https://github.com/libre-devops/terraform-azuredevops-managed-identity-connection

A module used to create a managed identity connection in Azure DevOps 🪪
https://github.com/libre-devops/terraform-azuredevops-managed-identity-connection

Last synced: 11 months ago
JSON representation

A module used to create a managed identity connection in Azure DevOps 🪪

Host: GitHub
URL: https://github.com/libre-devops/terraform-azuredevops-managed-identity-connection
Owner: libre-devops
License: mit
Created: 2025-05-24T23:11:30.000Z (about 1 year ago)
Default Branch: main
Last Pushed: 2025-05-25T00:39:48.000Z (about 1 year ago)
Last Synced: 2025-05-25T00:57:12.947Z (about 1 year ago)
Language: PowerShell
Size: 34.2 KB
Stars: 0
Watchers: 0
Forks: 0
Open Issues: 0
Metadata Files:
- Readme: README.md
- Contributing: CONTRIBUTING.md
- License: LICENSE

Awesome Lists containing this project

README

          ```hcl

data "azurerm_client_config" "current" {}

data "azurerm_subscription" "current" {}

data "azuredevops_project" "project_id" {

  name = var.azuredevops_project_name

}

locals {

  default_managed_identity_type        = var.managed_identity_type != "SystemAssigned" ? "UserAssigned" : "SystemAssigned"

  default_managed_identity_name        = var.managed_identity_name != null ? var.managed_identity_name : "msi-azdo-${var.azuredevops_project_name}-${var.azuredevops_organization_guid}"

  default_managed_identity_description = var.managed_identity_description != null ? var.managed_identity_description : "This managed identity is for the federated credential of Azure DevOps of the project ${var.azuredevops_project_name}, in the organization ${var.azuredevops_organization_name} with guid ${var.azuredevops_organization_guid}"

}

module "rg" {

  source = "libre-devops/rg/azurerm"

  count = var.rg_id == null ? 1 : 0

  rg_name  = var.rg_name

  location = var.location

  tags     = var.tags

}

locals {

  rg_parts           = var.rg_id != null ? split("/", var.rg_id) : null

  rg_name            = local.rg_parts != null ? local.rg_parts[4] : null

  rg_subscription_id = local.rg_parts != null ? local.rg_parts[2] : null

}

resource "azurerm_user_assigned_identity" "uid" {

  count               = local.default_managed_identity_type != "SystemAssigned" ? 1 : 0

  name                = local.default_managed_identity_name

  resource_group_name = local.rg_name != null ? local.rg_name : module.rg[0].rg_name

  location            = var.location

  tags                = var.tags

}

resource "azuredevops_serviceendpoint_azurerm" "azure_devops_service_endpoint_azurerm" {

  depends_on                             = [azurerm_role_assignment.assign_spn_to_subscription[0]]

  project_id                             = data.azuredevops_project.project_id.id

  service_endpoint_name                  = var.managed_identity_name != null ? var.managed_identity_name : local.default_managed_identity_name

  description                            = var.managed_identity_description

  service_endpoint_authentication_scheme = "ManagedServiceIdentity"

  credentials {

    serviceprincipalid = var.system_assigned_managed_identity_principal_id == null ? azurerm_user_assigned_identity.uid[0].client : var.system_assigned_managed_identity_client_id

  }

  azurerm_spn_tenantid      = data.azurerm_client_config.current.tenant_id

  azurerm_subscription_id   = data.azurerm_subscription.current.subscription_id

  azurerm_subscription_name = data.azurerm_subscription.current.display_name

}

resource "azurerm_role_assignment" "assign_spn_to_subscription" {

  count                = var.attempt_assign_role_to_spn == true ? 1 : 0

  principal_id         = var.system_assigned_managed_identity_principal_id == null ? azurerm_user_assigned_identity.uid[0].principal_id : var.system_assigned_managed_identity_principal_id

  scope                = data.azurerm_subscription.current.id

  role_definition_name = var.role_definition_name_to_assign

}

# resource "azurerm_federated_identity_credential" "fed_cred_managed_identity" {

#   count               = var.managed_identity_type == "UserAssigned" ? 1 : 0

#   name                = local.default_managed_identity_name

#   resource_group_name = local.rg_name

#   parent_id           = azurerm_user_assigned_identity.uid[0].id

#   audience            = ["api://AzureADTokenExchange"]

#   issuer              = azuredevops_serviceendpoint_azurerm.azure_devops_service_endpoint_azurerm.workload_identity_federation_issuer

#   subject             = azuredevops_serviceendpoint_azurerm.azure_devops_service_endpoint_azurerm.workload_identity_federation_subject

