Terraform module for Azure Managed Service Identity(MSI)

Versions

• Module tested for Terraform 1.0.1.
• Azure provider version 3.21.1
• main branch: Provider versions not pinned to keep up with Terraform releases
• tags releases: Tags are pinned with versions (use latest in your releases)

Usage

Option 1:

terrafrom init
terraform plan -var='teamid=tryme' -var='prjid=project1'
terraform apply -var='teamid=tryme' -var='prjid=project1'
terraform destroy -var='teamid=tryme' -var='prjid=project1'

Note: With this option please take care of remote state storage

Option 2:

Recommended method (stores remote state in remote backend(S3, Azure storage, or Google bucket) using prjid and teamid to create directory structure):

• Create python 3.8+ virtual environment

python3 -m venv <venv name>

• Install package:

pip install tfremote --upgrade

• Set below environment variables:

export TF_AWS_BUCKET=<remote state bucket name>
export TF_AWS_BUCKET_REGION=us-west-2
export TF_AWS_PROFILE=<profile from ~/.ws/credentials>

or

• Set below environment variables:

export TF_AWS_BUCKET=<remote state bucket name>
export TF_AWS_BUCKET_REGION=us-west-2
export AWS_ACCESS_KEY_ID=<aws_access_key_id>
export AWS_SECRET_ACCESS_KEY=<aws_secret_access_key>

• Updated examples directory with required values.

• Run and verify the output before deploying:

tf -c=aws plan -var='teamid=foo' -var='prjid=bar'

• Run below to deploy:

tf -c=aws apply -var='teamid=foo' -var='prjid=bar'

• Run below to destroy:

tf -c=aws destroy -var='teamid=foo' -var='prjid=bar'

Note: Read more on tfremote Please refer to examples directory link for references.

terraform {
  required_version = ">= 1.0.1"
  required_providers {
    azurerm = {
      version = "~> 3.21.1"
    }
  }
}

provider "azurerm" {
  features {}
}

module "msi" {
  source = "../"

  config = {
    "demo-identity" = {
      resource_group = "<resource_group_name>"
      location       = "westus2"
    }
  }
  # -----------------------------------------
  # Note: Do not change teamid and prjid once set.
  teamid = var.teamid
  prjid  = var.prjid
}

Please refer to examples directory link for references.

Requirements

Name	Version
terraform	>= 1.0.1
azurerm	~> 3.21.1

Providers

Name	Version
azurerm	~> 3.21.1

Modules

No modules.

Resources

Name	Type
azurerm_user_assigned_identity.identity	resource

Inputs

Name	Description	Type	Default	Required
config	MSI configuration	map(any)	{}	no
extra_tags	Additional tags to associate	map(string)	{}	no

Outputs

Name	Description
client_id	Client ID associated with the user assigned identity
id	The ID of the MSI created
name	The name of the MSI created
principal_id	The ID of the Principal (User, Group or Service Principal) to assign the Role Definition
tenant_id	Tenant ID associated with the user assigned identity.