refactor: update examples and format code for release (#31)

Jira https://lacework.atlassian.net/browse/ALLY-700 Signed-off-by: Salim Afiune Maya [email protected]
lacework · Oct 13, 2021 · 17d1bef · 17d1bef
1 parent 69fd49c
commit 17d1bef
Show file tree

Hide file tree

Showing 22 changed files with 66 additions and 261 deletions.
diff --git a/README.md b/README.md
@@ -9,25 +9,25 @@ Terraform module that creates an Azure Active Directory Application to provide L
 
 ## Inputs
 
-| Name                        | Description                                                                                                        | Type           | Default                     | Required |
-| --------------------------- | ------------------------------------------------------------------------------------------------------------------ | -------------- | --------------------------- | :------: |
-| all_subscriptions           | (DEPRECATED) If set to `true`, grant read access to ALL subscriptions within the selected Tenant (overrides `subscription_ids`) | `bool`         | `false`                     |    no    |
-| application_identifier_uris | A list of user-defined URI(s) for the Lacework AD Application                                                      | `list(string)` | `[]`                        |    no    |
-| application_name            | The name of the Azure Active Directory Application                                                                 | `string`       | `"lacework_security_audit"` |    no    |
-| create                      | (DEPRECATED) Set to `false` to prevent the module from creating any resources                                                   | `bool`         | `true`                      |    no    |
-| key_vault_ids               | (DEPRECATED) A list of Key Vault Ids used in your subscription for the Lacework AD App to have access to                        | `list(string)` | `[]`                        |    no    |
-| management_group_id         | (DEPRECATED) The ID of the Management Group                                                                                     | `string`       | `""`                        |    no    |
-| password_length             | [DEPRECATED] The length of the Lacework AD Application password                                                    | `number`       | `30`                        |    no    |
-| subscription_ids            | (DEPRECATED) List of subscriptions to grant read access to. By default the module will only use the primary subscription        | `list(string)` | `[]`                        |    no    |
-| tenant_id                   | A Tenant ID different from the default defined inside the provider                                                 | `string`       | `""`                        |    no    |
-| use_management_group        | (DEPRECATED) If set to `true`, the AD Application will be set up to leverage a Management Group                                 | `bool`         | `false`                     |    no    |
+| Name                        | Description                                                                                                                     | Type           | Default                     | Required |
+| --------------------------- | ------------------------------------------------------------------------------------------------------------------              | -------------- | --------------------------- | :------: |
+| application_name            | The name of the Azure Active Directory Application                                                                              | `string`       | `"lacework_security_audit"` | no       |
+| create                      | Set to `false` to prevent the module from creating any resources                                                                | `bool`         | `true`                      | no       |
+| all_subscriptions           | (DEPRECATED) If set to `true`, grant read access to ALL subscriptions within the selected Tenant (overrides `subscription_ids`) | `bool`         | `false`                     | no       |
+| subscription_ids            | (DEPRECATED) List of subscriptions to grant read access to. By default the module will only use the primary subscription        | `list(string)` | `[]`                        | no       |
+| application_identifier_uris | (DEPRECATED) A list of user-defined URI(s) for the Lacework AD Application                                                      | `list(string)` | `[]`                        | no       |
+| key_vault_ids               | (DEPRECATED) A list of Key Vault Ids used in your subscription for the Lacework AD App to have access to                        | `list(string)` | `[]`                        | no       |
+| management_group_id         | (DEPRECATED) The ID of the Management Group                                                                                     | `string`       | `""`                        | no       |
+| password_length             | [DEPRECATED] The length of the Lacework AD Application password                                                                 | `number`       | `30`                        | no       |
+| tenant_id                   | A Tenant ID different from the default defined inside the provider                                                              | `string`       | `""`                        | no       |
+| use_management_group        | (DEPRECATED) If set to `true`, the AD Application will be set up to leverage a Management Group                                 | `bool`         | `false`                     | no       |
 
 ## Outputs
 
-| Name                 | Description                                      |
-| -------------------- | ------------------------------------------------ |
-| application_id       | The Lacework AD Application id                   |
-| application_password | The Lacework AD Application password             |
-| created              | Was the Active Directory Application created     |
-| service_principal_id | The Lacework Service Principal id                |
-| tenant_id            | A Tenant ID used to configure the AD Application |
+| Name                 | Description                                                   |
+| -------------------- | ------------------------------------------------              |
+| application_id       | The Lacework AD Application id                                |
+| application_password | The Lacework AD Application password                          |
+| created              | Was the Active Directory Application created                  |
+| service_principal_id | The Lacework Service Principal id                             |
+| tenant_id            | (DEPRECATED) A Tenant ID used to configure the AD Application |
diff --git a/examples/all-subscriptions-ad-application/README.md b/examples/all-subscriptions-ad-application/README.md
diff --git a/examples/all-subscriptions-ad-application/main.tf b/examples/all-subscriptions-ad-application/main.tf
diff --git a/examples/all-subscriptions-ad-application/versions.tf b/examples/all-subscriptions-ad-application/versions.tf
diff --git a/examples/custom-ad-application/README.md b/examples/custom-ad-application/README.md
@@ -1,39 +1,18 @@
-# Custom AD Application to Integrate Azure Tenant and Select Subscriptions
+# Default Creation of AD Application for Lacework
 
-The following example shows how to deploy a new Azure AD application to integrate an Azure Tenant and select subscriptions with Lacework. This example provides examples of configuring the integration with module inputs.
+The following example shows how to deploy a new Azure AD application to be used in other modules to integrate Azure Tenant and Subscriptions with Lacework.
+
+This example provides examples of configuring the AD application with a custom name.
 
