3 issues in the Azure Devops section

[eliassal]

@ned1313 I followed your demo and created the pipeline.
1 issue : when running pipeline while vnet-peering.tf is present, I get authorization error as it seems that the role cant be created even that my user has all privileges.

2 issue : when pipeline runs successfully, development-security resource group is created but running the pipeline for a 2nd time it fails right way in the plan: it says RG exisits. So how this is related to idempotent principles? I should always delete the RG before rerunning the pipeline. How this manual task be avoided in the terraform tasks?

3rd issue, even when pipeline is run correctly (without the peering.tf), I visit the storage account I dont see terraform.tfstate.development, I only have 1 file terraform.tfstate when I ran another app from VSC. What is strange is that I have no errors in the pipeline so I am not sure where those files terraform.tfstate.development, is created

Thanks for your help

[ned1313]

Hi @eliassal TBH I haven't touched this course in a LONG time. I just ran through all the exercises and had to make some changes due to UI updates and pipeline tasks. I just made a new commit to this repository with updated pipeline files, an updated README, and updated commands.txt for the Azure DevOps section.

Here's a few things to check. When you create the service connection for the project, the Identity type should be App registration (automatic) and the Credential should be Secret. Version 2 of the azurerm provider doesn't support federated credentials.

Also, the Terraform extension I was using for Azure DevOps was deprecated and removed. The new extension is Terraform from Microsoft DevLabs. The extension has slightly different syntax and task names.

[ned1313]

Based on what you mentioned in your issues, it doesn't sound like Terraform is initializing properly and thus not connecting to the remote state location. Even it it is successful in deploying resources, the changes are not be recorded to persistent state.

[ned1313]

The permissions issue with the vnet-peering is probably due to the permissions associated with the Service Connection. The pipeline is using a Service Principal associated with that service connection to perform the Terraform actions. That service principal will need to be associated with a role that allows it to create/assign roles in the Azure subscription. I gave mine the Owner role, but you can be more stringent if you'd like.

[eliassal]

So many Thanks @ned1313. I will download the new updated repo.
The service connection is created with a user that has contributor role on the subscription, so I should think it can create/assign roles.
Tell me please, you provide the release in yaml file, how can we import it, or the question how can we use it in releases?

[eliassal]

Also, can you please explain in plain english how this function works, I am a little bit confused as I am new to this principle of template in TF

data "template_file" "subnet_prefixes" {
  count = length(var.subnet_names)

  template = "$${cidrsubnet(vnet_cidr,8,current_count)}"

  vars = {
    vnet_cidr     = var.vnet_cidr_range[terraform.workspace]
    current_count = count.index
  }
}

I think there is no way to debug it

[ned1313]

The pipeline yaml uses the service connection when you specify it using the environmentServiceNameAzureRM: 'Networking_Sub' input for the TerraformTask@5 tasks. I don't know the exact details, but I believe it loads the credentials in the background using the Azure CLI and Terraform automatically discovers them.

Regarding the template_file data source block you referenced, this isn't a function, it's a data source. I actually don't recommend using the template_file data source anymore, and instead I would use a for expression to accomplish the same goal. You could debug the data source by running terraform apply -refresh-only which will render all data sources without updating resources, then check state.

If you wanted to replace the data source with a for expression, then you would do something like this:

module "vnet-main" {
  source              = "Azure/vnet/azurerm"
  version             = "~> 2.0"
  resource_group_name = azurerm_resource_group.vnet_main.name
  vnet_name           = local.full_rg_name
  address_space       = [var.vnet_cidr_range[terraform.workspace]]
  subnet_prefixes     = [ for subnet in range(length(var.subnet_names)) : cidrsubnet(var.vnet_cidr_range[terraform.workspace],8,subnet) ]
  subnet_names        = var.subnet_names
  nsg_ids             = {}

  tags = {
    environment = terraform.workspace
    costcenter  = "it"

  }

  depends_on = [azurerm_resource_group.vnet_main]
}

I haven't tested the block above, but the for expression does work. For expressions were introduced in Terraform 0.15? Here's what it does:

length(var.subnet_names) - returns the number of elements in the list of subnet names (currently 2)
range(length(var.subnet_names)) - returns a list of numbers starting at 0 based on the argument, so [0,1]

The for expression iterates over the list [0,1] using the placeholder subnet. It returns a list where the elements are evaluated using the function cidrsubnet(var.vnet_cidr_range[terraform.workspace],8,subnet). This would return:

[
  "10.X.0.0/24",
  "10.X.1.0/24",
]

Depending on which workspace you're in.

Hopefully that helps and doesn't confuse things more!

