Feature Request: automatically generate UUID for azurerm_role_definition

[JamesDLD]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Description

Could we make the variable role_definition_id of the resource "azurerm_role_definition" optional?
Work has been done for the resource "azurerm_role_assignment" here #667

Same concern, below quoted ==>
"I don't understand why I need to specify a unique UUID for a azurerm_role_assignment resource. This makes this piece of code less modular. Would it be possible to make this property optional and fall back to an automatically generated UUID? Or is there any way to generate a static UUID in terraform? When I use the ${uuid()} interpolation, terraform will recreate the azurerm_role_assignment each run because the interpolation has changed."

New or Affected Resource(s)

Terraform v0.11.7
provider.azurerm v1.6.0

Potential Terraform Configuration

data "azurerm_subscription" "primary" {}

resource "azurerm_role_definition" "roles" {
  name               = "MyRoleDefinitionWithAnUniqueName"
  scope              = "${data.azurerm_subscription.primary.id}"

  permissions {
    actions = ["*"]

    not_actions = [
      "Microsoft.Authorization/*/Delete",
      "Microsoft.Authorization/*/Write",
      "Microsoft.Authorization/elevateAccess/Action",
    ]
  }

  assignable_scopes = [
    "${data.azurerm_subscription.primary.id}",
  ]
}

References

• Improvement: automatically generate UUID for azurerm_role_assignment #667

[katbyte]

Hello @JamesDLD,

Thank you for the suggestion! I have opened #1378 that should address it 🙂 However until it gets merged and released, you could use the random provider to generate and persist a UUID in terraform:

data "azurerm_subscription" "primary" {}

resource "random_id" "server" {
  byte_length = 16
}

resource "azurerm_role_definition" "roles" {
  role_definition_id = "${random_id.server.hex}"
  name               = "MyRoleDefinitionWithAnUniqueName"
  scope              = "${data.azurerm_subscription.primary.id}"

  permissions {
    actions = ["*"]

    not_actions = [
      "Microsoft.Authorization/*/Delete",
      "Microsoft.Authorization/*/Write",
      "Microsoft.Authorization/elevateAccess/Action",
    ]
  }

  assignable_scopes = [
    "${data.azurerm_subscription.primary.id}",
  ]
}

[JamesDLD]

Excellent @katbyte !
It works like a charm, I did update my module here : https://github.com/JamesDLD/terraform/tree/master/module/Create-AzureRmRoleDefinition

Thank you!

[katbyte]

Hey @JamesDLD,

This is now in master and has been released in 1.7 so you should be able to drop the terraform bits and rely entirely on the prover to generate the UUID.

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. If you feel I made an error 🤖 🙉 , please reach out to my human friends 👉 hashibot-feedback@hashicorp.com. Thanks!