azure - Terraform azurerm role definition with email address

Question

I am deploying resources to Azure with Terraform. I want to assign roles to AD users by using their email address. In the azurerm_role_assignment resource, only the object id of the user can be used. I have tried it with email but it logically fails.

resource "azurerm_role_assignment" "example" {
  scope                = data.azurerm_subscription.primary.id
  role_definition_name = "Reader"
  principal_id         = data.azurerm_client_config.example.object_id
}

With az powershell, the role can be assigned with the user's sign-in name : New-AzRoleAssignment -SignInName <userupn> .

Is there way to do it with terraform?

标签： azureterraformazure-rmazure-rbac

Answer 1

I have found the answer. The data azuread_users can be used as a solution:

data "azuread_users" "users" {
  user_principal_names = ["[e-mail]"]
}

resource "azurerm_role_assignment" "rbac_wvd" {
  scope                = data.azurerm_subscription.primary.id
  role_definition_name = "Reader"
  principal_id         = data.azuread_users.wvd_user.object_ids[0]
}