Enhance Entra ID login configuration and role assignments (#79)

rswrz · web-flow · commit 6b12830462b4 · 2025-06-17T14:10:45.000+02:00
Signed-off-by: Roman Schwarz &lt;rs@cloudeteer.de&gt;
diff --git a/README.md b/README.md
@@ -135,7 +135,8 @@ The following resources are used by this module:
 - [azurerm_managed_disk.this](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/managed_disk) (resource)
 - [azurerm_network_interface.this](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/network_interface) (resource)
 - [azurerm_public_ip.this](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/public_ip) (resource)
-- [azurerm_role_assignment.entra_id_login](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/role_assignment) (resource)
+- [azurerm_role_assignment.entra_id_login_admin](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/role_assignment) (resource)
+- [azurerm_role_assignment.entra_id_login_user](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/role_assignment) (resource)
 - [azurerm_user_assigned_identity.this](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/user_assigned_identity) (resource)
 - [azurerm_virtual_machine_data_disk_attachment.this](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/virtual_machine_data_disk_attachment) (resource)
 - [azurerm_virtual_machine_extension.domain_join](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/virtual_machine_extension) (resource)
@@ -502,15 +503,22 @@ Default: `true`
 
 ### <a name="input_entra_id_login"></a> [entra\_id\_login](#input\_entra\_id\_login)
 
-Description:   Configures Entra ID-based login for virtual machines. Set `enabled` to `true` to activate this feature and define the list of `principal_ids` permitted to log in.
+Description: Configures Entra ID-based login for virtual machines. Set `enabled` to `true` to activate this feature and specify the lists of `admin_login_principal_ids` and `user_login_principal_ids` that are permitted to log in.
+
 **Note**: This feature requires at least 1GB of memory and is not supported on certain SKUs, including `Standard_B1ls`, `Basic_A0`, and `Standard_A0`.
 
+**Note**: When specifying `admin_login_principal_ids` or `user_login_principal_ids`, this module will create Azure role assignments for those principals. The user deploying this module must have sufficient permissions to create role assignments (typically the `Owner` role or a custom role with the necessary permissions).
+
+**Deprecation Notice**: The `principal_ids` argument is deprecated and will be removed in version 2.0 of this module. Please use `admin_login_principal_ids` and `user_login_principal_ids` instead.
+
 Type:
 
 ```hcl
 object({
-    enabled       = optional(bool)
-    principal_ids = optional(list(string), [])
+    enabled                   = optional(bool)
+    principal_ids             = optional(list(string), []) # !! DEPRECATED !!
+    admin_login_principal_ids = optional(list(string), [])
+    user_login_principal_ids  = optional(list(string), [])
   })
 ```
 
diff --git a/r-extensions.tf b/r-extensions.tf
@@ -82,6 +82,29 @@ resource "azurerm_virtual_machine_extension" "entra_id_login" {
   }
 }
 
+resource "azurerm_role_assignment" "entra_id_login_admin" {
+  for_each = (
+    var.entra_id_login.enabled
+    ? toset(concat(var.entra_id_login.principal_ids, var.entra_id_login.admin_login_principal_ids))
+    : []
+  )
+
+  principal_id         = each.value
+  role_definition_name = "Virtual Machine Administrator Login"
+  scope                = local.virtual_machine.id
+}
+
+resource "azurerm_role_assignment" "entra_id_login_user" {
+  for_each = (
+    var.entra_id_login.enabled ? toset(var.entra_id_login.user_login_principal_ids) : []
+  )
+
+  principal_id         = each.value
+  role_definition_name = "Virtual Machine User Login"
+  scope                = local.virtual_machine.id
+}
+
+
 resource "azurerm_virtual_machine_extension" "domain_join" {
   count = var.domain_join.enabled ? 1 : 0
 
diff --git a/r-identity.tf b/r-identity.tf
@@ -14,10 +14,7 @@ resource "azurerm_user_assigned_identity" "this" {
   tags                = var.tags
 }
 
-resource "azurerm_role_assignment" "entra_id_login" {
-  for_each = var.entra_id_login.enabled ? toset(var.entra_id_login.principal_ids) : []
-
-  principal_id         = each.value
-  role_definition_name = "Virtual Machine Administrator Login"
-  scope                = local.virtual_machine.id
+moved {
+  from = azurerm_role_assignment.entra_id_login
+  to   = azurerm_role_assignment.entra_id_login_admin
 }
diff --git a/tests/local/input_entra_id.tftest.hcl b/tests/local/input_entra_id.tftest.hcl
@@ -20,11 +20,6 @@ run "entra_id_extension_and_identity_type_should_be_created" {
     error_message = "It is not possible to install the AAD-Extension without a given 'principal_id'."
   }
 
