Azure meshPlatform Module

Terraform module to integrate Azure as a meshPlatform into meshStack instance. With this module, service principals used by meshStack are created with the required permissions. The output of this module is a set of credentials that need to be configured in meshStack as described in meshcloud public docs.

We currently support Microsoft Enterprise Agreements and Microsoft Customer Agreements as well as pre-provisioned subscriptions when integrating Azure as a meshPlatform.

Prerequisites

To run this module, you need the following:

• Terraform installed (already installed in Azure Portal)
• Azure CLI installed (already installed in Azure Portal)
• Permissions on AAD level. If using Microsoft Customer Agreement, AAD level permissions must be set in the Tenant Directory that will create the subscriptions (Source Tenant) as well as the Tenant Directory that will receive the subscriptions (Destination Tenant). An Azure account with one of the following roles:
  1. Global Administrator
  2. Privileged Role Administrator AND (Cloud) Application Administrator
• Permissions on Azure Resource Level: User Access Administrator on the Management Group that should be managed by meshStack

How to Use This Module

Using Azure Portal

If using a Microsoft Customer Agreement, go through these steps in the Destination Tenant

1. Login into Azure Portal with your Admin user.

2. Open a cloud shell.

3. Create a terraform file that calls this module and produces outputs. Similar to:

   module "meshplatform" {
     source = "git::https://github.com/meshcloud/terraform-azure-meshplatform.git"
     # FILL INPUTS
   }
   output "meshplatform" {
     sensitive = true
     value     = module.meshplatform
   }

   It is highly recommended to configure a terraform backend, otherwise you risk losing track of your applied resources.

4. Execute the module.

   # Changes into ~/terraform-azure-meshplatform and applies terraform
   cd ~/terraform-azure-meshplatform
   terraform init
   terraform apply

5. Use the information from terraform output to configure the platform in meshStack.

   # The JSON output contains sensitive values that must not be transmitted anywhere other then the platform config screen in meshStack.
   terraform output -json

Using CLI

1. Login with az CLI

   az login --tenant TENANT_ID

2. Follow the instructions for Azure Portal

Configuring the Azure meshPlatform module

Using an Enterprise Agreement

Using an Enterprise Agreement enrollment account requires manual steps outside of terraform.

1. Ensure you have permissions on Enterprise Agreement level: Account Owner for the enrollment account that should be used for creating subscriptions
2. Grant access on the enrollment account as described in the section Use an Enteprise Enrollment.

Using Microsoft Customer Agreement

Prerequisites:

• Ensure you have permissions in the source AAD Tenant for granting access to the billing account used for subscription creation using the Account Administrator role

Create MCA service principals:

With this module, you can create multiple MCA service principals by passing a list of mca.service_principal_names. This is useful for environments with restricted acceses to the AAD tenant holding the MCA license.

Add an mca block when calling this module.

e.g.:

module "meshplatform" {
  source  = "meshcloud/meshplatform/azure"
  # required inputs

  mca = {
      service_principal_names = ["your-mca-sp-name-1", "your-mca-sp-name-2", "..."]
      billing_account_name    = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx:xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx_xxxx-xx-xx"
      billing_profile_name    = "xxxx-xxxx-xxx-xxx"
      invoice_section_name    = "xxxx-xxxx-xxx-xxx"
  }
}

Using Pre-provisioned Subscriptions

meshStack will need to be able to read subscriptions at the source location (typically the root of your management group hierarchy) and then have permission to rename them. Please include the following additional_permission when configuring this terraform module.

  additional_permissions = ["Microsoft.Subscription/rename/action"]

Enabling Azure Functions for Landing Zones

In order to enable meshStack to call Azure Functions as part of tenant replication for your landing zones, you must provide the SPN with access to the function.

  additional_required_resource_accesses = [
    # The block below configures replicator access
    # to the app with id `fe81736c-99c6-4fca-8cc2-2818a2365451` with the appRole with id `e29066a1-ecb1-4a8e-af2d-1627fae35711`
    #
    # This example configures access to an azure function
    {
      resource_app_id = "fe81736c-99c6-4fca-8cc2-2818a2365451" # https://registry.terraform.io/providers/hashicorp/azuread/latest/docs/resources/application#resource_app_id
      resource_accesses = [
        # https://registry.terraform.io/providers/hashicorp/azuread/latest/docs/resources/application#resource_access
        {
          id   = "e29066a1-ecb1-4a8e-af2d-1627fae35711"
          type = "Role"
        },
      ]
    },
  ]

Single Sign On (SSO) Integration

While this does not belong to a meshplatform, you can enable sso using this module. This is subject to change and sso can be moved out in the future.

To login to meshStack with Microsoft Entra ID, you can create an SSO service principal by adding the following inputs when calling this module:

sso_enabled = true

# This is required as it will construct the redirect uri. A default has been added only so that it's not mandatory to setup sso (i.e. when sso_enabled = false)
sso_meshstack_idp_domain = "sso.<domain>"

Contributing Guide

Before opening a Pull Request, please do the following:

1. Install pre-commit

   We use pre-commit to perform several terraform related tasks such as terraform validate, terraform fmt, and generating terraform docs with terraform_docs

2. Execute pre-commit install: Hooks configured in .pre-commit-config.yaml will be executed automatically on commit. For manual execution, you can use pre-commit run -a.

Requirements

Providers

Modules

Resources

Inputs

object({
    service_principal_names = list(string)
    billing_account_name    = string
    billing_profile_name    = string
    invoice_section_name    = string
  })

Outputs