How can one use Azure Service Connection in Azure DevOps Server 2019 (on-prem) to run terraform from a script running in a release stage?

user_80002 0
Viewed 562

So I am aware of a couple Azure DevOps terraform tasks. But we wrap our terraform calls with powershell scripts, so these tasks are of no use to us.

So, given that we call terraform from scripts the only way we could find to make terraform authenticate is by following this procedure:

  1. Create Service Connection using the Service Principal dedicated to the pod
  2. Create a variable group and link it to the Key Vault containing the SP credentials.
  3. Every task running the powershell code wrapping terraform would have environment variables ARM_CLIENT_ID and ARM_CLIENT_SECRET mapped to the variables in the variable group from (2). ARM_TENANT_ID and ARM_SUBSCRIPTION_ID are set accordingly.

But this is incredibly cumbersome. Is it possible to do it with just the Service Connection?

terraform azure-devops azure powershell authentication
1 Answers

Is it possible to do it with just the Service Connection?

I am afraid it is impossible to do it with just the Service Connection for the powershell scripts.

According to the Microsoft replied:

This is as per service connection design and security considerations. Scripts in the build or release are not allowed to access secrets stored in service connections.

You can check the ticket here.

Hope this helps.

user_74607770
Related