-
Notifications
You must be signed in to change notification settings - Fork 0
/
azuread_application.tf
109 lines (96 loc) · 5.17 KB
/
azuread_application.tf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
provider "azuread" {
tenant_id = var.tenant_id
client_id = var.azuread_client_id
client_secret = var.azuread_client_secret
}
data "azuread_client_config" "client_config_azuread_application" {}
resource "azuread_application" "application" {
display_name = var.solution_name
required_resource_access {
resource_app_id = data.azuread_service_principal.service_principal_graph.application_id
resource_access {
id = data.azuread_service_principal.service_principal_graph.app_role_ids["DeviceManagementManagedDevices.Read.All"]
type = "Role"
}
resource_access {
id = data.azuread_service_principal.service_principal_graph.app_role_ids["Mail.Send"]
type = "Role"
}
resource_access {
id = data.azuread_service_principal.service_principal_graph.app_role_ids["Policy.Read.All"]
type = "Role"
}
resource_access {
id = data.azuread_service_principal.service_principal_graph.app_role_ids["Reports.Read.All"]
type = "Role"
}
resource_access {
id = data.azuread_service_principal.service_principal_graph.app_role_ids["RoleManagement.Read.All"]
type = "Role"
}
}
required_resource_access {
resource_app_id = data.azuread_service_principal.service_principal_exchange_online.application_id
resource_access {
id = data.azuread_service_principal.service_principal_exchange_online.app_role_ids["Exchange.ManageAsApp"]
type = "Role"
}
}
}
resource "azuread_app_role_assignment" "app_role_assignment_graph_devicemanagementmanageddevices_read_all" {
principal_object_id = azuread_service_principal.service_principal_azure_ad_license_status.object_id
resource_object_id = data.azuread_service_principal.service_principal_graph.object_id
app_role_id = data.azuread_service_principal.service_principal_graph.app_role_ids["DeviceManagementManagedDevices.Read.All"]
}
resource "azuread_app_role_assignment" "app_role_assignment_graph_mail_send" {
principal_object_id = azuread_service_principal.service_principal_azure_ad_license_status.object_id
resource_object_id = data.azuread_service_principal.service_principal_graph.object_id
app_role_id = data.azuread_service_principal.service_principal_graph.app_role_ids["Mail.Send"]
}
resource "azuread_app_role_assignment" "app_role_assignment_graph_policy_read_all" {
principal_object_id = azuread_service_principal.service_principal_azure_ad_license_status.object_id
resource_object_id = data.azuread_service_principal.service_principal_graph.object_id
app_role_id = data.azuread_service_principal.service_principal_graph.app_role_ids["Policy.Read.All"]
}
resource "azuread_app_role_assignment" "app_role_assignment_graph_reports_read_all" {
principal_object_id = azuread_service_principal.service_principal_azure_ad_license_status.object_id
resource_object_id = data.azuread_service_principal.service_principal_graph.object_id
app_role_id = data.azuread_service_principal.service_principal_graph.app_role_ids["Reports.Read.All"]
}
resource "azuread_app_role_assignment" "app_role_assignment_graph_rolemanagement_read_all" {
principal_object_id = azuread_service_principal.service_principal_azure_ad_license_status.object_id
resource_object_id = data.azuread_service_principal.service_principal_graph.object_id
app_role_id = data.azuread_service_principal.service_principal_graph.app_role_ids["RoleManagement.Read.All"]
}
resource "azuread_app_role_assignment" "app_role_assignment_exchange_online_exchange_manageasapp" {
principal_object_id = azuread_service_principal.service_principal_azure_ad_license_status.object_id
resource_object_id = data.azuread_service_principal.service_principal_exchange_online.object_id
app_role_id = data.azuread_service_principal.service_principal_exchange_online.app_role_ids["Exchange.ManageAsApp"]
}
resource "azuread_application_certificate" "application_certificate" {
application_object_id = azuread_application.application.object_id
encoding = "hex"
type = "AsymmetricX509Cert"
value = azurerm_key_vault_certificate.key_vault_certificate.certificate_data
start_date = azurerm_key_vault_certificate.key_vault_certificate.certificate_attribute[0].not_before
end_date = azurerm_key_vault_certificate.key_vault_certificate.certificate_attribute[0].expires
}
data "azuread_service_principal" "service_principal_graph" {
# Provider: Microsoft Graph
application_id = "00000003-0000-0000-c000-000000000000"
}
data "azuread_service_principal" "service_principal_exchange_online" {
# Provider: Office 365 Exchange Online
application_id = "00000002-0000-0ff1-ce00-000000000000"
}
resource "azuread_service_principal" "service_principal_azure_ad_license_status" {
application_id = azuread_application.application.application_id
owners = [
data.azuread_client_config.client_config_azuread_application.object_id
]
}
resource "azuread_directory_role_assignment" "directory_role_assignment" {
# Role: Global Reader
principal_object_id = azuread_service_principal.service_principal_azure_ad_license_status.object_id
role_id = "f2ef992c-3afb-46b9-b7cf-a126ee74c451"
}