使用 Terraform 生成 PAT Azure DevOps 令牌

Question

Story

I'm using Terraform for onboarding new Projects to Azure DevOps. I wanna eliminate all manual steps except Subscription creation. Firstly I'm creating AAD Group, then registering App, creating Service Principal and secret. After that I'm creating Azure DevOps project. And then I wanna create PAT token which will be used in this Project.

Issue

I successfully generate Bearer token, but when I'm using this token to generate PAT, I'm getting error like: TF401444: Please sign-in at least once as <tenant-id>\\<clientId> in a web browser to enable access to the service.

Creating Bearer Token:

curl -X POST -H 'Content-Type: application/x-www-form-urlencoded' \
https://login.microsoftonline.com/<tenantId>/oauth2/v2.0/token \
-d 'client_id=<clientId>' \
-d 'grant_type=client_credentials' \
-d 'scope=499b84ac-1321-427f-aa17-267ca6975798/.default' \
-d 'client_secret=<application secret>'

Generating PAT token (doesn't work)

curl -X POST 'https://vssps.dev.azure.com/<organizationId>/_apis/tokens/pats?api-version=6.1-preview.1' \
--header 'Content-Type: application/json' \
--header 'Authorization: Bearer ${token} ' \
--data-raw '{
    "displayName":"TokenFromAPI_1",
    "scope":"app_token",
    "validTo":"2022-12-22T00:00:00.000Z",
    "allOrgs":false
}'

API permission for Application

Details AFAIK there was missing the availability to create PAT via API for a long time. This was introduced this year if I'm not mistaken. I guess thats the reason why there is still not yet Terraform resource for generating PAT tokens yet. Anyway I wanna do that via REST API for this moment.

Answer 1

Terraform implicitly require az login to get the token information from the portal. Please ran the below command before running terraform plan

az account get-access-token

Upon authentication, please set the respective subscription using below command

az account set --subscription "**************************"

Run Terraform plan and apply later all setup.

terraform plan 
terraform apply -auto-approve