main.tf

data "azurerm_client_config" "current" {}

resource "azuread_group" "custom_groups" {
  for_each           = var.custom_groups
  display_name       = each.key
  description        = "Automatically generated by terraform"
  security_enabled   = true
  assignable_to_role = tobool(each.value.azuread_role_assignable)
}

resource "azurerm_role_assignment" "custom_groups" {
  for_each             = local.group_role_assignments
  scope                = each.value.scope
  role_definition_name = each.value.role_definition_name
  role_definition_id   = each.value.role_definition_id
  principal_id         = azuread_group.custom_groups[each.value.principal].object_id
}

resource "azuread_group" "subscription_owners" {
  for_each           = var.subscriptions
  display_name       = "SUB_${each.key}_OWNER"
  description        = "Automatically generated by terraform. Grants Owner permissions on ${each.key} subscription."
  security_enabled   = true
  assignable_to_role = false
}
resource "azurerm_role_assignment" "subscription_owners" {
  for_each             = var.subscriptions
  scope                = "/subscriptions/${each.value}"
  role_definition_name = "Owner"
  principal_id         = azuread_group.subscription_owners[each.key].object_id
}

resource "azuread_group" "subscription_contributors" {
  for_each           = var.subscriptions
  display_name       = "SUB_${each.key}_CONTRIBUTOR"
  description        = "Automatically generated by terraform. Grants Contributor permissions on ${each.key} subscription."
  security_enabled   = true
  assignable_to_role = false
}
resource "azurerm_role_assignment" "subscription_contributors" {
  for_each             = var.subscriptions
  scope                = "/subscriptions/${each.value}"
  role_definition_name = "Contributor"
  principal_id         = azuread_group.subscription_contributors[each.key].object_id
}

resource "azuread_group" "subscription_readers" {
  for_each           = var.subscriptions
  display_name       = "SUB_${each.key}_READER"
  description        = "Automatically generated by terraform. Grants Reader permissions on ${each.key} subscription."
  security_enabled   = true
  assignable_to_role = false
}
resource "azurerm_role_assignment" "subscription_readers" {
  for_each             = var.subscriptions
  scope                = "/subscriptions/${each.value}"
  role_definition_name = "Reader"
  principal_id         = azuread_group.subscription_readers[each.key].object_id
}

resource "azuread_group" "management_owners" {
  for_each           = var.management_groups
  display_name       = "AMG_${each.key}_OWNER"
  description        = "Automatically generated by terraform. Grants Owner permissions on ${each.value.display_name} management group."
  security_enabled   = true
  assignable_to_role = false
}
resource "azurerm_role_assignment" "management_owners" {
  for_each             = var.management_groups
  scope                = "/providers/Microsoft.Management/managementGroups/${each.key}"
  role_definition_name = "Owner"
  principal_id         = azuread_group.management_owners[each.key].object_id
}

resource "azuread_group" "management_contributors" {
  for_each           = var.management_groups
  display_name       = "AMG_${each.key}_CONTRIBUTOR"
  description        = "Automatically generated by terraform. Grants Contributor permissions on ${each.value.display_name} management group."
  security_enabled   = true
  assignable_to_role = false
}
resource "azurerm_role_assignment" "management_contributors" {
  for_each             = var.management_groups
  scope                = "/providers/Microsoft.Management/managementGroups/${each.key}"
  role_definition_name = "Contributor"
  principal_id         = azuread_group.management_contributors[each.key].object_id
}

resource "azuread_group" "management_readers" {
  for_each           = var.management_groups
  display_name       = "AMG_${each.key}_READER"
  description        = "Automatically generated by terraform. Grants Reader permissions on ${each.value.display_name} management group."
  security_enabled   = true
  assignable_to_role = false
}
resource "azurerm_role_assignment" "management_readers" {
  for_each             = var.management_groups
  scope                = "/providers/Microsoft.Management/managementGroups/${each.key}"
  role_definition_name = "Reader"
  principal_id         = azuread_group.management_readers[each.key].object_id
}