How to add remote azure repo for terraform modules to make terraform code work on Azure pipelines

Question

Source definition given below works for terraform modules BUT it has a PAT TOKEN. Works fine on local VM as well as on Azure Pipelines. This question is about how to define source definition for terraform modules but without hard coding PAT TOKEN

Working copy of code:

source = "git::https://<PAT TOKEN>@<AZURE DEVOPS URL>/DefaultCollection/<Project Name>y/_git/terraform-modules//<sub directory>"

I tried the below:

    git::https://<AZURE DEVOPS URL>/DefaultCollection/<Project Name>/_git/terraform-modules.git//<sub directory>

That gave me error like below:

"git::https://<AZURE DEVOPS URL>/DefaultCollection/<Project Name>/_git/terraform-modules":
error downloading
'https://<AZURE DEVOPS URL>/DefaultCollection/<Project Name>/_git/terraform-modules':
/usr/bin/git exited with 128: Cloning into
'.terraform/modules/resource_group'...
fatal: could not read Username for 'https://<AZURE DEVOPS URL>':
terminal prompts disabled

Added my user name without the domain part like below:

source                  = "git::https://<USERNAMEM@<AZURE DEVOPS URL>/DefaultCollection/<PROJECT NAME>/_git/terraform-modules.git//compute"

Error below:

"git::https://<USERNAME>@<AZURE DEVOPS>/DefaultCollection/<PROJECT>/_git/terraform-modules.git":
error downloading
'https://<USERNAME>@<AZURE DEVOPS>/DefaultCollection/<PROJECT>/_git/terraform-modules.git':
/usr/bin/git exited with 128: Cloning into '.terraform/modules/sql_vms'...
fatal: could not read Password for
'https://<USERNAME>@<AZURE DEVOPS>': terminal prompts disabled

When Build pipeline can do checkout even without specifying username and password why do we have to mention in terraform code.

Azure Pipeline Agent has git credentials. Not sure if this is going to work at all without PAT Token?

https://<USERNAME>@<AZURE DEVOPS>/DefaultCollection/<PROJECT>/_git/terraform-modules.git, if you're trying to access devops repos by this format, you can also use git credential or ssh. See this. — LoLance

mark mark · Accepted Answer · 2020-04-19T00:26:02

Have a look at this - Is it possible to authenticate to a remote Git repository using the default windows credentials non interactively?

So, in our case we discovered that just running git config --global http.emptyAuth true before terraform resolves the problem. The :@ business is not needed, unless your terraform module repository is an LFS repo. But this is not our case, so we did not need it.

How to add remote azure repo for terraform modules to make terraform code work on Azure pipelines

1 Answers