github.com/danp/terraform@v0.9.5-0.20170426144147-39d740081351/website/source/docs/providers/azurerm/index.html.markdown (about)

     1  ---
     2  layout: "azurerm"
     3  page_title: "Provider: Azure Resource Manager"
     4  sidebar_current: "docs-azurerm-index"
     5  description: |-
     6    The Azure Resource Manager provider is used to interact with the many resources supported by Azure, via the ARM API. This supersedes the Azure provider, which interacts with Azure using the Service Management API. The provider needs to be configured with a credentials file, or credentials needed to generate OAuth tokens for the ARM API.
     7  ---
     8  
     9  # Microsoft Azure Provider
    10  
    11  The Microsoft Azure provider is used to interact with the many
    12  resources supported by Azure, via the ARM API. This supercedes the [legacy Azure
    13  provider][asm], which interacts with Azure using the Service Management API. The
    14  provider needs to be configured with the credentials needed to generate OAuth
    15  tokens for the ARM API.
    16  
    17  [asm]: /docs/providers/azure/index.html
    18  
    19  Use the navigation to the left to read about the available resources.
    20  
    21  ## Example Usage
    22  
    23  ```hcl
    24  # Configure the Microsoft Azure Provider
    25  provider "azurerm" {
    26    subscription_id = "..."
    27    client_id       = "..."
    28    client_secret   = "..."
    29    tenant_id       = "..."
    30  }
    31  
    32  # Create a resource group
    33  resource "azurerm_resource_group" "production" {
    34    name     = "production"
    35    location = "West US"
    36  }
    37  
    38  # Create a virtual network in the web_servers resource group
    39  resource "azurerm_virtual_network" "network" {
    40    name                = "productionNetwork"
    41    address_space       = ["10.0.0.0/16"]
    42    location            = "West US"
    43    resource_group_name = "${azurerm_resource_group.production.name}"
    44  
    45    subnet {
    46      name           = "subnet1"
    47      address_prefix = "10.0.1.0/24"
    48    }
    49  
    50    subnet {
    51      name           = "subnet2"
    52      address_prefix = "10.0.2.0/24"
    53    }
    54  
    55    subnet {
    56      name           = "subnet3"
    57      address_prefix = "10.0.3.0/24"
    58    }
    59  }
    60  ```
    61  
    62  ## Argument Reference
    63  
    64  The following arguments are supported:
    65  
    66  * `subscription_id` - (Optional) The subscription ID to use. It can also
    67    be sourced from the `ARM_SUBSCRIPTION_ID` environment variable.
    68  
    69  * `client_id` - (Optional) The client ID to use. It can also be sourced from
    70    the `ARM_CLIENT_ID` environment variable.
    71  
    72  * `client_secret` - (Optional) The client secret to use. It can also be sourced from
    73    the `ARM_CLIENT_SECRET` environment variable.
    74  
    75  * `tenant_id` - (Optional) The tenant ID to use. It can also be sourced from the
    76    `ARM_TENANT_ID` environment variable.
    77  
    78  * `environment` - (Optional) The cloud environment to use. It can also be sourced
    79    from the `ARM_ENVIRONMENT` environment variable. Supported values are:
    80    * `public` (default)
    81    * `usgovernment`
    82    * `german`
    83    * `china`
    84  
    85  * `skip_provider_registration` - (Optional) Prevents the provider from registering
    86    the ARM provider namespaces, this can be used if you don't wish to give the Active
    87    Directory Application permission to register resource providers. It can also be
    88    sourced from the `ARM_SKIP_PROVIDER_REGISTRATION` environment variable, defaults
    89    to `false`.
    90  
    91  ## Creating Credentials
    92  
    93  Azure requires that an application is added to Azure Active Directory to generate the `client_id`, `client_secret`, and `tenant_id` needed by Terraform (`subscription_id` can be recovered from your Azure account details).
    94  
    95  There are two high-level tasks to complete.  The first is to create an App Registration with Azure Active Directory.  You can do this in either the New ARM portal (http://portal.azure.com) or the older 'Classic' portal (http://manage.windowsazure.com).
    96  
    97  The second task is to grant permissions for the Application Registration in your Subscription.
    98  
    99  To create the App Registration using the New ARM portal:
   100  
   101  - Select **Azure Active Directory** from the left pane
   102  - Select the **App Registrations** tile from the Overview Section
   103  - Click **Endpoints** at the top of the App Registrations blade.  This will display a list of URIs. Extract the GUID from the bottom URI for **OAUTH 2.0 AUTHORIZATION ENDPOINT**. This is the `tenant_id`
   104  - Select **Add** from the top of the blade.
   105  - Add a friendly name for the application e.g. **Terraform**. Choose **Web App / API** for Application Type
   106  - Add a valid URI as the Sign-on URL. This isn't used and can be anything e.g. http://terra.form.
