on = [
azuread_group.this
]
}
does it look good and would it work? I don't have access to run the above code to validate.

Answer 1

I tried to reproduce the same in my environment.
variable "ad_groups" {
description = "Azure AD groups to be added"
type = list(object({
display_name = string,
description = string,
scope = string,
role = string
}))
default = [
{
display_name = "Group2"
description = "some description",
scope = "/providers/Microsoft.Management/managementGroups/xxxxx",
role = "Reader"
}
]
}
# Create AD Groups and add the Current User
resource "azuread_group" "this"{
count = length(var.ad_groups)
display_name = var.ad_groups[count.index].display_name
description = var.ad_groups[count.index].description
security_enabled = true
owners = [data.azuread_client_config.current.object_id]
}
# Assign Permission to the AD Group
resource "azurerm_role_assignment" "sp-tenant-global-admin-user-access-role-assignment" {
count = length(var.ad_groups)
scope = var.ad_groups[count.index].scope
role_definition_name = var.ad_groups[count.index].role
principal_id = azuread_group.this[count.index].object_id
depends_on = [
azuread_group.this
]
}
 
I have received error like:
As I donot have role over the scope of the subscription, as the
/providers/Microsoft.Management/managementGroups/xxxx need
privilege to assign role over the subscription scope.
But as you are using azurerm provider to create a role to group via
terraform , I tried the following code with a resource group scope
as I checked it is enough for my groups
Code:
Variables.tf
variable "ad_groups" {
description = "Azure AD groups to be added"
type = list(object({
display_name = string,
description = string,
scope = string,
role = string
}))
default = [
{
display_name = "Group2"
description = "some description",
scope = "/subscriptions/xxxxx/resourcegroups/myrg" #resource group scope
role = "Reader"
}
]
}
Main.tf:
resource "azuread_user" "example" {
display_name = "kavyaJDoe"
password = "notSecure123"
user_principal_name = "xxx.onmicrosoft.com"
}
resource "azuread_group" "example" {
display_name = "kavyaMyGroup"
owners = [data.azuread_client_config.current.object_id]
security_enabled = true
members = [
azuread_user.example.object_id,
# more users
]
}
resource "azuread_group" "this"{
count = length(var.ad_groups)
display_name = var.ad_groups[count.index].display_name
description = var.ad_groups[count.index].description
security_enabled = true
# prevent_duplicate_names = true
owners = [data.azuread_client_config.current.object_id]
}
resource "azurerm_role_assignment" "sp-tenant-global-admin-user-access-role-assignment" {
count = length(var.ad_groups)
scope ="/subscriptions/xxx/resourcegroups/myrg"
role_definition_name = var.ad_groups[count.index].role
principal_id = azuread_group.this[count.index].object_id
depends_on = [
azuread_group.this
]
}
Optional :if role is required to be assigned in order to provide roles to others:
resource "azurerm_role_definition" "role_assignment_write_delete" {
name = "RBAC Owner"
scope = data.azurerm_client_config.current.subscription_id
description = "Management of role assignments"
permissions {
actions = [
"Microsoft.Authorization/roleAssignments/write",
"Microsoft.Authorization/roleAssignments/delete",
]
not_actions = []
}
assignable_scopes = [
data.azurerm_client_config.current.subscription_id //or management group
]
}
I could create the role assignment successfully:
Can see the role created for the group2 that got initiated through variables:
Reference:
Understand scope for Azure RBAC | Microsoft Learn