Terraform Azure Service Principal Module

This module creates Service Principal (with client secrets, OIDC, or client certificate).

Set one or more of the service principal input variable to "true" to use for authentication.

use_secret      = false
use_oidc        = true
use_certificate = false

Complete Example - Service Principal with all methods

This example shows how to use the module to create spn with client secret, client certificate, and OIDC by setting their variables to true

module "service-principal" {
  source = "git::https://github.com/mosowaz/terraform-azurerm-service-principal.git//terraform?ref=v1.5.0"

  resource_group = {
    name     = "service_principal"
    location = "canadacentral"
  }

  use_secret      = true
  use_oidc        = true
  use_certificate = true

  # (Optional) block is required only if use_oidc = true
  federation = {
    azdo_organization_name = "Your_Organization"
    azdo_project_name      = "Project_name"
    azdo_repo_name         = "Repository_name"
    azdo_branch            = "main"
  }

  # (Optional) block is required only if use_certificate = true
  client_certificate = {
    common_name  = "Organization_CN_name"
    organization = "Organiztion_name"
  }

  # (Optional) This is required only if use_certificate = true
  certificate_validity_period_hours = 740 # Number of hours
  app_display_name                  = var.display_name
  description                       = var.description
  use_existing                      = true

  app_role_ids = ["bf7b1a76-6e77-406b-b258-bf5c7720e98f",] # (Optional) API permission (Group.Create)

  iam_roles = ["Contributor",] # List of roles for SPN
  # default scope is resource group

  spn_password = {
    display_name = "Automation account"
  }
}

  

Requirements

Name	Version
azuread	~> 3.3.0
azurerm	~> 4.28.0
http	~> 3.5
random	~> 3.5
time	0.12.1
tls	4.1.0

Modules

No modules.

Resources

Name	Type
azuread_application.spn_application	resource
azuread_application_api_access.api_permission	resource
azuread_application_federated_identity_credential.spn_oidc	resource
azuread_service_principal.service_principal	resource
azuread_service_principal_certificate.spn_certificate	resource
azuread_service_principal_password.spn_secret	resource
azurerm_resource_group.rg	resource
azurerm_role_assignment.iam_roles	resource
azurerm_role_assignment.iam_roles_user	resource
tls_private_key.cert_key	resource
tls_self_signed_cert.signed_cert	resource
azuread_service_principal.msgraph_api	data source
azurerm_client_config.current	data source
azurerm_role_definition.owner_role	data source
azurerm_subscription.primary	data source

Inputs

Name	Description	Type	Default	Required
iam_roles	(Required) IAM roles required for the Service Principal to perform operations	list(string)	n/a	yes
resource_group	(Required) Name and location of resource group	object({ name = string location = string })	n/a	yes
use_certificate	(Required) Should the Service Principal be used to authenticate with Client Certificate?	bool	n/a	yes
use_oidc	(Required) Should the Service Principal be used to authenticate with OpenID Connect?	bool	n/a	yes
use_secret	(Required) Should the Service Principal be used to authenticate with Client Secret?	bool	n/a	yes
app_display_name	(Optional) The display name of the application associated with this service principal.	string	"My_Automation_Account"	no
app_role_ids	(Optional) API permissions required by the service principal running terraform apply	list(string)	[ "" ]	no
certificate_validity_period_hours	(Optional) Number of hours the client certificate will be valid for. This is required if use_certificate = true	number	null	no
client_certificate	(Optional) This block is required if use_certificate = true common_name: Distinguished name (e.g myapp.example.com). organization: Distinguished name (i.e YOUR_ORGANIZATION_NAME)	object({ common_name = optional(string, null) organization = optional(string, null) })	{}	no
description	(Optional) Description of the Service Principal being created	string	"Service principal for automation"	no
federation	(Optional) This block is required if use_oidc = true This assumes you already have a repository and a project in your organization.	object({ azdo_organization_name = optional(string, null) azdo_project_name = optional(string, null) azdo_repo_name = optional(string, null) azdo_branch = optional(string, "*") })	{}	no
spn_password	(Optional) Object references to the Service Principal password	object({ display_name = optional(string, null) start_date = optional(any, null) end_date = optional(any, null) })	{}	no
use_existing	(Optional) When true, any existing service principal linked to the same application will be automatically imported. When false, an import error will be raised for any pre-existing service principal.	bool	true	no

Outputs

Name	Description
application_client_id	Client ID for the application
application_id	n/a
application_object_id	Application's object ID
end_date	n/a
service_principal_app_tenant_id	Tenant ID of associated application
service_principal_object_id	n/a
service_principal_secret_value	Service principal secret value
spn_client_cert	client certificate
start_date	n/a