CODEWITHSUNDEEP
terraformterraform-provider-azureazure-managed-identityterraform-cloud
admin
admin

Reputation: 65

Terraform authentication multi-subscription using multiple service principals

I want my terraform scripts to be able to authenticate on multiple azure subscriptions using multiple service principal.

Here is what I think:

$ export ARM_SUBSCRIPTION_ID=159f2485-xxxx-xxxx-xxxx-xxxxxxxxxxxx     # Client subscription
$ export ARM_CLIENT_ID=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx           # client_id of the service principal
$ export ARM_CLIENT_SECRET=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
$ export ARM_TENANT_ID=72f988bf-xxxx-xxxx-xxxx-xxxxxxxxxxxx           # the same tenant for all clients

Is this correct?

Do you have a more secure way to authenticate on multiple subscriptions when using terraform cloud? (ideally without client_secret)

Upvotes: 0

Views: 1373

Answers (1)

Charles Xu
Charles Xu

Reputation: 31452

If the container instance can run Terraform script, then there is no problem with the steps. You give permission to the service principal and change the environment variable ARM_SUBSCRIPTION_ID for different subscriptions, then Terraform script works for different subscriptions.

A safer way is to use the authentication with Azure CLI. If you set different subscriptions with the CLI command:

az account set --subscription="SUBSCRIPTION_ID"

Then the Terraform script will also work for different subscriptions. In this way you don't need to set the secret as the environment variable.

Upvotes: 1

Related Questions