Terraform - Azure 服务主体部署 - 权限不足

Question

我正在尝试创建 azure 服务主体。我正在使用服务主体从我的笔记本电脑连接到 azure，我添加了所需的权限，服务主体（我用来连接到 azure）是全局管理员的成员，sp 是应用程序开发人员和应用程序管理员角色的成员天蓝色的广告。为了连接到 Azure，我使用了以下 PowerShell 命令。

$ApplicationId = "aaa"
$AppPassword = "bbb"
$TenantId = "ccc"
$SecuredPassword = ConvertTo-SecureString -String $AppPassword -AsPlainText -Force

$Credential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList 
$ApplicationId, $SecuredPassword
Connect-AzAccount -ServicePrincipal -TenantId $TenantId -Credential $Credential

当我尝试运行时 - terraform apply -var-file="variables.tfvars" 出现错误：

with azuread_application.azuread_app,
│   on service-principal.tf line 3, in resource "azuread_application" "azuread_app":
│    3: resource "azuread_application" "azuread_app" {
│
│ ApplicationsClient.BaseClient.Post(): unexpected status 403 with OData error: Authorization_RequestDenied: Insufficient privileges to complete the operation.

我能够毫无问题地部署其他资源。我正在使用位于 Azure 容器上的远程后端状态文件。

下面的地形代码：

data "azuread_client_config" "client_config" {}

resource "azuread_application" "azuread_app" {
  display_name = "sp_name"
  owners       = [data.azuread_client_config.client_config.object_id]
}

resource "azuread_service_principal" "azuread_sp" {
  application_id               = azuread_application.azuread_app.application_id
  app_role_assignment_required = false
  owners                       = [data.azuread_client_config.client_config.object_id]
}

resource "azuread_service_principal_password" "azuread_sp_password" {
  service_principal_id = azuread_service_principal.azuread_sp.object_id
}

Answer 1

我使用以下代码在我的环境中测试了相同的场景，Service Principal 已从 terraform 成功创建。

terraform {
  backend "azurerm" {
    storage_account_name = "cloudshellansuman123" # replace with your storage account name
    container_name       = "test" #replace with your container name
    key                  = "terraform.tfstate"
    access_key = "ukyaH/Jxxxxxxxxxxxxxxxxx="#replace with your storage account access key
  }  
}

provider "azurerm" {
    features{}
  client_id="de398e56-xxxxxxxxxxxxxxxxxx-20d07416ecb0"#replace with your service principal client ID which you are using to connect with Azure
  client_secret= "-IP7Q~uDLoxxxxxxxxxxxxRGtHMMXj7-.-lA"#replace with your service principal client Secret which you are using to connect with Azure
  tenant_id = "ab07xxxxxxxxxxxxxxx--xxx-620b694ded30"#replace with your AzureAD tenant ID which the subscription is a part of 
  subscription_id="8xxxxxxxxxxx-xxxxxxx-xxxxxxxxx-xxae"#replace with your Subscription ID on Which the Service Principal has Owner/Contributor access
}


provider "azuread" {
  client_id="de398e-xx-x-x-x-x-x-x-x416ecb0"#replace with your service principal client ID which you are using to connect with Azure AD
  client_secret= "-IP7Q~uDLoxxxxxxxxxxxxxxGtHMMXj7-.-lA"#replace with your service principal client Secret which you are using to connect with Azure AD
  tenant_id = "ab0xxxxxxxxxxxxxxx-xxxxxxxxx-xxxxxxxx30"#replace with your AzureAD tenant ID which the subscription is a part of 
}

data "azuread_client_config" "current" {}

resource "azuread_application" "terraform" {
  display_name = "Ansumantest"
  owners       = [data.azuread_client_config.current.object_id]
}

resource "azuread_application_password" "terraform" {
  application_object_id = azuread_application.terraform.object_id
}

 resource "azuread_service_principal" "terraform" {
   application_id = azuread_application.terraform.application_id
   owners         = [data.azuread_client_config.current.object_id]
 }

为了测试，我创建了一个用于连接 Azure 的服务主体，并授予了您授予的所有相同权限，并在订阅中添加了 Owner 访问权限，如下所示：强>

输出：

注意：使用上述代码，您无需再次使用 PowerShell 连接到 Azure。它将使用.tf 配置直接进行身份验证。还要确保在 terraform 中使用最新的 AzureRM 和 AzureAD 提供程序版本，即分别为 2.95.0 和 2.17.0。