Skip to content

Commit 0b1b29a

Browse files
jimrightjimright
authored
Add terraform-azure-cred-permissions module (#109)
Signed-off-by: Jim Enright <[email protected]>
1 parent c80909a commit 0b1b29a

File tree

25 files changed

+657
-36
lines changed

25 files changed

+657
-36
lines changed

‎README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@ This repository contains a number of Terraform modules for creation of the pre-r
2121
| [terraform-aws-firewall](modules/terraform-aws-firewall/README.md) | Module to create and configure to create and configure an AWS Network Firewall. This module can be used to assist in deploying Cloudera Data Platform (CDP) Public Cloud in a fully private networking configuration where the CDP Environment is connected to a Networking VPC running the Firewall. |
2222
| [terraform-azure-resource-group](modules/terraform-azure-resource-group/README.md) | Module for creation of a Resource Group on Azure. Can be used for creation of the pre-requisite resource group for Cloudera Data Platform (CDP) Public Cloud. |
2323
| [terraform-azure-vnet](modules/terraform-azure-vnet/README.md) | Module for creation of the Virtual Network (VNET) on Azure. Can be used for creation of the pre-requisite VNet and subnets for Cloudera Data Platform (CDP) Public Cloud. |
24+
| [terraform-azure-cred-permissions](modules/terraform-azure-cred-permissions/README.md) | Module for creation of the Cross Account Credential pre-requisites on Azure. Note that this module is called from the terraform-cdp-azure-prereqs module. |
2425
| [terraform-azure-bastion](modules/terraform-azure-bastion/README.md) | Module to create a Bastion Virtual Machine instance on Azure. |
2526
| [terraform-azure-nfs](modules/terraform-azure-nfs/README.md) | Module for creation of Azure NFS File Share required for Cloudera Machine Learning (CML) Public Cloud. Also optionally creates a Virtual Machine which can be used to mount and set the required ownership for CML workspace's projects folder.|
2627
| [terraform-azure-cdw-permissions](modules/terraform-azure-cdw-permissions/README.md) | Module for creation of the Azure Kubernetes Service (AKS) managed identity required for the Cloudera Data Warehouse (CDW) service.|

‎modules/terraform-aws-cred-permissions/README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
<!-- BEGIN_TF_DOCS -->
2-
# Terraform Module for CDP Credential Prerequisites on AWS
2+
# Terraform Module for Cloudera on AWS Credential Prerequisites
33

44
This module contains resource files and example variable definition files for creation of the Cloudera Data Platform (CDP) Public Cloud Cross Account Credential pre-requisite on AWS.
55

‎modules/terraform-aws-cred-permissions/doc_fragments/header.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
# Terraform Module for CDP Credential Prerequisites on AWS
1+
# Terraform Module for Cloudera on AWS Credential Prerequisites
22

33
This module contains resource files and example variable definition files for creation of the Cloudera Data Platform (CDP) Public Cloud Cross Account Credential pre-requisite on AWS.
44

‎modules/terraform-azure-cred-permissions/.terraform-docs.yaml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
formatter: markdown
2+
header-from: doc_fragments/header.md
3+
settings:
4+
anchor: true
5+
color: true
6+
default: true
7+
escape: true
8+
html: true
9+
indent: 2
10+
required: true
11+
sensitive: true
12+
type: true
13+
14+
15+
sort:
16+
enabled: true
17+
by: required
18+
19+
output:
20+
file: README.md
21+
mode: replace

