How do I create multiple resource groups with storage accounts for a list of users using list/count in Azure Terraform?

I have two main files (main.tf) and a module (users.tf), and I want to create one resource group and one storage account for each user.

With current setup I'm only able to create a storage account in the main resource group for each user.

Here is a example of what I already achieved:

main.tf

#azterraform {
terraform {
  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "2.81.0"
    }
  }
}

# Configure the Microsoft Azure Provider
provider "azurerm" {
  features {}    
}

# main Resource Group
resource "azurerm_resource_group" "main-rg" { 
  name      = "RG-MAIN"
  location  = "easteurope"
}

# users module
module "users" {
  source               = "./modules/users"
  resource_group       = azurerm_resource_group.main-rg
  
  for_each             = toset( ["user1", "user2", "user3"] )
  resource_unique_id   = each.key
}

users.tf

# Create the Users Resource Group
resource "azurerm_resource_group" "users-rg" {
  name     = upper("RG-${var.resource_unique_id}-${var.config.suffix_nodash}")
  location = var.config.location
  tags     = var.config.tags
}

# Grant contributor access to users ad-group
resource "azurerm_role_assignment" "users-contributor" {
  scope                = azurerm_resource_group.users-rg.id
  role_definition_name = "Contributor"
  principal_id         = var.config.users-adgroup-id
}

# Grant contributor access to DDA Service principal
resource "azurerm_role_assignment" "DDA-sp-contributor" {
  scope                = azurerm_resource_group.users-rg.id
  role_definition_name = "Contributor"
  principal_id         = var.config.dda-service-principal-id
}

# Create storage account in Users resource group
resource "azurerm_storage_account" "users-storage-account" {
  name                     = lower("st${var.resource_unique_id}${var.config.suffix_nodash}")
  resource_group_name      = azurerm_resource_group.users-rg.name
  location                 = azurerm_resource_group.users-rg.location
  account_tier             = "Standard"
  account_replication_type = "LRS"
}

variable.tf file:

variable "config" {
  description = "(required) configuration variable value from the root module"
}

variable "resource_group" {
  description = "(required) resource group for resources"
}

variable "resource_unique_id" {
  description = "(required) resource unique identifier"
}

config.json

{
    "config": {
      "region": "East Europe",
      "suffix": "-eeu",
      "suffix_nodash": "eeu",
      "resource-acronym": "dda",      
      "tags": {
        "Creator": "[email protected];",
        "Managedby": "[email protected]; [email protected]; [email protected];",
        "Project": "DDA",
        "Projectversion": "1.0"
      },
      "location": "easteurope",
      "azure_environment": {
        "resource_manager_url": "https://management.azure.com/",
        "authority": "https://login.microsoftonline.com/"
      },
      "users-adgroup-id": "abcd-abcd-abcd-abcd-abcd",
      "dda-service-principal-id": "xyz-xyz-xyz-xyz-xyz"      
  } 
}

CodePudding user response：

With the following changes, the code works:

1. Add a variable.tf file at the root module level that defines the "config" variable

2. Pass the "config" variable to the "users" module in main.tf

3. Pass config.json to terraform with the '-var-file' option

To help with understandability, consider using native Terraform for your config file rather than JSON - unless you have a strong case for the latter.

Directory structure

config.json
main.tf
variable.tf   <<<<<<< Added this file
 \modules
    \users
        users.tf
        variable.tf

variable.tf (root module level)

variable "config" {
  description = "(required) configuration variable value from the root module"
}

main.tf

# users module
module "users" {
  source               = "./modules/users"
  resource_group       = azurerm_resource_group.main-rg
  config               = var.config           <<<<<<<<<<<<<<<<<<<<<<<<<< Added
  
  for_each             = toset( ["user1", "user2", "user3"] )
  resource_unique_id   = each.key
}

Executed from root module directory

terraform init
terraform plan -var-file="./config.json"
terraform apply -var-file="./config.json"

Resource listing (after running terraform apply)

$ az resource list --query "[?contains(name, 'stuser')].{type:type, name:name, resourceGroup:resourceGroup}"
[
  {
    "name": "stuser1eeu",
    "resourceGroup": "RG-USER1-EEU",
    "type": "Microsoft.Storage/storageAccounts"
  },
  {
    "name": "stuser2eeu",
    "resourceGroup": "RG-USER2-EEU",
    "type": "Microsoft.Storage/storageAccounts"
  },
  {
    "name": "stuser3eeu",
    "resourceGroup": "RG-USER3-EEU",
    "type": "Microsoft.Storage/storageAccounts"
  }
]