 ## Sample Code
 
 ```hcl
-terraform {
-  required_providers {
-    lacework = {
-      source = "lacework/lacework"
-    }
-  }
-}
-
 provider "azuread" {}
 
-provider "azurerm" {
-  features {}
-}
-
-provider "lacework" {}
-
 module "ad_application" {
-  source                      = "lacework/ad-application/azure"
-  version                     = "~> 0.1"
-  application_name            = "lacework_custom_ad_application_name"
-  application_identifier_uris = ["https://account.lacework.net"]
-  subscription_ids            = ["subscription-id-1", "subscription-id-2", "subscription-id-3"]
-  tenant_id                   = "123abc12-abcd-1234-abcd-abcd12340123"
-  password_length             = 16
-  key_vault_ids = [
-    "/subscriptions/1234abcd-1234-abcd-a1b3-abcd12345xyz/resourceGroups/lwresourcegroup/providers/Microsoft.KeyVault/vaults/keyvault1",
-    "/subscriptions/1234abcd-1234-abcd-a1b3-abcd12345xyz/resourceGroups/lwresourcegroup/providers/Microsoft.KeyVault/vaults/keyvault2",
-    "/subscriptions/1234abcd-1234-abcd-a1b3-abcd12345xyz/resourceGroups/lwresourcegroup/providers/Microsoft.KeyVault/vaults/keyvault3"
-  ]
+  source           = "lacework/ad-application/azure"
+  version          = "~> 1.0"
+  application_name = "lacework_custom_ad_application_name"
 }
 ```
 

diff --git a/examples/custom-ad-application/main.tf b/examples/custom-ad-application/main.tf
@@ -1,19 +1,6 @@
 provider "azuread" {}
 
-provider "azurerm" {
-  features {}
-}
-
 module "ad_application" {
-  source                      = "../../"
-  application_name            = "lacework_custom_ad_application_name"
-  application_identifier_uris = ["https://account.lacework.net"]
-  subscription_ids            = ["subscription-id-1", "subscription-id-2", "subscription-id-3"]
-  tenant_id                   = "123abc12-abcd-1234-abcd-abcd12340123"
-  password_length             = 16
-  key_vault_ids = [
-    "/subscriptions/1234abcd-1234-abcd-a1b3-abcd12345xyz/resourceGroups/lwresourcegroup/providers/Microsoft.KeyVault/vaults/keyvault1",
-    "/subscriptions/1234abcd-1234-abcd-a1b3-abcd12345xyz/resourceGroups/lwresourcegroup/providers/Microsoft.KeyVault/vaults/keyvault2",
-    "/subscriptions/1234abcd-1234-abcd-a1b3-abcd12345xyz/resourceGroups/lwresourcegroup/providers/Microsoft.KeyVault/vaults/keyvault3"
-  ]
+  source           = "../../"
+  application_name = "lacework_custom_ad_application_name"
 }
diff --git a/examples/custom-ad-application/versions.tf b/examples/custom-ad-application/versions.tf
diff --git a/examples/default-ad-application/README.md b/examples/default-ad-application/README.md
@@ -1,26 +1,12 @@
-# Default AD Application to Integrate Azure Tenant and Default Subscription
+# Default Creation of AD Application for Lacework
 
-The following example shows how to deploy a new Azure AD application to integrate an Azure Tenant and select subscriptions with Lacework. This example provides examples of configuring the integration with module inputs.
+The following example shows how to deploy a new Azure AD application to be used in other modules to integrate Azure Tenant and Subscriptions with Lacework.
 
