Assign a managed identity access to an application role using Terraform

Question

I want to assign a managed identity access to an application role using Terraform.

I found a similar procedure, but it uses PowerShell. I want to do that with Terraform.
https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/how-to-assign-app-role-managed-identity-powershell

resource "azuread_application_app_role" "AppRole1" {
  application_object_id = azuread_application.ResourceController.id
  allowed_member_types  = ["Application"]
  description           = "All access"
  display_name          = "All access"
  is_enabled            = true
  value                 = "All"
}

resource "azurerm_role_assignment" "assignment1" {
  principal_id = data.azuread_service_principal.website.id # This is a managed identity.
  role_definition_id = azuread_application_app_role.AppRole1.id
  scope= azuread_application_app_role.ResourceController.id # ???
}

What should I specify in the scope field or this isn't possible with Terraform?

Charles Xu Charles Xu · Accepted Answer · 2021-04-08T05:58:41

The scope is the resource Id that you want to assign the managed identity with the role. For example, you want to assign the managed identity to the VM with the role you create. Then the scope is the VM resource ID like this:

"/subscriptions/subscription_id/resourceGroups/group_name/providers/Microsoft.Compute/virtualMachines/vm_name"

Assign a managed identity access to an application role using Terraform

2 Answers