azure - 创建组并从 tfvars 添加组成员并分配 keyvault 访问策略

Question

我有一个非常简单的脚本(下面的脚本)，它创建一个由 terraform 服务主体拥有的组，并添加由其用户主体名称 (UPN) 指定的组成员。我想通过在 dev.tfvars 文件中指定多个组和多个组成员来扩展其功能。它有效，但由于我是 terraform 的新手，我想知道我是否做得正确，以及如何将 keyvault 访问策略功能添加到其中一个组？

# Fetch the current Azure AD client configuration
data "azuread_client_config" "current" {}

# Create an Azure AD Group named "Developers"
resource "azuread_group" "devs" {
  display_name     = "Developers"
  owners           = [data.azuread_client_config.current.object_id]
  security_enabled = true
}

# Fetch the details of a specific user by their UPN
data "azuread_user" "specific_user" {
  user_principal_name = "<a href="https://stackoverflow.com/cdn-cgi/l/email-protection" class="__cf_email__" data-cfemail="f79e999198b7849e8392d994989a" rel="noreferrer noopener nofollow">[email protected]</a>"
}

# Add the specific user as a member of the "Developers" group
resource "azuread_group_member" "member" {
  group_object_id  = azuread_group.devs.object_id
  member_object_id = data.azuread_user.specific_user.object_id
}

代码片段

// variables.tf
variable "groups" {
  description = "List of groups to create"
  type = list(object({
    display_name = string
    users        = list(string) # User Principal Names (UPNs)
  }))
}

//dev.tfvars
groups = [
  {
    display_name = "ProdDev_Software_Developers",
    users        = ["<a href="https://stackoverflow.com/cdn-cgi/l/email-protection" class="__cf_email__" data-cfemail="6a03040c052a19031e0f44090507" rel="noreferrer noopener nofollow">[email protected]</a>", "<a href="https://stackoverflow.com/cdn-cgi/l/email-protection" class="__cf_email__" data-cfemail="600a0f080e202e25342f3227263451515057525159554e0f0e0d0903120f130f06144e030f0d" rel="noreferrer noopener nofollow">[email protected]</a>"]
  },
  {
    display_name = "Fin_Financial_Analysts",
    users        = ["<a href="https://stackoverflow.com/cdn-cgi/l/email-protection" class="__cf_email__" data-cfemail="1970777f76596a706d7c377a7674" rel="noreferrer noopener nofollow">[email protected]</a>", "<a href="https://stackoverflow.com/cdn-cgi/l/email-protection" class="__cf_email__" data-cfemail="c5afaaadab858b80918a97828391f4f4f5f2f7f4fcf0ebaaaba8aca6b7aab6aaa3b1eba6aaa8" rel="noreferrer noopener nofollow">[email protected]</a>"]
  }
]

// user_groups.tf
locals {
  group_user_pairs = flatten([
    for group in var.groups : [
      for user in group.users : {
        display_name = group.display_name
        user         = user
      }
    ]
  ])
}

resource "azuread_group" "group" {
  for_each = { for group in var.groups : group.display_name => group }

  display_name     = each.key
  owners           = [data.azuread_client_config.current.object_id]
  security_enabled = true
}

data "azuread_user" "user" {
  for_each = { for item in local.group_user_pairs : "${item.display_name}:${item.user}" => item }

  user_principal_name = each.value.user
}

resource "azuread_group_member" "group_member" {
  for_each = { for item in local.group_user_pairs : "${item.display_name}:${item.user}" => item }

  group_object_id  = azuread_group.group[each.value.display_name].object_id
  member_object_id = data.azuread_user.user[each.key].object_id
}

我要添加的访问策略

我的脚本还创建了一个 keyvault，我基本上想等待它创建它并单独尝试获取已创建的 keyvault，并在其中添加这些访问策略。

我想做的就是创建一个组并授予“列表”权限，因为我无法列出我创建的 keystore 中的 secret 。我不确定使用 RBAC 可能有更好的主意。

  access_policy {
    tenant_id = data.azurerm_client_config.current.tenant_id
    object_id = var.devs_group_object_id
    key_permissions = [
      "Get",
      "List",
      "Update",
      "Create",
      "Import",
      "Delete",
      "Recover",
      "Backup",
      "Restore"
    ]
    secret_permissions = [
      "Get",
      "Set",
      "List",
      "Delete",
      "Recover",
      "Backup",
      "Restore"
    ]
  }

Answer 1

I tried to Create groups and add group members from tfvars and assign key vault access policies and I was able to provision them successfully using Terraform.

