Terraform - Adding specific users to a specific group - azure-active-directory

Question

I have a 2 csv files named "_member.csv" and "_groups.csv".
Content from _member.csv :
first_name,last_name,department,job_title
Albator,Albator,Exploitation,Integrateur d'exploitation
Bingo,Bingo,Exploitation,Ingenieur de production
Cresus,Cresus,Etudes et developpements, Analyste developpeur
Content from _groups.csv :
members_groups
adm-xxx
exp-xxx
cod-xxx
tec-xxx
met-xxx
svc-xxx
My resource to create users :
resource "azuread_user" "Terra-Aad-User-Member" {
for_each = { for user in local.azure_members : user.first_name => user }
user_principal_name = format(
"%s%s#%s",
substr(lower(each.value.first_name), 0, 1),
lower(each.value.last_name),
local.domain_name
)
password = format(
"%s%s%s!",
lower(each.value.last_name),
substr(lower(each.value.first_name), 0, 1),
length(each.value.first_name)
)
force_password_change = true
display_name = "${each.value.first_name} ${each.value.last_name}"
department = each.value.department
job_title = each.value.job_title
}
My resource to create groups :
resource "azuread_group" "Terra-Aad-Group" {
for_each = { for group in local.azure_groups : group.members_groups => group }
display_name = format("%s", lower(each.value.members_groups))
security_enabled = true
}
My resource to add users to groups :
resource "azuread_group_member" "Terra-Aad-Member-In-Group" {
for_each = { for u in azuread_user.Terra-Aad-User-Member : u.department => u... if u.department == "Exploitation" }
group_object_id = values(azuread_group.Terra-Aad-Group).0.object_id
member_object_id = each.value.id
}
The provider :
terraform {
required_providers {
azuread = {
source = "hashicorp/azuread"
version = "=2.28.1"
}
}
}
provider "azuread" {
tenant_id = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
}
data "azuread_domains" "Terra-Aad" {
only_initial = true
}
My variables.tf
locals {
domain_name = data.azuread_domains.Terra-Aad.domains.0.domain_name
azure_members = csvdecode(file("${path.module}/_member.csv"))
azure_groups = csvdecode(file("${path.module}/_groups.csv"))
}
When I launch 'terraform plan', I have this error :
│ Error: Unsupported attribute
│
│ on groupmember.tf line 5, in resource "azuread_group_member" "Terra-Aad-Member-In-Group":
│ 5: member_object_id = each.value.id
│ ├────────────────
│ │ each.value is tuple with 2 elements
│
│ This value does not have any attributes.
Is it possible to automatically add all users who have the department 'Exploitation' to the group 'adm-xxx'? The problem is in the line 'member_object_id = each.value.id' I may need a conditional expression but I don't know exactly what that line is.
Does anyone have an idea?
Ok. So I added a null_resource to get all the ids of my users who are on the "Exploitation" department like this :
resource "null_resource" "Id-Department" {
provisioner "local-exec" {
command = "az ad user list --filter \"department eq 'Exploitation'\" --query \"[].id\" -o tsv"
interpreter = ["PowerShell", "-Command"]
}
depends_on = [azuread_user.Terra-Aad-User-Member]
}
I modified my resource azuread_group_member like this :
resource "azuread_group_member" "Terra-Aad-Member-In-Group" {
for_each = { for u in azuread_user.Terra-Aad-User-Member : u.department => u... if u.department == "Exploitation" }
group_object_id = values(azuread_group.Terra-Aad-Group).0.object_id
member_object_id = null_resource.Id-Department
depends_on = [null_resource.Id-Department]
}
Now I get this error :
│ Error: Incorrect attribute value type
│
│ on groupmember.tf line 13, in resource "azuread_group_member" "Terra-Aad-Member-In-Group":
│ 13: member_object_id = null_resource.Id-Department
│ ├────────────────
│ │ null_resource.Id-Department is object with 2 attributes
│
│ Inappropriate value for attribute "member_object_id": string required.
What I need is to take all the results of the command in null_resource to this: member_object_id = null_resource.Id-Department
Is there a way to do this ?

Answer 1

For starters, it seems most simple just to extract the groups to a list. Then for azuread_group, you can just use toset. Once that is done, you can reference this group by the group name in the object. So within azuread_group_member you use the for expression to get only members that are have "Exploitation" - you can reference their member_object_id by each.value.object_id. And you can get the group_object_id from the set-built azuread_group objects.
locals {
azure_groups = [for v in csvdecode(file("${path.module}/_groups.csv")) : v.members_groups]
azure_members = csvdecode(file("${path.module}/_member.csv"))
}
resource "azuread_user" "Terra-Aad-User-Member" {
for_each = { for user in local.azure_members : "${user.first_name}-${user.last_name}" => user }
user_principal_name = format(
"%s%s#%s",
substr(lower(each.value.first_name), 0, 1),
lower(each.value.last_name),
local.domain_name
)
password = format(
"%s%s%s!",
lower(each.value.last_name),
substr(lower(each.value.first_name), 0, 1),
length(each.value.first_name)
)
force_password_change = true
display_name = "${each.value.first_name} ${each.value.last_name}"
department = each.value.department
job_title = each.value.job_title
}
resource "azuread_group" "Terra-Aad-Group" {
for_each = toset(local.azure_groups)
display_name = lower(each.value)
security_enabled = true
}
resource "azuread_group_member" "Terra-Aad-Member-In-Group" {
for_each = {
for k, v in azuread_user.Terra-Aad-User-Member :
k => v if v.department == "Exploitation"
}
group_object_id = azuread_group.Terra-Aad-Group["adm-xxx"].object_id
member_object_id = each.value.object_id
}
As an aside, I have no idea how a null_resource is relevant here. You should have all the information you need without it.