You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
4. Open `~/terraform-azure-meshplatform/main.tf` with a text editor. Modify the module variables and Terraform state backendsettings in the file.
45
+
> It is highly recommended to configure a [terraform backend](https://developer.hashicorp.com/terraform/language/settings/backends/configuration), otherwise you risk losing track of your applied resources.
41
46
42
-
5. Execute the module.
47
+
4. Execute the module.
43
48
44
49
```powershell
45
50
# Changes into ~/terraform-azure-meshplatform and applies terraform
@@ -48,7 +53,7 @@ To run this module, you need the following:
48
53
terraform apply
49
54
```
50
55
51
-
6. Use the information from terraform output to configure the platform in meshStack.
56
+
5. Use the information from terraform output to configure the platform in meshStack.
52
57
53
58
```sh
54
59
# The JSON output contains sensitive values that must not be transmitted anywhere other then the platform config screen in meshStack.
@@ -79,12 +84,12 @@ To run this module, you need the following:
79
84
> Until <https://github.com/hashicorp/terraform-provider-azurerm/issues/15211> is resolved, MCA service principal setup can only be done manually outside of terraform.
80
85
81
86
1. Ensure you have permissions in the source AAD Tenant for granting access to the billing account used for subscription creation using the `Account Administrator` role
82
-
1. Switch to the Tenant Directory that contains your Billing Account and follow the steps to [Register an Application](https://learn.microsoft.com/en-us/azure/active-directory/develop/quickstart-register-app#register-an-application) and [Add Credentials](https://learn.microsoft.com/en-us/azure/active-directory/develop/quickstart-register-app#add-credentials). Make sure to copy down the **Directory (tenant) ID**, **Application (client) ID**, **Object ID** and the **App Secret** value that was generated. The App Secret is only visible during the creation process.
83
-
2. You must grant the Enterprise Application permissions on the Billing Account, Billing Profile, or Invoice Section so that it can generate new subscriptions. Follow the steps in [this guide](https://learn.microsoft.com/en-us/azure/cost-management-billing/manage/understand-mca-roles#manage-billing-roles-in-the-azure-portal) to grant the necessary permissions. You must grant one of the following permissions
87
+
2. Switch to the Tenant Directory that contains your Billing Account and follow the steps to [Register an Application](https://learn.microsoft.com/en-us/azure/active-directory/develop/quickstart-register-app#register-an-application) and [Add Credentials](https://learn.microsoft.com/en-us/azure/active-directory/develop/quickstart-register-app#add-credentials). Make sure to copy down the **Directory (tenant) ID**, **Application (client) ID**, **Object ID** and the **App Secret** value that was generated. The App Secret is only visible during the creation process.
88
+
3. You must grant the Enterprise Application permissions on the Billing Account, Billing Profile, or Invoice Section so that it can generate new subscriptions. Follow the steps in [this guide](https://learn.microsoft.com/en-us/azure/cost-management-billing/manage/understand-mca-roles#manage-billing-roles-in-the-azure-portal) to grant the necessary permissions. You must grant one of the following permissions
84
89
- Billing Account or Billing Profile: Owner, Contributor
3. Write down the Billing Scope ID that looks something like this <samp>/providers/Microsoft.Billing/billingAccounts/5e98e158-xxxx-xxxx-xxxx-xxxxxxxxxxxx:xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx_xxxx-xx-xx/billingProfiles/AW4F-xxxx-xxx-xxx/invoiceSections/SH3V-xxxx-xxx-xxx</samp>
87
-
4. Use the following information to configure the platform in meshStack
91
+
4. Write down the Billing Scope ID that looks something like this <samp>/providers/Microsoft.Billing/billingAccounts/5e98e158-xxxx-xxxx-xxxx-xxxxxxxxxxxx:xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx_xxxx-xx-xx/billingProfiles/AW4F-xxxx-xxx-xxx/invoiceSections/SH3V-xxxx-xxx-xxx</samp>
92
+
5. Use the following information to configure the platform in meshStack
88
93
- Billing Scope
89
94
- Destination Tenant ID
90
95
- Source Tenant ID
@@ -126,6 +131,16 @@ provide the SPN with access to the function.