根据要求，我的 terraform 代码结构如下所示，用于创建用户组。

变量.tf

 variable "groups" {
  description = "List of groups to create"
  type = list(object({
    display_name = string
    users        = list(string) # User Principal Names (UPNs)
  }))
}

dev.tfvars

groups = [
  {
    display_name = "GroupVK",
    users        = ["<a href="https://stackoverflow.com/cdn-cgi/l/email-protection" class="__cf_email__" data-cfemail="51253422253a30272830113c6267642964676361686360687f3e3f3c3832233e223e37257f323e3c" rel="noreferrer noopener nofollow">[email protected]</a>", "<a href="https://stackoverflow.com/cdn-cgi/l/email-protection" class="__cf_email__" data-cfemail="9febfaecebfbfaf2f0aedfd2aca9aae7aaa9adafa6adaea6b1f0f1f2f6fcedf0ecf0f9ebb1fcf0f2" rel="noreferrer noopener nofollow">[email protected]</a>"]
  },
  {
    display_name = "GroupSB",
    users        = ["<a href="https://stackoverflow.com/cdn-cgi/l/email-protection" class="__cf_email__" data-cfemail="05716076716e64737c6445683633307d303337353c37343c2b6a6b686c66776a766a63712b666a68" rel="noreferrer noopener nofollow">[email protected]</a>", "<a href="https://stackoverflow.com/cdn-cgi/l/email-protection" class="__cf_email__" data-cfemail="780c1d0b0c1c1d15174938354b4e4d004d4e4a48414a494156171615111b0a170b171e0c561b1715" rel="noreferrer noopener nofollow">[email protected]</a>"]
  }
]

ma​​in.tf

locals {
  group_user_pairs = flatten([
    for group in var.groups : [
      for user in group.users : {
        display_name = group.display_name
        user         = user
      }
    ]
  ])
}

// Fetch the current Azure AD client configuration
data "azuread_client_config" "current" {}

resource "azuread_group" "group" {
  for_each = { for group in var.groups : group.display_name => group }

  display_name     = each.key
  owners           = [data.azuread_client_config.current.object_id]
  security_enabled = true
}

data "azuread_user" "user" {
  for_each = { for item in local.group_user_pairs : "${item.display_name}:${item.user}" => item }

  user_principal_name = each.value.user
}

resource "azuread_group_member" "group_member" {
  for_each = { for item in local.group_user_pairs : "${item.display_name}:${item.user}" => item }

  group_object_id  = azuread_group.group[each.value.display_name].object_id
  member_object_id = data.azuread_user.user[each.key].object_id
}

输出:

一旦我们完成了具有多个用户的组的创建，那么我们需要创建一个具有 RBAC 角色访问 或“访问策略”的 key 保管库

我的 key 保管库访问 terraform 配置如下。

keyvault.tf

# Fetch the current Azure AD client configuration
 data "azuread_client_config" "current" {}

data "azuread_group" "example" {
  display_name     = "GroupVK"
  security_enabled = true
 }
 
 # Fetch the details of a specific user by their UPN
data "azuread_user" "specific_user" {
  user_principal_name = "<a href="https://stackoverflow.com/cdn-cgi/l/email-protection" class="__cf_email__" data-cfemail="c0b4a5b3b4aba1b6b9a180adf3f6f5b8f5f6f2f0f9f2f1f9eeafaeada9a3b2afb3afa6b4eea3afad" rel="noreferrer noopener nofollow">[email protected]</a>"
}

    
resource "azurerm_key_vault" "example" {
  name                = "demovenkat"
  location            = "eastus"
  resource_group_name = "v-bolliv"
  sku_name            = "standard"
  tenant_id           = data.azuread_client_config.current.tenant_id
}


# Add access policies to the Key Vault
resource "azurerm_key_vault_access_policy" "example" {
  key_vault_id = data.azurerm_key_vault.example.id
  tenant_id    = data.azuread_client_config.current.tenant_id
  object_id    =  data.azuread_user.specific_user.object_id

    key_permissions = [
    "Get",
    "List",
    "Update",
    "Create",
    "Import",
    "Delete",
    "Recover",
    "Backup",
    "Restore",
  ]

  secret_permissions = [
    "Get",
    "List",
    "Set",
    "Delete",
    "Recover",
    "Backup",
    "Restore",
  ]
}

输出