Ecosyste.ms: Awesome

An open API service indexing awesome lists of open source software.

Awesome Lists | Featured Topics | Projects

https://github.com/cloudnationhq/terraform-azure-rbac

Terraform module which create rbac resources used by workloads and accelerators.
https://github.com/cloudnationhq/terraform-azure-rbac

azure terraform wam

Last synced: 7 days ago
JSON representation

Terraform module which create rbac resources used by workloads and accelerators.

Awesome Lists containing this project

README 

        
# Rbac



This terraform module simplifies the process of creating and managing role assignments on azure resources offering a flexible and powerful solution for managing azure role based access control (rbac) through code.



## Goals



The main objective is to create a more logic data structure, achieved by combining and grouping related resources together in a complex object.



The structure of the module promotes reusability. It's intended to be a repeatable component, simplifying the process of building diverse workloads and platform accelerators consistently.



A primary goal is to utilize keys and values in the object that correspond to the REST API's structure. This enables us to carry out iterations, increasing its practical value as time goes on.



A last key goal is to separate logic from configuration in the module, thereby enhancing its scalability, ease of customization, and manageability.



## Non-Goals



These modules are not intended to be complete, ready-to-use solutions; they are designed as components for creating your own patterns.



They are not tailored for a single use case but are meant to be versatile and applicable to a range of scenarios.



Security standardization is applied at the pattern level, while the modules include default values based on best practices but do not enforce specific security standards.



End-to-end testing is not conducted on these modules, as they are individual components and do not undergo the extensive testing reserved for complete patterns or solutions.



## Features



- offers support for creating role assignment (role based access control) on Azure resources.

- support for creating new custom role definitions

- multiple roles and scopes can be defined per principal type.

- data lookup of group or service-principal (app registration) based on display name in Entra ID.

- data lookup of user based on upn in Entra ID.

- data lookup for existing custom role definitions and assigning these.



## Requirements



| Name | Version |

|------|---------|

|  [terraform](#requirement\_terraform) | ~> 1.0 |

|  [azuread](#requirement\_azuread) | ~> 2.47 |

|  [azurerm](#requirement\_azurerm) | ~> 4.0 |



## Providers



| Name | Version |

|------|---------|

|  [azuread](#provider\_azuread) | ~> 2.47 |

|  [azurerm](#provider\_azurerm) | ~> 4.0 |



## Resources



| Name | Type |

|------|------|

| [azurerm_role_assignment.role](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/role_assignment) | resource |

| [azurerm_role_assignment.role_object_id](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/role_assignment) | resource |

| [azurerm_role_definition.custom](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/role_definition) | resource |

| [azuread_group.group](https://registry.terraform.io/providers/hashicorp/azuread/latest/docs/data-sources/group) | data source |

| [azuread_service_principal.sp](https://registry.terraform.io/providers/hashicorp/azuread/latest/docs/data-sources/service_principal) | data source |

| [azuread_user.user](https://registry.terraform.io/providers/hashicorp/azuread/latest/docs/data-sources/user) | data source |

| [azurerm_role_definition.custom](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/data-sources/role_definition) | data source |



## Inputs



| Name | Description | Type | Default | Required |

|------|-------------|------|---------|:--------:|

|  [role\_assignments](#input\_role\_assignments) | n/a | `any` | n/a | yes |

|  [role\_definitions](#input\_role\_definitions) | n/a | `any` | `{}` | no |



## Outputs



| Name | Description |

|------|-------------|

|  [role\_assignments](#output\_role\_assignments) | n/a |

|  [role\_definitions](#output\_role\_definitions) | n/a |



## Testing



For more information, please see our testing [guidelines](./TESTING.md)



## Notes



Using a dedicated module, we've developed a naming convention for resources that's based on specific regular expressions for each type, ensuring correct abbreviations and offering flexibility with multiple prefixes and suffixes.



Full examples detailing all usages, along with integrations with dependency modules, are located in the examples directory.



To update the module's documentation run `make doc`



This module does not create or manages the actual user, group or service-principal in Entra ID.



It looks up the object ID of the service principal type based on display_name (servicePrincipal, application or Group type) or UPN (User type).



To lookup these values in Entra ID, specific API permissions are needed for the SP running Terraform, see also requirements.



If these API permissions cannot be granted for whatever reason, alternatively the object_id can be directly used instead.



## Authors



Module is maintained by [these awesome contributors](https://github.com/cloudnationhq/terraform-azure-rbac/graphs/contributors).



## Contributing



We welcome contributions from the community! Whether it's reporting a bug, suggesting a new feature, or submitting a pull request, your input is highly valued.



For more information, please see our contribution [guidelines](./CONTRIBUTING.md).



## License



MIT Licensed. See [LICENSE](./LICENSE) for full details.



## References



- [Documentation](https://learn.microsoft.com/en-us/azure/role-based-access-control/)

- [Rest Api](https://learn.microsoft.com/en-us/azure/role-based-access-control/role-assignments-rest)

- [Rest Api Specs](https://github.com/MicrosoftDocs/azure-docs/blob/main/articles/role-based-access-control/role-assignments-list-rest.md)