126
131
]
127
132
```
128
133
134
+
## Contributing Guide
135
+
136
+
Before opening a Pull Request, please do the following:
We use pre-commit to perform several terraform related tasks such as `terraform validate`, `terraform fmt`, and generating terraform docs with `terraform_docs`
141
+
142
+
2. Execute `pre-commit install`: Hooks configured in `.pre-commit-config.yaml` will be executed automatically on commit. For manual execution, you can use `pre-commit run -a`.
| <aname="input_scope"></a> [scope](#input\_scope)| The scope to which Service Principal permissions should be assigned to. Usually this is the management group id of form `/providers/Microsoft.Management/managementGroups/<tenantId>` that sits atop the subscriptions. |`string`| n/a | yes |
38
-
| <aname="input_service_principal_name_suffix"></a> [service\_principal\_name\_suffix](#input\_service\_principal\_name\_suffix)| Service principal name suffix. |`string`| n/a | yes |
37
+
| <aname="input_assignment_scopes"></a> [assignment\_scopes](#input\_assignment\_scopes)| The scopes to which Service Principal permissions should be assigned to. Usually this is the management group id of form `/providers/Microsoft.Management/managementGroups/<tenantId>` that sits atop the subscriptions. |`list(string)`| n/a | yes |
38
+
| <aname="input_create_password"></a> [create\_password](#input\_create\_password)| Create a password for the enterprise application. |`bool`| n/a | yes |
39
+
| <aname="input_service_principal_name"></a> [service\_principal\_name](#input\_service\_principal\_name)| Service principal name. Must be unique per Entra ID. |`string`| n/a | yes |
40
+
| <aname="input_workload_identity_federation"></a> [workload\_identity\_federation](#input\_workload\_identity\_federation)| Enable workload identity federation instead of using a password by providing these additional settings. Usually you should receive the required settings when attempting to configure a platform with workload identity federation in meshStack. |`object({ issuer = string, subject = string })`|`null`| no |
39
41
40
42
## Outputs
41
43
42
44
| Name | Description |
43
45
|------|-------------|
46
+
| <aname="output_application_client_secret"></a> [application\_client\_secret](#output\_application\_client\_secret)| Client Secret Of the Application. |
44
47
| <aname="output_credentials"></a> [credentials](#output\_credentials)| Service Principal application id and object id |
45
-
| <aname="output_application_client_secret"></a> [application\_client\_secret](#output\_application\_client\_secret)| Password for the Service Principal. |
|[azuread_application_published_app_ids.well_known](https://registry.terraform.io/providers/hashicorp/azuread/2.18.0/docs/data-sources/application_published_app_ids)| data source |
27
-
|[azuread_service_principal.msgraph](https://registry.terraform.io/providers/hashicorp/azuread/2.18.0/docs/data-sources/service_principal)| data source |
|[azuread_application_published_app_ids.well_known](https://registry.terraform.io/providers/hashicorp/azuread/2.46.0/docs/data-sources/application_published_app_ids)| data source |
28
+
|[azuread_application_template.enterprise_app](https://registry.terraform.io/providers/hashicorp/azuread/2.46.0/docs/data-sources/application_template)| data source |
29
+
|[azuread_service_principal.msgraph](https://registry.terraform.io/providers/hashicorp/azuread/2.46.0/docs/data-sources/service_principal)| data source |
28
30
29
31
## Inputs
30
32
31
33
| Name | Description | Type | Default | Required |
| <aname="input_meshstack_redirect_uri"></a> [meshstack\_redirect\_uri](#input\_meshstack\_redirect\_uri)| Redirect URI that will be provided by meshcloud. It is individual per meshStack. |`string`| n/a | yes |
34
-
| <aname="input_service_principal_name_suffix"></a> [service\_principal\_name\_suffix](#input\_service\_principal\_name\_suffix)| Service principal name suffix. |`string`| n/a | yes |
35
+
| <aname="input_meshstack_redirect_uri"></a> [meshstack\_redirect\_uri](#input\_meshstack\_redirect\_uri)| Redirect URI that was provided by meshcloud. It is individual per meshStack. |`string`| n/a | yes |
36
+
| <aname="input_service_principal_name"></a> [service\_principal\_name](#input\_service\_principal\_name)| Service principal name. |`string`| n/a | yes |
35
37
36
38
## Outputs
37
39
38
40
| Name | Description |
39
41
|------|-------------|
40
-
| <aname="output_app_registration"></a> [app\_registration](#output\_app\_registration)|Application registration application id and object id|
41
-
| <aname="output_app_registration_client_secret"></a> [app\_registration\_client\_secret](#output\_app\_registration\_client\_secret)|Password for the application registration.|
42
+
| <aname="output_application_client_secret"></a> [application\_client\_secret](#output\_application\_client\_secret)|Password for the application registration.|
43
+
| <aname="output_credentials"></a> [credentials](#output\_credentials)|Service Principal application id and object id|
0 commit comments