goodworkaround / terraform-az-rbac-pim-assignment Goto Github PK

│ Error: Invalid value for module argument
│
│   on testVDI.tf line 59, in module "pim_assignment_2":
│   59:   resource_group_name  = azurerm_resource_group.test-vdi-rg[each.key]
│
│ The given value is not suitable for child module variable "resource_group_name" defined at PIM Assignment - Resource Group\main.tf:24,1-31: string required.

variable "resource_group_name" {
  type = string
}

│ Error: Incorrect attribute value type
│
│   on PIM Assignment - Resource Group\main.tf line 44, in resource "random_uuid" "eligible_schedule_request_id":
│   44:   keepers = {
│   45:     principalId         = var.principal_id
│   46:     roleDefinitionId    = data.azurerm_role_definition.role.id
│   47:     requestType         = var.request_type
│   48:     startDateTime       = "${formatdate("YYYY-MM-DD", time_rotating.eligible_schedule_request_start_date.id)}T${formatdate("HH:mm:ss.0000000+02:00", time_rotating.eligible_schedule_request_start_date.id)}"
│   49:     duration            = "P${tostring(var.assignment_days)}D"
│   50:     resource_group_name = var.resource_group_name
│   51:   }
│     ├────────────────
│     │ data.azurerm_role_definition.role.id will be known only after apply
│     │ time_rotating.eligible_schedule_request_start_date.id will be known only after apply
│     │ var.assignment_days is a number, known only after apply
│     │ var.principal_id is a string, known only after apply
│     │ var.request_type is a string, known only after apply
│     │ var.resource_group_name is a map of dynamic, known only after apply
│
│ Inappropriate value for attribute "keepers": element "resource_group_name": string required.

resource "azurerm_resource_group" "test-vdi-rg" {
  for_each = var.team_name
  name     = "${each.value}-VDI"
  location = var.location
  tags = {
    Owner            = lookup(var.Owner, each.key)
    TechnicalContact = lookup(var.TechnicalContact, each.key)
    Location         = lookup(var.City, each.key)
    DepartmentName   = lookup(var.DepartmentName, each.key)
  }
}

module "pim_assignment_2" {

  source               = "./PIM Assignment - Resource Group"
  for_each             = var.team_name
  resource_group_name  = azurerm_resource_group.test-vdi-rg.name
  principal_id         = lookup(var.SecurityGroup, each.key)
  role_definition_name = "Virtual Machine Administrator Login"
}

│ Error: Module module.pim_assignment_2 contains provider configuration
│
│ Providers cannot be configured within modules using count, for_each or depends_on.

module "PIM_reader" {
  source = "./modules/pim_assignment_to_subscription"

  subscription_ids     = [
    "XXXXXXXXXXXXXXXXXXXXXX" ,  # lz-prod-01
    "YYYYYYYYYYYYYYYYYYYYYYY"   # lz-prod-02
  ]
  location             = var.location
  role_definition_name = "Reader"
  member               = module.ni_reader_group.aad_group
  assignment_days      = 365
  state                = "Enabled" # Deleted => for removing PIM assignment | Enabled => for assign a PIM
}

locals {
  request_type = var.state == "Enabled" ? "AdminUpdate" : (var.state == "Deleted" ? "AdminRemove" : "")
}
// Use data resource to get the role definition ID if not provided
data "azurerm_role_definition" "role" {
  for_each   = { for sub_id in var.subscription_ids : sub_id => sub_id }

  name  = var.role_definition_name
  scope = "/subscriptions/${each.value}"
}

resource "random_uuid" "eligible_schedule_request_id" {
  for_each = { for sub_id in var.subscription_ids : sub_id => sub_id }

  keepers = {
    principalId      = var.member
    roleDefinitionId = data.azurerm_role_definition.role[each.key].id
    requestType      = local.request_type
    startDateTime    = "${formatdate("YYYY-MM-DD", time_rotating.eligible_schedule_request_start_date.id)}T${formatdate("HH:mm:ss.0000000+02:00", time_rotating.eligible_schedule_request_start_date.id)}"
    duration         = "P${tostring(var.assignment_days)}D"
  }
}

resource "time_rotating" "eligible_schedule_request_start_date" {
  rotation_days = floor(var.assignment_days / 2)
}

# Deploy the eligible schedule request using ARM template
resource "azurerm_subscription_template_deployment" "eligible_schedule_request" {
  for_each = { for sub_id in var.subscription_ids : sub_id => sub_id }

  name = random_uuid.eligible_schedule_request_id[each.key].id
  # id             = random_uuid.eligible_schedule_request_id[each.key].id
  location         = var.location
  template_content = file("${path.module}/pim_assignment.json")

  // Send parameters to ARM template
  parameters_content = jsonencode({
    "principalId" = {
      value = var.member
    },
    "roleDefinitionId" = {
      value = data.azurerm_role_definition.role[each.key].id
    },
    "requestType" = {
      value = local.request_type
    },
    "id" = {
      value = random_uuid.eligible_schedule_request_id[each.key].id
    }
    "startDateTime" = {
      value = "${formatdate("YYYY-MM-DD", time_rotating.eligible_schedule_request_start_date.id)}T${formatdate("HH:mm:ss.0000000+02:00", time_rotating.eligible_schedule_request_start_date.id)}"
    }
    "duration" = {
      value = "P${tostring(var.assignment_days)}D"
    }
    "scope" = {
      value = "/subscriptions/${each.value}"
    }
  })
  timeouts {
    create = "120s"
  }
  lifecycle {
    ignore_changes = [
      template_content
    ]
  }
}