I want to provision an azure key vault from terraform via the interactive powershell prompt. I want to login to to azure (az login
) with the web browser. I want that users object id to set a limited custom access policy for it. My terraform snippet for the key vault looks like this:
resource "azurerm_key_vault" "always_encrypted_sample" {
# . . . . SNIP . . . .
access_policy {
tenant_id = "${data.azurerm_client_config.current.tenant_id}"
object_id = "${var.certificate_creator}"
certificate_permissions = [
"create", "get" # Terraform needs get to make the cert, probably to check its existance
]
}
}
resource "azurerm_key_vault_certificate" "column_certificate" {
# . . . . SNIP . . . .
}
I don't know how to get the object id. az account show
only gives me the following:
{
"environmentName": "AzureCloud",
"id": "XXXXXXXXXXXX",
"isDefault": true,
"name": "Pay-As-You-Go",
"state": "Enabled",
"tenantId": "XXXXXXX",
"user": {
"name": "user@domain.tld",
"type": "user"
}
}
I opened a feature request for user to contain an id property. I am looking for a workaround. Is there an command in the azure cli to get my users object id or even upn so I can query the object id from that? Is that object id exposed by terraform somewhere? Its not in azurerm_client_config
.