   107  - Click **Create** at the bottom to create the App Registration
   108  - Choose your new App Registration to show details
   109  - You should now be on the blade for your App Registration.  At the top, notice the "Application ID" GUID.  You'll use this as the `client_id`
   110  - If the Settings blade for your Application Registration is not showing, click on **All Settings**
   111  - Click on **Keys**. Enter a name for your key in **Key description** and choose an expiration duration.  When you click **Save** at the top of the blade, the key value will be displayed.  Once it is displayed, you then use this as the value for `client_secret`. This will disappear once you move off the page
   112  - Click **Required Permissions**.  Click **Add**.  This will allow us to add permission to use the Windows Azure Service Management API to the App Registration.  On Step 1, choose Windows Azure Service Management API.  Click **Select**.  On Step 2, check the box next to "Access Azure Service Management as organization users".  Click **Select**.  Click **Done** to finish adding the permission.
   113  
   114  To create the App Registration using the 'Classic' portal:
   115  
   116  - Select **Active Directory** from the left pane and select the directory you wish to use
   117  - Select **Applications** from the options at the top of the page
   118  - Select **Add** from the bottom of the page. Choose **Add an application my organization is developing**
   119  - Add a friendly name for the application e.g. **Terraform**. Leave **Web Application And/Or Web API** selected and click the arrow for the next page
   120  - Add two valid URIs. These aren't used an can be anything e.g. http://terra.form. Click the arrow to complete the wizard
   121  - You should now be on the page for the application. Click on **Configure** at the top of the page. Scroll down to the middle of the page where you will see the value for `client_id`
   122  - In the **Keys** section of the page, select a suitable duration and click **Save** at the bottom of the page. This will then display the value for `client_secret`. This will disappear once you move off the page
   123  - Click **View Endpoints** at the bottom of the page. This will display a list of URIs. Extract the GUID from the bottom URI for **OAUTH 2.0 AUTHORIZATION ENDPOINT**. This is the `tenant_id`
   124  
   125  To grant permissions to the App Registration to your subscription, you now must to use to the 'ARM' Portal:
   126  
   127  - Select **Subscriptions** from the left panel. Select the subscription that you want to use. In the Subscription details pane, click **Access Control (IAM)**
   128  - Click **Add**.  For Step 1 select an appropriate role for the tasks you want to complete with Terraform. You can find details on the built in roles [here](https://azure.microsoft.com/en-gb/documentation/articles/role-based-access-built-in-roles/)
   129  - Type in the name of the application added in the search box. You need to type this as it won't be shown in the user list. Click on the appropriate user in the list and then click **Select**
   130  - Click **OK** in the **Add Access** panel. The changes will now be saved
   131  
   132  ## To create using [Azure CLI](https://github.com/Azure/azure-cli):
   133  
   134     ```shell
   135     az login
   136     az account set --subscription="${SUBSCRIPTION_ID}"
   137     az ad sp create-for-rbac --role="Contributor" --scopes="/subscriptions/${SUBSCRIPTION_ID}"
   138     ```
   139  
   140  This will output your `client_id`, `client_secret` (password), `sp_name`, and `tenant`. The sp_name or client_id may be used for the `servicePrincipalProfile.servicePrincipalClientId` and the `client_secret` is used for `servicePrincipalProfile.servicePrincipalClientSecret`.
   141  
   142  Confirm your service principal by opening a new shell and run the following commands substituting in `sp_name`, `client_secret`, and `tenant`:
   143  
   144     ```shell
   145     az login --service-principal -u NAME -p PASSWORD --tenant TENANT
   146     az vm list-sizes --location westus
   147     ```
   148  
   149  * **With the legacy [Azure XPlat CLI](https://github.com/Azure/azure-xplat-cli)**
   150  
   151     Instructions: ["Use Azure CLI to create a service principal to access resources"](https://azure.microsoft.com/en-us/documentation/articles/resource-group-authenticate-service-principal-cli/)
   152  
   153  * **With [PowerShell](https://azure.microsoft.com/en-us/documentation/articles/resource-group-authenticate-service-principal/)**
   154  
   155     Instructions: ["Use Azure PowerShell to create a service principal to access resources"](https://azure.microsoft.com/en-us/documentation/articles/resource-group-authenticate-service-principal/)
   156  
   157  * **With the [Legacy Portal](https://azure.microsoft.com/en-us/documentation/articles/resource-group-create-service-principal-portal/)**
   158  
   159     Instructions: ["Use portal to create Active Directory application and service principal that can access resources"](https://azure.microsoft.com/en-us/documentation/articles/resource-group-create-service-principal-portal/)
   160  
   161  This may be out of date and was based on: [https://github.com/Azure/acs-engine](https://github.com/Azure/acs-engine/blob/master/docs/serviceprincipal.md)
   162  
   163  ## Testing
   164  
   165  Credentials must be provided via the `ARM_SUBSCRIPTION_ID`, `ARM_CLIENT_ID`,
   166  `ARM_CLIENT_SECRET` and `ARM_TENANT_ID` environment variables in order to run
   167  acceptance tests.