‎modules/terraform-azure-cred-permissions/README.md‎

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
<!-- BEGIN_TF_DOCS -->
2+
# Terraform Module for Cloudera on Azure Credential Prerequisites
3+
4+
This module contains resource files and example variable definition files for creation of Cross Account Credential pre-requisite for Cloudera on Azure. This includes creation of a Azure Entra ID application, a client secret and a Service Principal with appropriate Role Assignments.
5+
6+
Support for using a pre-existing Entra Application is provided via the `existing_xaccount_app_client_id` input variable. When this is set resources are created. Instead a lookup of the details of the existing Entra ID application takes place and is returned.
7+
8+
## Usage
9+
10+
The [examples](./examples) directory has examples of Azure Resource Group creation:
11+
12+
* `ex01-minimal-inputs` uses the minimum set of inputs to create a Azure Entra ID Application suitable for Cloudera on Azure credential.
13+
14+
* `ex02-existing-app` passes a pre-existing Cross Account Application to the module. In this case no resources are created.
15+
16+
In each directory an example `terraform.tfvars.sample` values file is included to show input variable values.
17+
18+
## Requirements
19+
20+
| Name | Version |
21+
|------|---------|
22+
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.9.0 |
23+
| <a name="requirement_azuread"></a> [azuread](#requirement\_azuread) | 2.46.0 |
24+
| <a name="requirement_azurerm"></a> [azurerm](#requirement\_azurerm) | >= 4.0.0 |
25+
26+
## Providers
27+
28+
| Name | Version |
29+
|------|---------|
30+
| <a name="provider_azuread"></a> [azuread](#provider\_azuread) | 2.46.0 |
31+
| <a name="provider_azurerm"></a> [azurerm](#provider\_azurerm) | >= 4.0.0 |
32+
33+
## Modules
34+
35+
No modules.
36+
37+
## Resources
38+
39+
| Name | Type |
40+
|------|------|
41+
| [azuread_application.cdp_xaccount_app](https://registry.terraform.io/providers/hashicorp/azuread/2.46.0/docs/resources/application) | resource |
42+
| [azuread_application_password.cdp_xaccount_app_password](https://registry.terraform.io/providers/hashicorp/azuread/2.46.0/docs/resources/application_password) | resource |
43+
| [azuread_service_principal.cdp_xaccount_app_sp](https://registry.terraform.io/providers/hashicorp/azuread/2.46.0/docs/resources/service_principal) | resource |
44+
| [azurerm_role_assignment.cdp_xaccount_role](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/role_assignment) | resource |
45+
| [azuread_application.existing_xaccount_app](https://registry.terraform.io/providers/hashicorp/azuread/2.46.0/docs/data-sources/application) | data source |
46+
| [azuread_client_config.current](https://registry.terraform.io/providers/hashicorp/azuread/2.46.0/docs/data-sources/client_config) | data source |
47+
| [azurerm_subscription.sub_details](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/data-sources/subscription) | data source |
48+
49+
## Inputs
50+
51+
| Name | Description | Type | Default | Required |
52+
|------|-------------|------|---------|:--------:|
53+
| <a name="input_azure_subscription_id"></a> [azure\_subscription\_id](#input\_azure\_subscription\_id) | Azure Subscription ID | `string` | `null` | no |
54+
| <a name="input_existing_xaccount_app_client_id"></a> [existing\_xaccount\_app\_client\_id](#input\_existing\_xaccount\_app\_client\_id) | Client ID of existing Azure AD Application for Cloudera Cross Account. If set then no application or SPN resources are created. | `string` | `null` | no |
55+
| <a name="input_existing_xaccount_app_pword"></a> [existing\_xaccount\_app\_pword](#input\_existing\_xaccount\_app\_pword) | Password of existing Azure AD Application for Cloudera Cross Account. If set then no application or SPN resources are created. | `string` | `null` | no |
56+
| <a name="input_xaccount_app_name"></a> [xaccount\_app\_name](#input\_xaccount\_app\_name) | Cross account application name within Azure Active Directory | `string` | `null` | no |
57+
| <a name="input_xaccount_app_owners"></a> [xaccount\_app\_owners](#input\_xaccount\_app\_owners) | List principals object IDs that will be granted ownership of the Cross Account application. If not specified the executing principal will be set as the owner. | `list(string)` | `null` | no |
58+
| <a name="input_xaccount_app_password_end_date_relative"></a> [xaccount\_app\_password\_end\_date\_relative](#input\_xaccount\_app\_password\_end\_date\_relative) | The relative duration for which the password (client secret) for the Cross Account application is valid. | `string` | `"17520h"` | no |
59+
| <a name="input_xaccount_app_role_assignments"></a> [xaccount\_app\_role\_assignments](#input\_xaccount\_app\_role\_assignments) | List of Role Assignments for the Cross Account Service Principal. If scope is not specified then scope is set to var.azure\_subscription\_id | <pre>list(object({<br/> role = string<br/> description = string<br/> scope = optional(string)<br/> })<br/> )</pre> | <pre>[<br/> {<br/> "description": "Contributor Role to Cross Account Service Principal at Subscription Level",<br/> "role": "Contributor"<br/> }<br/>]</pre> | no |
60+
61+
## Outputs
62+
63+
| Name | Description |
64+
|------|-------------|
65+
| <a name="output_azure_xaccount_app"></a> [azure\_xaccount\_app](#output\_azure\_xaccount\_app) | Full details for the Azure AD Cross Account Application |
66+
| <a name="output_azure_xaccount_app_client_id"></a> [azure\_xaccount\_app\_client\_id](#output\_azure\_xaccount\_app\_client\_id) | Client ID for the Azure AD Cross Account Application |
67+
| <a name="output_azure_xaccount_app_pword"></a> [azure\_xaccount\_app\_pword](#output\_azure\_xaccount\_app\_pword) | Password for the Azure AD Cross Account Application |
68+
| <a name="output_azure_xaccount_service_principal_id"></a> [azure\_xaccount\_service\_principal\_id](#output\_azure\_xaccount\_service\_principal\_id) | ID for the Azure AD Cross Account Service Principal |
69+
<!-- END_TF_DOCS -->

