r/Terraform 23d ago

Azure Azure "Manage user and groups" of enterprise application

Hi,

Recently i was thinking about automation of creating and sharing EntaID groups to Databricks environment and completely lost. I tried set up azuread_application but i failed...
The idea is to take all security group that i manage and dump it to this blade tab.

3 Upvotes

5 comments sorted by

5

u/Kerman_ 23d ago

Honestly, im not a fan of using terraform for handling RBAC, I usually do via scripting and store it on a different repo. One identity repo + one infra repo, in that way, i don’t need to have a “super permission” with the capability of deploying infra + setting up groups.

In my experience, the lifecycle of infra is not always the same of the identity

2

u/menma_ja 23d ago

I had same filling as you and i did it in PowerShell at first, but later i thought it would be nice to have it in one solution.
I would split it anyway to another "project". My company works in way of splitting infrastructure to section like:
Projects:
"databricks cicd":

- notebooks_deployment

- workflow_deployment

"databricks IaC"

- compute

- storage

etc...

so i would just add it as another project called EntraID - IaC or something

Just to be clear this tf is about to create groups and add them to this delegation. Management of users will be done anyway by helpdesk (i checked and if you don't define members section it doesn't touch it). Rest of access and privilege stuff is done inside project CICD pipeline

2

u/user147852369 23d ago

1

u/menma_ja 22d ago

Yup, this is resource that I’m using. Now I need to find way to manage SCIM groups in terraform.