# }

```

## Requirements

| Name | Version |

|------|---------|

|  [azuredevops](#requirement\_azuredevops) | >=1.0.1 |

## Providers

| Name | Version |

|------|---------|

|  [azuredevops](#provider\_azuredevops) | >=1.0.1 |

|  [azurerm](#provider\_azurerm) | n/a |

## Modules

| Name | Source | Version |

|------|--------|---------|

|  [rg](#module\_rg) | libre-devops/rg/azurerm | n/a |

## Resources

| Name | Type |

|------|------|

| [azuredevops_serviceendpoint_azurerm.azure_devops_service_endpoint_azurerm](https://registry.terraform.io/providers/microsoft/azuredevops/latest/docs/resources/serviceendpoint_azurerm) | resource |

| [azurerm_role_assignment.assign_spn_to_subscription](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/role_assignment) | resource |

| [azurerm_user_assigned_identity.uid](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/user_assigned_identity) | resource |

| [azuredevops_project.project_id](https://registry.terraform.io/providers/microsoft/azuredevops/latest/docs/data-sources/project) | data source |

| [azurerm_client_config.current](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/data-sources/client_config) | data source |

| [azurerm_subscription.current](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/data-sources/subscription) | data source |

## Inputs

| Name | Description | Type | Default | Required |

|------|-------------|------|---------|:--------:|

|  [attempt\_assign\_role\_to\_spn](#input\_attempt\_assign\_role\_to\_spn) | Whether or not to attempt to assign a role to the SPN to the subscription.  This is actually needed, so defaults to true | `bool` | `true` | no |

|  [azuredevops\_organization\_guid](#input\_azuredevops\_organization\_guid) | The unique ID of your Azure DevOps organisation | `string` | n/a | yes |

|  [azuredevops\_organization\_name](#input\_azuredevops\_organization\_name) | The name of your Azure DevOps organization | `string` | n/a | yes |

|  [azuredevops\_project\_name](#input\_azuredevops\_project\_name) | The name of your Azure DevOps project you want to configure | `string` | n/a | yes |

|  [location](#input\_location) | The location for this resource to be put in | `string` | `"uksouth"` | no |

|  [managed\_identity\_description](#input\_managed\_identity\_description) | The description of the service principal | `string` | `null` | no |

|  [managed\_identity\_name](#input\_managed\_identity\_name) | The name of the service principal | `string` | `null` | no |

|  [managed\_identity\_type](#input\_managed\_identity\_type) | The type of the managed identity | `string` | `null` | no |

|  [rg\_id](#input\_rg\_id) | The id of a resource group, supplying this value stops the module from creating a resource group, defaults to null as created a resource group is the default behaviour | `string` | `null` | no |

|  [rg\_name](#input\_rg\_name) | The name of the resource group, this module creates a resource group for you, so please supply a unique name | `string` | `null` | no |

|  [role\_definition\_name\_to\_assign](#input\_role\_definition\_name\_to\_assign) | The role definition needed to setup SPN, for security reasons, defautls to Reader | `string` | `"Reader"` | no |

|  [system\_assigned\_managed\_identity\_client\_id](#input\_system\_assigned\_managed\_identity\_client\_id) | The client id of the system assigned managed identity | `string` | `null` | no |

|  [system\_assigned\_managed\_identity\_principal\_id](#input\_system\_assigned\_managed\_identity\_principal\_id) | The principal id of the system assigned managed identity | `string` | `null` | no |

|  [tags](#input\_tags) | A map of the tags to use on the resources that are deployed with this module. | `map(string)` | `{}` | no |

## Outputs

| Name | Description |

|------|-------------|

|  [managed\_identity\_client\_id](#output\_managed\_identity\_client\_id) | The client id of the managed identity |

|  [managed\_identity\_id](#output\_managed\_identity\_id) | The id of the managed identity |

|  [managed\_identity\_principal\_id](#output\_managed\_identity\_principal\_id) | The principal id of the managed identity |

|  [service\_endpoint\_id](#output\_service\_endpoint\_id) | The id of the service endpoint |

|  [service\_endpoint\_name](#output\_service\_endpoint\_name) | The project name of the service endpoint is made with |

|  [service\_endpoint\_project\_id](#output\_service\_endpoint\_project\_id) | The project id of the service endpoint is made with |

|  [service\_endpoint\_service\_principal\_id](#output\_service\_endpoint\_service\_principal\_id) | The service principal id service endpoint is made with |

ecosyste.ms

Data

Tools

Indexes

Applications

Experiments

Awesome

https://github.com/libre-devops/terraform-azuredevops-managed-identity-connection

Awesome Lists containing this project

README