What's the equivalent terraform code for Azure AD SP create-for-rbac?

Question

For an integration, a service defines the following command to run

az ad sp create-for-rbac --role reader --scopes /subscriptions/{subscription_id}

Instead of running the command, I was wondering what the equivalent terraform code for az ad sp create-for-rbac was?

Answer 1

provider "azuread" {
  version = "=0.3.0"
}

resource "azuread_application" "auth" {
  name = "auth"
}

resource "azuread_service_principal" "auth" {
  application_id = "${azuread_application.auth.application_id}"
}

resource "random_string" "password" {
  length = 16
  special = true
  override_special = "/@\" "
}

resource "azuread_service_principal_password" "auth" {
  service_principal_id = "${azuread_service_principal.auth.id}"
  value                = "${random_string.password.result}"
  end_date_relative    = "240h"
}

output "client_secret" {
  value = "${random_string.password.result}"
  description = "Client Secret"
}

provider "azurerm" {
  version = "=1.24.0"
}

data "azurerm_subscription" "primary" {}

data "azurerm_client_config" "current" {}

resource "azurerm_role_assignment" "auth" {
  scope                = "${data.azurerm_subscription.primary.id}"
  role_definition_name = "Reader"
  principal_id         = "${azuread_service_principal.auth.id}"
}