 ## Sample Code
 
 ```hcl
-terraform {
-  required_providers {
-    lacework = {
-      source = "lacework/lacework"
-    }
-  }
-}
-
 provider "azuread" {}
 
-provider "azurerm" {
-  features {}
-}
-
-provider "lacework" {}
-
 module "ad_application" {
   source  = "lacework/ad-application/azure"
   version = "~> 0.1"

diff --git a/examples/default-ad-application/main.tf b/examples/default-ad-application/main.tf
@@ -1,9 +1,5 @@
 provider "azuread" {}
 
-provider "azurerm" {
-  features {}
-}
-
 module "ad_application" {
   source = "../../"
 }
diff --git a/examples/default-ad-application/versions.tf b/examples/default-ad-application/versions.tf
diff --git a/examples/management-group/README.md b/examples/management-group/README.md
diff --git a/examples/management-group/main.tf b/examples/management-group/main.tf
diff --git a/examples/management-group/versions.tf b/examples/management-group/versions.tf
diff --git a/examples/skip-creation-ad-application/README.md b/examples/skip-creation-ad-application/README.md
@@ -5,25 +5,11 @@ The following example shows how to use module inputs to skip the creation of the
 ## Sample Code
 
 ```hcl
-terraform {
-  required_providers {
-    lacework = {
-      source = "lacework/lacework"
-    }
-  }
-}
-
 provider "azuread" {}
 
-provider "azurerm" {
-  features {}
-}
-
-provider "lacework" {}
-
 module "ad_application" {
   source  = "lacework/ad-application/azure"
-  version = "~> 0.1"
+  version = "~> 1.0"
   create  = false
 }
 ```

diff --git a/examples/skip-creation-ad-application/main.tf b/examples/skip-creation-ad-application/main.tf
@@ -1,9 +1,5 @@
 provider "azuread" {}
 
-provider "azurerm" {
-  features {}
-}
-
 module "ad_application" {
   source = "../../"
   create = false

diff --git a/examples/skip-creation-ad-application/versions.tf b/examples/skip-creation-ad-application/versions.tf
diff --git a/lacework_logo.png → imgs/lacework_logo.png b/lacework_logo.png → imgs/lacework_logo.png
diff --git a/main.tf b/main.tf
@@ -1,7 +1,4 @@
 locals {
-  #To be removed [DEPRECATED] tenant_id
-  tenant_id = length(var.tenant_id) > 0 ? var.tenant_id : data.azuread_client_config.current.tenant_id
-
   application_id = var.create ? (
     length(azuread_application.lacework) > 0 ? azuread_application.lacework[0].application_id : ""
   ) : ""
@@ -18,16 +15,17 @@ data "azuread_client_config" "current" {}
 ## Create a service principal and assigned Directory Reader role in Azure AD
 resource "azuread_application" "lacework" {
   count         = var.create ? 1 : 0
-  display_name    = var.application_name
+  display_name  = var.application_name
   owners        = [data.azuread_client_config.current.object_id]
-  logo_image    = filebase64("${path.module}/lacework_logo.png")
-  marketing_url = "https://www.lacework.com/" 
-  web{
-    homepage_url = "https://www.lacework.com" 
+  logo_image    = filebase64("${path.module}/imgs/lacework_logo.png")
+  marketing_url = "https://www.lacework.com/"
+  web {
+    homepage_url = "https://www.lacework.com/"
   }
 }
-resource "azuread_directory_role" "dir-reader" {
-  display_name = "Directory Readers" 
+
+resource "azuread_directory_role" "dir_reader" {
+  display_name = "Directory Readers"
 }
 
 resource "azuread_service_principal" "lacework" {
@@ -42,12 +40,13 @@ resource "azuread_application_password" "client_secret" {
   depends_on            = [azuread_service_principal.lacework]
 }
 
-#https://docs.microsoft.com/en-us/azure/active-directory/roles/permissions-reference#directory-readers 
-#When to use this role? When Granting service principals access to directory where Directory.Read.All is not an option.
-#this way we avoid Grant Admin Consent issue
-resource "azuread_directory_role_member" "lacework-dir-reader" {
+# When to use this role? When Granting service principals access to directory where
+# Directory.Read.All is not an option. This way we avoid Grant Admin Consent issue.
+#
+# => https://docs.microsoft.com/en-us/azure/active-directory/roles/permissions-reference#directory-readers 
+resource "azuread_directory_role_member" "lacework_dir_reader" {
   count            = var.create ? 1 : 0
-  role_object_id   = azuread_directory_role.dir-reader.object_id
+  role_object_id   = azuread_directory_role.dir_reader.object_id
   member_object_id = local.service_principal_id
   depends_on       = [azuread_service_principal.lacework]
-}
+}
diff --git a/output.tf b/output.tf
@@ -19,7 +19,9 @@ output "service_principal_id" {
   description = "The Lacework Service Principal id"
 }
 
+# @afiune We should remove these deprecations in a couple of months
+# https://github.com/lacework/terraform-azure-ad-application/issues/30
 output "tenant_id" {
-  value       = local.tenant_id
-  description = "A Tenant ID used to configure the AD Application"
+  value       = var.tenant_id
+  description = "[DEPRECATED] A Tenant ID used to configure the AD Application"
 }
diff --git a/scripts/ci_tests.sh b/scripts/ci_tests.sh
@@ -9,10 +9,8 @@ set -eou pipefail
 readonly project_name=terraform-azure-ad-application
 
 TEST_CASES=(
-  examples/all-subscriptions-ad-application
   examples/custom-ad-application
   examples/default-ad-application
-  examples/management-group
   examples/skip-creation-ad-application
 )