Terraform - Impossible to apply rights at the same time as creating groups

Cookies 0
Viewed 32

I have to put a list of groups (var.dev) in the group 'cod-xxx01'. My terraform creates all the groups and rights at the same time.

Is there a way to retrieve this list once the groups are created ? The 'depends_on' does not seem to work.

The problem is if groups in my variable "codeur" are not created, I have this error :

│ Error: Invalid index
│
│   on RightGroupMember.tf line 35, in resource "azuread_group_member" "Terra-Aad-Member-Con-Dev-Reader":
│   35:   group_object_id  = azuread_group.Terra-Aad-Group-Right["${var.dev[count.index]}"].object_id
│     ├────────────────
│     │ azuread_group.Terra-Aad-Group-Right is object with 65 attributes
│     │ count.index is 10
│     │ var.dev is list of string with 11 elements
│
│ The given key does not identify an element in this collection value.

My code is :

variable "dev" {
  type = list(string)
  default = [
    "rea-vma-dev01",
    "rea-vma-rec01",
    "rea-vma-pre04",
    "con-bql-dev01",
    "rea-bql-rec01",
    "rea-ins-dev01",
    "rea-ins-rec01",
    "rea-ins-pre04",
    "rea-rmq-dev01",
    "rea-rmq-rec01",
    "rea-rmq-pre04",
  ]

  description = "Access for 'cod-xxx01'"
}

resource "azuread_group_member" "Terra-Aad-Member-Con-Dev-Reader" {
  count = length(var.dev)

  group_object_id  = azuread_group.Terra-Aad-Group-Right["${var.dev[count.index]}"].object_id
  member_object_id = azuread_group.Terra-Aad-Group["cod-xxx01"].object_id

  depends_on = [
    azuread_group.Terra-Aad-Group-Right
  ]
}

Thank you so much.

The others resource are : For groups :

Right_Groups = {for x in csvdecode(file("${path.module}/_RightGroups.csv")) : x.droits_groups => x.description}

resource "azuread_group" "Terra-Aad-Group-Right" {
  for_each = local.Right_Groups

  display_name     = lower(each.key)
  security_enabled = true
  description      = each.value
}

The CSV for 'Right_Groups' :

droits_groups,description
rea-vma-dev01,dev01
rea-vma-rec01,rec01
rea-vma-pre04,pre04
con-bql-dev01,dev01
rea-bql-rec01,rec01
rea-ins-dev01,dev01
rea-ins-rec01,rec01
rea-ins-pre04,pre04
rea-rmq-dev01,dev01
rea-rmq-rec01,rec01
rea-rmq-pre04,pre04

I think it has everything you need.

terraform-provider-azure azure-active-directory terraform
1 Answers

What I would suggest here is using resource chaining with for_each [1]. So the azuread_group can remain as is, but you would have to change the azuread_group_member resource:

resource "azuread_group_member" "Terra-Aad-Member-Con-Dev-Reader" {
  for_each = azuread_group.Terra-Aad-Group-Right

  group_object_id  = each.value.object_id
  member_object_id = azuread_group.Terra-Aad-Group["cod-xxx01"].object_id
}

[1] https://www.terraform.io/language/meta-arguments/for_each#chaining-for_each-between-resources

Marko E0
Related