terraform-module-revamp

azure_oidc/main.tf

@@ -15,11 +15,11 @@ resource "azuread_service_principal" "sg_sp" {
 }
 
 # Assign Contributor role to the Service Principal at the subscription level
-resource "azurerm_role_assignment" "example" {
-  principal_id         = azuread_service_principal.sg_sp.object_id
-  role_definition_name = "Contributor"
-  scope                = data.azurerm_subscription.current.id
-}
+# resource "azurerm_role_assignment" "example" {
+#   principal_id         = azuread_service_principal.sg_sp.object_id
+#   role_definition_name = "Contributor"
+#   scope                = data.azurerm_subscription.current.id
+# }
 
 # Configure Workload Identity (Federated Credential)
 resource "azuread_application_federated_identity_credential" "sg_fed_id_creds" {

azure_oidc/output.tf

@@ -0,0 +1,14 @@
+output "azure_oidc" {
+  description = "Azure OIDC configuration details"
+
+  value = {
+    client_id            = azuread_application.app_registration.client_id
+    application_id       = azuread_application.app_registration.id
+    service_principal_id = azuread_service_principal.sg_sp.object_id
+    tenant_id            = data.azuread_client_config.current.tenant_id
+    subscription_id      = data.azurerm_subscription.current.subscription_id
+    issuer               = azuread_application_federated_identity_credential.sg_fed_id_creds.issuer
+    subject              = azuread_application_federated_identity_credential.sg_fed_id_creds.subject
+    audience             = azuread_application_federated_identity_credential.sg_fed_id_creds.audiences[0]
+  }
+}

azure_oidc/provider.tf

@@ -2,7 +2,7 @@ terraform {
   required_providers {
     azurerm = {
       source  = "hashicorp/azurerm"
-      version = "=4.6.0"
+      version = "=5.0.1"
     }
     azuread = {
       source  = "hashicorp/azuread"

azure_static/main.tf

@@ -22,22 +22,10 @@ resource "azurerm_role_assignment" "example" {
 }
 
 # Step 3: Create a Client Secret for the Service Principal
-resource "azuread_service_principal_password" "client_secret" {
-  service_principal_id = azuread_service_principal.sg_sp.id
-}
-
-# Step 4: Output the Client Secret Value (ID will be available in the Service Principal)
-output "client_secret_value" {
-  value     = azuread_service_principal_password.client_secret.value
-  sensitive = true
-}
 
-# Step 5: Output the Client ID (Application ID)
-output "client_id" {
-  value = azuread_application.app_registration.client_id
+resource "azuread_application_password" "client_secret" {
+  application_id     = azuread_application.app_registration.id
+  display_name       = "Terraform Client Secret"
+  end_date  = "2027-02-07T23:59:59Z"
 }
 
-# Step 6: Output the Client Secret ID (from the service principal password)
-output "client_secret_id" {
-  value = azuread_service_principal_password.client_secret.id
-}

azure_static/output.tf

@@ -0,0 +1,21 @@
+output "azure_service_principal" {
+  description = "Azure Service Principal details"
+
+  value = {
+    client_id            = azuread_application.app_registration.client_id
+    application_id       = azuread_application.app_registration.id
+    service_principal_id = azuread_service_principal.sg_sp.object_id
+    tenant_id            = data.azuread_client_config.current.tenant_id
+  }
+}
+
+# output "client_secret" {
+#   description = "Client secret for the Azure Service Principal"
+#   value       = azuread_service_principal_password.client_secret.value
+#   sensitive   = true
+# }
+output "client_secret" {
+  description = "Client secret for the Azure App Registration"
+  value       = azuread_application_password.client_secret.value
+  sensitive = true
+}

azure_static/provider.tf

@@ -2,7 +2,7 @@ terraform {
   required_providers {
     azurerm = {
       source  = "hashicorp/azurerm"
-      version = "=4.6.0"
+      version = "=5.0.1"
     }
     azuread = {
       source  = "hashicorp/azuread"

stackguardian_connector_cloud/main.tf

@@ -73,10 +73,10 @@ resource "stackguardian_connector" "sg_azure_static_connector" {
   settings = {
     kind = var.connector_type,
     config = [{
-      armTenantId       = var.armTenantId,
-      armSubscriptionId = var.armSubscriptionId,
-      armClientId       = var.armClientId,
-      armClientSecret   = var.armClientSecret
+      arm_tenant_id       = var.armTenantId,
+      arm_subscription_id = var.armSubscriptionId,
+      arm_client_id       = var.armClientId,
+      arm_client_secret   = var.armClientSecret
     }]
   }
 }
@@ -95,9 +95,9 @@ resource "stackguardian_connector" "sg_azure_oidc_connector" {
   settings = {
     kind = var.connector_type,
     config = [{
-      armTenantId       = var.armTenantId,
-      armSubscriptionId = var.armSubscriptionId,
-      armClientId       = var.armClientId,
+      arm_tenant_id       = var.armTenantId,
+      arm_subscription_id = var.armSubscriptionId,
+      arm_client_id       = var.armClientId,
     }]
   }
 }

stackguardian_connector_cloud/provider.tf

@@ -2,7 +2,13 @@ terraform {
   required_providers {
     stackguardian = {
       source  = "StackGuardian/stackguardian"
-      version = "1.3.1"
+      version = "1.12.0"
     }
   }
+}
+
+provider "stackguardian" {
+  org_name = var.org_name
+  api_key  = var.api_key
+  api_uri  = var.sg_api_uri
 }

stackguardian_connector_cloud/variables.tf

@@ -9,6 +9,11 @@ variable "org_name" {
   description = "Your organization name on StackGuardian Platform"
 }
 
+variable "sg_api_uri" {
+  type        = string
+  description = "Your organization name on StackGuardian Platform"
+}
+
 variable "connector_type" {
   type        = string
   description = "type of connector. You can select anyone of the following AWS_STATIC, AWS_RBAC, AWS_OIDC, AZURE_STATIC, AZURE_OIDC, GCP_OIDC"