使用 terraform（无效的 UUID）创建 Azure AD 应用程序

Question

I am using terraform to create an Azure AD application, I have tried the default example from the terraform samples https://registry.terraform.io/providers/hashicorp/azuread/latest/docs/resources/application also I have customized the code below from the one I created manually(basically, I have created an application manually in AD and got the details from the data resource using terraform for the created application). both the code throws same error

Error: Value must be a valid UUID │ │ with azuread_application.example, │ on adapp.tf line 3, in resource "azuread_application" "example": │ 3: resource "azuread_application" "example" {

This is the code I have customized from the original example

data "azuread_client_config" "current" {}

resource "azuread_application" "example" {
  display_name     = "example"
  identifier_uris  = ["api://example-app"]
  owners           = [data.azuread_client_config.current.object_id]
  sign_in_audience = "AzureADMultipleOrgs"

  required_resource_access {
    resource_app_id = "00000003-0000-0000-c000-000000000000"
    resource_access {
      id   = "..."
      type = "Scope"
    }
  }

  web {
    redirect_uris = ["https://app.example.net/account"]

    implicit_grant {
      access_token_issuance_enabled = false
    }
  }
}

I have validated the "data.azuread_client_config.current.object_id", its not null and it producing the value.

Terraform Config:

Terraform v0.15.4 on windows_amd64

• provider registry.terraform.io/hashicorp/azuread v1.6.0

Answer 1

As you are using the resource app id of "Microsoft Graph" (00000003-0000-0000-c000-000000000000), so you have to provide what delegated permissions you need for your app to have in Microsoft graph like User.read etc.

Some CLI commands that will help you to get the Microsoft Graph resource App Id's and Delegated Permissions Id's:

 - az ad sp list --display-name "Microsoft Graph" --query
   '[].{appDisplayName:appDisplayName, appId:appId}' 
           --output table
 - az ad sp show --id 00000003-0000-0000-c000-000000000000 --query
   "oauth2Permissions[].{Value:value, Id:id}" --output table

So as you are already using the default Microsoft Graph App Id, we need to get the delegated permission ID's to provide in resource access id.

Then your terraform code will be as below:

data "azuread_client_config" "current" {}

resource "azuread_application" "example" {
  display_name     = "example"
  identifier_uris  = ["api://example-app"]
  owners           = [data.azuread_client_config.current.object_id]
  sign_in_audience = "AzureADMultipleOrgs"

  required_resource_access {
    resource_app_id = "00000003-0000-0000-c000-000000000000"# resourceid of microsoft graph
    resource_access {
      id   = "e1fe6dd8-ba31-4d61-89e7-88639da4683d"  # User.Read
      type = "Scope"
    }
  }

  web {
    redirect_uris = ["https://app.example.net/account"]

    implicit_grant {
      access_token_issuance_enabled = false
    }
  }
}

Doing a terraform plan:

Note: Default Microsoft Graph App ID is "00000003-0000-0000-c000-000000000000" and Default Windows Active Directory App ID (Azure AD Graph) is "00000002-0000-0000-c000-000000000000" . Based on your requirement you can use Microsoft Graph or Azure AD Graph.