Skip to content

Commit b1f28e0

Browse files
damienboddamienbod
committed
Test terraform
1 parent ba9442e commit b1f28e0

20 files changed

Lines changed: 478 additions & 0 deletions

‎iac-core/.terraform.lock.hcl‎

Lines changed: 42 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎iac-core/README.md‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
# iac-core
2+
3+
## Prerequisites
4+
5+
- Azure tenant with a subscription and permissions to create resources and app registrations
6+
- [Azure CLI](https://learn.microsoft.com/en-us/cli/azure/install-azure-cli?WT.mc_id=MVP_344197)
7+
- [Terraform 1.13.3](https://developer.hashicorp.com/terraform/install?product_intent=terraform)
8+
9+
## Deploy resources to host terraform state
10+
11+
1. Adjust values in `iac-core\vars\dev.core.tfvars`
12+
1. Create resources to host terraform state by executing the following commands
13+
14+
```PowerShell
15+
az login -t [AZURE_TENANT_ID]
16+
cd [PATH_TO_REPOSITORY]\iac-core
17+
terraform init
18+
terraform apply --var-file=.\vars\dev.core.tfvars
19+
```

‎iac-core/backend.tf‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
terraform {
2+
backend "local" {
3+
path = "dev.core.tfstate"
4+
}
5+
}

‎iac-core/main.tf‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
data "azurerm_client_config" "current" {}
2+
3+
locals {
4+
name_template = "${var.resource_prefix}-<service>-iac"
5+
}
6+
7+
# Resource Group
8+
resource "azurerm_resource_group" "rg" {
9+
name = replace(local.name_template, "<service>", "rg")
10+
location = var.default_location
11+
}
12+
13+
resource "azuread_group" "group-rg-contributor" {
14+
display_name = format("%s-contributor", azurerm_resource_group.rg.name)
15+
prevent_duplicate_names = true
16+
security_enabled = true
17+
members = [data.azurerm_client_config.current.object_id]
18+
lifecycle {
19+
# apart from setting initially; do not flag changes in members and owners as state change
20+
ignore_changes = [members, owners]
21+
}
22+
}
23+
24+
# Storage Account
25+
resource "azurerm_storage_account" "sa" {
26+
resource_group_name = azurerm_resource_group.rg.name
27+
name = format("%s03", "storiac")
28+
location = var.default_location
29+
account_tier = "Standard"
30+
account_replication_type = "GRS"
31+
shared_access_key_enabled = false
32+
default_to_oauth_authentication = true
33+
min_tls_version = "TLS1_2"
34+
}
35+
36+
# container iac-state
37+
resource "azurerm_storage_container" "tfstate" {
38+
name = "tfstate"
39+
storage_account_id = azurerm_storage_account.sa.id
40+
}
41+
42+
resource "azurerm_role_assignment" "blob-data-owner" {
43+
scope = azurerm_resource_group.rg.id
44+
role_definition_name = "Storage Blob Data Owner"
45+
principal_id = azuread_group.group-rg-contributor.object_id
46+
}
47+
48+
resource "azurerm_role_assignment" "rg-contributor" {
49+
scope = azurerm_resource_group.rg.id
50+
role_definition_name = "Contributor"
51+
principal_id = azuread_group.group-rg-contributor.object_id
52+
}

‎iac-core/outputs.tf‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
output "rg" {
2+
value = azurerm_resource_group.rg.name
3+
}

‎iac-core/providers.tf‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
provider "azurerm" {
2+
environment = "public"
3+
subscription_id = var.subscription_id
4+
tenant_id = var.tenant_id
5+
storage_use_azuread = true
6+
features {}
7+
}
8+
9+
provider "azuread" {
10+
tenant_id = var.tenant_id
11+
}

‎iac-core/variables.tf‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
variable "tenant_id" {
2+
type = string
3+
description = "Azure tenant ID"
4+
}
5+
variable "subscription_id" {
6+
type = string
7+
description = "Azure subscription ID"
8+
}
9+
variable "resource_prefix" {
10+
type = string
11+
description = "Prefix for all resources"
12+
}
13+
variable "default_location" {
14+
type = string
15+
description = "Default Azure resource location"
16+
}

‎iac-core/vars/dev.core.tfvars‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
tenant_id = "00000000-0000-0000-0000-000000000000"
2+
subscription_id = "00000000-0000-0000-0000-000000000000"
3+
resource_prefix = "e2e-security-web"
4+
default_location = "switzerlandnorth"

‎iac-core/versions.tf‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
terraform {
2+
required_version = "~> 1.13.3"
3+
required_providers {
4+
azuread = {
5+
source = "hashicorp/azuread"
6+
version = "~> 3.6.0"
7+
}
8+
azurerm = {
9+
source = "hashicorp/azurerm"
10+
version = "~> 4.49.0"
11+
}
12+
}
13+
}

‎iac/README.md‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
# iac
2+
3+
## Prerequisites
4+
5+
- Azure tenant with a subscription and permissions to create resources and app registrations
6+
- [Azure CLI](https://learn.microsoft.com/en-us/cli/azure/install-azure-cli?WT.mc_id=MVP_344197)
7+
- [Terraform 1.13.3](https://developer.hashicorp.com/terraform/install?product_intent=terraform)
8+
9+
## Deploy application resources
10+
11+
> [!IMPORTANT]
12+
> To generate deployment credentials and to configure the secrets for the GitHub actions workflow, see [here](https://learn.microsoft.com/en-us/azure/app-service/deploy-github-actions?tabs=openid%2Caspnetcore&WT.mc_id=MVP_344197#manually-set-up-a-github-actions-workflow).
13+
> There are currently two GitHub environments set up for this repository: `dev` and `dev-iac`.
14+
> For each environment, a separate federated credential is set up in the Entra app which got created while generating deployment credentials.
15+
> Furthermore the service principal of the Entra app is a member of the Entra group `e2e-security-web-rg-iac-contributor` and the following Microsoft Graph application permissions got added
16+
>
17+
> - `Application.ReadWrite.All`
18+
> - `Domain.Read.All`
19+
> - `Group.ReadWrite.All`
20+
>
21+
> Finally, the service principal was assigned ...
22+
>
23+
> - ... the `Contributor` role at the subscription level
24+
> - ... the `Owner` role for the resource group of the application
25+
26+
> [!NOTE]
27+
> The application resources are created via GitHub actions workflow. The following steps are only required, if you want to create the resources manually.
28+
29+
1. Adjust values in `iac\vars\dev.app.tfvars`
30+
1. Adjust values in `iac\backend\dev.backend.tfvars`
31+
1. Create application resources using the following commands
32+
33+
```PowerShell
34+
az login -t [AZURE_TENANT_ID]
35+
cd [PATH_TO_REPOSITORY]\iac
36+
terraform init --backend-config=backend\dev.backend.tfvars
37+
terraform apply --var-file=.\vars\dev.app.tfvars --state=dev.app.tfstate
38+
```
39+
40+
## Useful links
41+
42+
- [Set up a GitHub Actions workflow manually](https://learn.microsoft.com/en-us/azure/app-service/deploy-github-actions?tabs=openid%2Caspnetcore&WT.mc_id=MVP_344197#set-up-a-github-actions-workflow-manually)
43+
- [Authenticating using a Service Principal and OpenID Connect](https://registry.terraform.io/providers/hashicorp/azuread/latest/docs/guides/service_principal_oidc)

0 commit comments

Comments
 (0)