-  assert {
-    condition     = length(azurerm_role_assignment.entra_id_login) != 0
-    error_message = "It is not possible to install the AAD-Extension without a given 'principal_id'."
-  }
-
   assert {
     condition     = local.identity_type == "SystemAssigned"
     error_message = "It is not possible to install the EntraID-Extension without setting the Idenity to 'SystemAssigned' OR 'SystemAssigned, UserAssigned'."
@@ -51,11 +46,6 @@ run "entra_id_extension_and_add_identity_type_should_be_created" {
     error_message = "It is not possible to install the AAD-Extension without a given 'principal_id'."
   }
 
-  assert {
-    condition     = length(azurerm_role_assignment.entra_id_login) != 0
-    error_message = "It is not possible to install the AAD-Extension without a given 'principal_id'."
-  }
-
   assert {
     condition     = local.identity_type == "SystemAssigned, UserAssigned"
     error_message = "It is not possible to install the EntraID-Extension without setting the Idenity to 'SystemAssigned' OR 'SystemAssigned, UserAssigned'."
@@ -71,7 +61,12 @@ run "nothing_should_be_created_regarding_entra_id_login" {
   }
 
   assert {
-    condition     = length(azurerm_role_assignment.entra_id_login) == 0
+    condition     = length(azurerm_role_assignment.entra_id_login_admin) == 0
+    error_message = "No role_assignment for EntraID should be created when 'entra_id_login' is disabled."
+  }
+
+  assert {
+    condition     = length(azurerm_role_assignment.entra_id_login_user) == 0
     error_message = "No role_assignment for EntraID should be created when 'entra_id_login' is disabled."
   }
 
diff --git a/tests/remote/main.tf b/tests/remote/main.tf
@@ -75,4 +75,11 @@ module "tftest_02" {
   image               = "Ubuntu2204"
   key_vault_id        = local.key_vault_id
   subnet_id           = local.subnet_id
+
+  entra_id_login = {
+    enabled                   = true
+    principal_ids             = ["52c45cde-8aa6-45a7-b717-686d20a2fbbf"]
+    admin_login_principal_ids = ["52c45cde-8aa6-45a7-b717-686d20a2fbbf"]
+    user_login_principal_ids  = ["52c45cde-8aa6-45a7-b717-686d20a2fbbf"]
+  }
 }
diff --git a/variables.tf b/variables.tf
@@ -311,13 +311,22 @@ variable "encryption_at_host_enabled" {
 
 variable "entra_id_login" {
   description = <<-EOD
-      Configures Entra ID-based login for virtual machines. Set `enabled` to `true` to activate this feature and define the list of `principal_ids` permitted to log in.
+    Configures Entra ID-based login for virtual machines. Set `enabled` to `true` to activate this feature and specify the lists of `admin_login_principal_ids` and `user_login_principal_ids` that are permitted to log in.
+
     **Note**: This feature requires at least 1GB of memory and is not supported on certain SKUs, including `Standard_B1ls`, `Basic_A0`, and `Standard_A0`.
+
+    **Note**: When specifying `admin_login_principal_ids` or `user_login_principal_ids`, this module will create Azure role assignments for those principals. The user deploying this module must have sufficient permissions to create role assignments (typically the `Owner` role or a custom role with the necessary permissions).
+
+    **Deprecation Notice**: The `principal_ids` argument is deprecated and will be removed in version 2.0 of this module. Please use `admin_login_principal_ids` and `user_login_principal_ids` instead.
   EOD
+
   type = object({
-    enabled       = optional(bool)
-    principal_ids = optional(list(string), [])
+    enabled                   = optional(bool)
+    principal_ids             = optional(list(string), []) # !! DEPRECATED !!
+    admin_login_principal_ids = optional(list(string), [])
+    user_login_principal_ids  = optional(list(string), [])
   })
+
   default = ({
     enabled = false
   })

Original file line number	Diff line number	Diff line change
`@@ -14,10 +14,7 @@ resource "azurerm_user_assigned_identity" "this" {`
`14`	`14`	`tags = var.tags`
`15`	`15`	`}`
`16`	`16`
`17`		`-resource "azurerm_role_assignment" "entra_id_login" {`
`18`		`- for_each = var.entra_id_login.enabled ? toset(var.entra_id_login.principal_ids) : []`
`19`		`-`
`20`		`- principal_id = each.value`
`21`		`- role_definition_name = "Virtual Machine Administrator Login"`
`22`		`- scope = local.virtual_machine.id`
	`17`	`+moved {`
	`18`	`+ from = azurerm_role_assignment.entra_id_login`
	`19`	`+ to = azurerm_role_assignment.entra_id_login_admin`
`23`	`20`	`}`