‎modules/terraform-azure-cred-permissions/data.tf‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
# Copyright 2025 Cloudera, Inc. All Rights Reserved.
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
# Get the configuration of the AzureAD provider
16+
data "azuread_client_config" "current" {}
17+
18+
# Access information about Azure Subscription
19+
data "azurerm_subscription" "sub_details" {
20+
21+
count = local.create_xaccount_resources ? 1 : 0
22+
23+
subscription_id = var.azure_subscription_id
24+
}
25+
26+
# Lookup existing AzureAD application
27+
data "azuread_application" "existing_xaccount_app" {
28+
29+
count = local.create_xaccount_resources ? 0 : 1
30+
31+
client_id = var.existing_xaccount_app_client_id
32+
}

‎modules/terraform-azure-cred-permissions/defaults.tf‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
# Copyright 2023 Cloudera, Inc. All Rights Reserved.
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
locals {
16+
17+
# ------- Determine if resources should be created -------
18+
create_xaccount_resources = (var.existing_xaccount_app_client_id == null)
19+
20+
xaccount_app_owners = coalesce(var.xaccount_app_owners, [data.azuread_client_config.current.object_id])
21+
22+
}

‎modules/terraform-azure-cred-permissions/doc_fragments/header.md‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
# Terraform Module for Cloudera on Azure Credential Prerequisites
2+
3+
This module contains resource files and example variable definition files for creation of Cross Account Credential pre-requisite for Cloudera on Azure. This includes creation of a Azure Entra ID application, a client secret and a Service Principal with appropriate Role Assignments.
4+
5+
Support for using a pre-existing Entra Application is provided via the `existing_xaccount_app_client_id` input variable. When this is set resources are created. Instead a lookup of the details of the existing Entra ID application takes place and is returned.
6+
7+
## Usage
8+
9+
The [examples](./examples) directory has examples of Azure Resource Group creation:
10+
11+
* `ex01-minimal-inputs` uses the minimum set of inputs to create a Azure Entra ID Application suitable for Cloudera on Azure credential.
12+
13+
* `ex02-existing-app` passes a pre-existing Cross Account Application to the module. In this case no resources are created.
14+
15+
In each directory an example `terraform.tfvars.sample` values file is included to show input variable values.

‎modules/terraform-azure-cred-permissions/examples/ex01-minimal_inputs/main.tf‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
# Copyright 2025 Cloudera, Inc. All Rights Reserved.
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
terraform {
16+
required_version = ">= 1.5.7"
17+
required_providers {
18+
azuread = {
19+
source = "hashicorp/azuread"
20+
version = "2.46.0"
21+
}
22+
}
23+
}
24+
25+
provider "azuread" {
26+
}
27+
28+
provider "azurerm" {
29+
features {
30+
resource_group {
31+
prevent_deletion_if_contains_resources = false
32+
}
33+
}
34+
35+
}
36+
37+
# Access information about Azure Subscription
38+
data "azurerm_subscription" "current" {}
39+
40+
# ------- Azure Entra App -------
41+
module "ex01_xaccount_app" {
42+
source = "../.."
43+
44+
xaccount_app_name = "${var.env_prefix}-xaccount-app"
45+
azure_subscription_id = data.azurerm_subscription.current.subscription_id
46+
}

‎modules/terraform-azure-cred-permissions/examples/ex01-minimal_inputs/outputs.tf‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
# Copyright 2025 Cloudera, Inc. All Rights Reserved.
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
output "xaccount_app_client_id" {
16+
value = module.ex01_xaccount_app.azure_xaccount_app_client_id
17+
18+
description = "Cross Account application client ID"
19+
20+
}

0 commit comments

Comments
 (0)