azuread/applications¶

Overview¶

This page documents the Terraform module implementation, key configuration surfaces, and how it integrates with CAF.

Dependency diagram (Mermaid)¶

graph TD azuread_application.app["azuread_application.app"] azuread_service_principal.app["azuread_service_principal.app"] azuread_service_principal_password.pwd["azuread_service_principal_password.pwd"] azurerm_key_vault_secret.client_id["azurerm_key_vault_secret.client_id"] azurerm_key_vault_secret.client_secret["azurerm_key_vault_secret.client_secret"] azurerm_key_vault_secret.tenant_id["azurerm_key_vault_secret.tenant_id"] random_password.pwd["random_password.pwd"] terraform_data.grant_admin_consent["terraform_data.grant_admin_consent"] time_rotating.pwd["time_rotating.pwd"] time_sleep.wait_for_directory_propagation["time_sleep.wait_for_directory_propagation"] azuread_service_principal.app --> azuread_application.app azuread_service_principal_password.pwd --> azuread_service_principal.app azuread_service_principal_password.pwd --> random_password.pwd azuread_service_principal_password.pwd --> time_rotating.pwd azurerm_key_vault_secret.client_id --> azuread_application.app azurerm_key_vault_secret.client_secret --> azuread_service_principal_password.pwd azurerm_key_vault_secret.client_secret --> time_rotating.pwd random_password.pwd --> time_rotating.pwd terraform_data.grant_admin_consent --> azuread_application.app terraform_data.grant_admin_consent --> azuread_service_principal.app terraform_data.grant_admin_consent --> time_sleep.wait_for_directory_propagation time_sleep.wait_for_directory_propagation --> azuread_service_principal.app

Module Reference¶

Category: azuread
Path: modules/azuread/applications
Azure Resources: azuread_application, azuread_service_principal, azuread_service_principal_password, azurerm_key_vault_secret, random_password, terraform_data, time_rotating, time_sleep

Inputs¶

Name	Description	Type	Required	Default	Validation
`"global_settings"`		`any`	no	`{}`	-
`"settings"`		`any`	no	`{}`	-
`"azuread_api_permissions"`		`any`	no	`{}`	-
`"client_config"`	"Client configuration object (see module README.md)."	`any`	yes	`-`	-
`"user_type"`		`any`	no	`-`	-
`"keyvaults"`		`any`	no	`{}`	-
`"password_policy"`	"Default password policy applies when not set in tfvars."	`any`	no	`{"expire_in_days": 180, "length": 250, "number": true, "rotation": {"months": 1}, "special": false, "upper": true}`	-

Outputs¶

Name	Description	Sensitive	Value
`"tenant_id"`		-	`var.client_config.tenant_id`
`"azuread_application"`		-	`{"client_id": "${azuread_application.app.client_id}", "id": "${azuread_application.app.id}", "object_id": "${azuread_application.app.object_id}"}`
`"azuread_service_principal"`		-	`{"id": "${azuread_service_principal.app.id}", "object_id": "${azuread_service_principal.app.object_id}"}`
`"keyvaults"`		-	`{for key, value in try(var.settings.keyvaults, {}) : key => {id = azurerm_key_vault_secret.client_id[key].key_vault_id, secret_name_client_secret = value.secret_prefix}}`
`"rbac_id"`	"This attribute is used to set the role assignment"	-	`azuread_service_principal.app.object_id`

Sources¶

modules/azuread/applications/api_permissions.tf
modules/azuread/applications/keyvault_secrets.tf
modules/azuread/applications/module.tf
modules/azuread/applications/outputs.tf
modules/azuread/applications/variables.tf