[eliassal]

So many thanks @ned1313 , I really appreciate your help. I followed almost all your tips, now while I am trying to rerun the modules from the begining, I am getting something very strange. Inside "2-sec-vnet", I modified it because according to version = "3.4.0" of Azuread provider, I run tf apply plan.....
all objects get created in my subscription except process gets stuck as follows and never ends. Have you ever seen this

random_password.vnet_peering: Creating...
random_password.vnet_peering: Creation complete after 0s [id=none]
azuread_application.vnet_peering: Creating...
azuread_application.vnet_peering: Creation complete after 1s [id=/applications/XXXXXXX-16e9-4e2b-8624-XXXXXXXX]
azuread_service_principal.vnet_peering: Creating...
azuread_service_principal.vnet_peering: Creation complete after 2s [id=/servicePrincipals/f5b08ed5-d924-4b38-9783-XXXXXXXX]
azuread_service_principal_password.vnet_peering: Creating...
azurerm_resource_group.vnet_sec: Creating...
azurerm_role_definition.vnet-peering: Creating...
azurerm_resource_group.vnet_sec: Creation complete after 1s [id=/subscriptions/XXXXXXX-4725-460d-8e3b-XXXXXXXXXX/resourceGroups/security]
module.vnet-sec.data.azurerm_resource_group.vnet: Reading...
module.vnet-sec.data.azurerm_resource_group.vnet: Read complete after 1s [id=/subscriptions/XXXXXXX-4725-460d-8e3b-XXXXXXXXXX/resourceGroups/security]
module.vnet-sec.azurerm_virtual_network.vnet: Creating...
azuread_service_principal_password.vnet_peering: Still creating... [00m10s elapsed]
azurerm_role_definition.vnet-peering: Creation complete after 3s [id=/subscriptions/XXXXXXX-4725-460d-8e3b-XXXXXXXXXX/providers/Microsoft.Authorization/roleDefinitions/8674c46b-216b-1475-89c8-85e73800404d|/subscriptions/XXXXXXX-4725-460d-8e3b-XXXXXXXXXX]
module.vnet-sec.azurerm_virtual_network.vnet: Still creating... [00m10s elapsed]
azuread_service_principal_password.vnet_peering: Still creating... [00m20s elapsed]
azuread_service_principal_password.vnet_peering: Creation complete after 21s [id=XXXXXXX-d924-4b38-9783-3e583c5b4cff/password/XXXXXXX-1f7b-4062-9419-58a70ab45498]
module.vnet-sec.azurerm_virtual_network.vnet: Creation complete after 12s [id=/subscriptions/XXXXXXX-4725-460d-8e3b-XXXXXXXXXX/resourceGroups/security/providers/Microsoft.Network/virtualNetworks/security]
azurerm_role_assignment.vnet: Creating...
module.vnet-sec.azurerm_subnet.subnet[1]: Creating...
module.vnet-sec.azurerm_subnet.subnet[0]: Creating...
local_file.windows: Creating...
local_file.linux: Creating...
local_file.windows: Creation complete after 0s [id=fa0fb95532c034ea458e9f4c56c6147d39f66d93]
local_file.linux: Creation complete after 0s [id=9789a202cc131e39c5b43ddac9f1e7ffa87f8c14]
module.vnet-sec.azurerm_subnet.subnet[1]: Creation complete after 4s [id=/subscriptions/XXXXXXX-4725-460d-8e3b-XXXXXXXXXX/resourceGroups/security/providers/Microsoft.Network/virtualNetworks/security/subnets/inspect]
module.vnet-sec.azurerm_subnet.subnet[0]: Creation complete after 7s [id=/subscriptions/XXXXXXX-4725-460d-8e3b-XXXXXXXXXX/resourceGroups/security/providers/Microsoft.Network/virtualNetworks/security/subnets/siem]
azurerm_role_assignment.vnet: Still creating... [00m10s elapsed]
azurerm_role_assignment.vnet: Still creating... [00m20s elapsed]
azurerm_role_assignment.vnet: Still creating... [00m30s elapsed]
azurerm_role_assignment.vnet: Still creating... [00m40s elapsed]
azurerm_role_assignment.vnet: Still creating... [00m50s elapsed]
azurerm_role_assignment.vnet: Still creating... [01m00s elapsed]
azurerm_role_assignment.vnet: Still creating... [01m10s elapsed]

[eliassal]

Hello @ned1313 , I finally resolved the last issue concerning the process getting stuck on azurerm_role_assignment.vnet: Still creating... [00m10s elapsed].
I replaced client_id in main.tf in module "2-sec-vnet", by
principal_id = azuread_service_principal.vnet_peering.object_id
and process went through. I will go to the azure devops module now
So many thanks for your help again

[eliassal]

@ned1313, old pipeline now works fine after some updates of service principals. However, I added ARM_SAS_TOKEN: $(sas_token) as you suggest in your updted pipeline but it did still terraform.tfstate-dev nor terraform.tfstate-uat is created. What is strange is that n error is generated.
One last thing, you provide the pipelines in yaml which can not be imported as Azure devops only accepts json or text file.