Building Terraform Quick Start repo part 3 – Azure DevOps API
Tags: azure, devops, terraform
Published: 2022-04-03 08:33:55


---
title: Building Terraform Quick Start repo part 3 – Azure DevOps API 
published: true
description: This is the third part of the series following our humble endeavors to automate Terraform deployment tasks &hellip; Continue reading &#8220;Building Terraform Quick Start repo part 3 – Azure DevOps API&#8221;
tags: azure, devops, terraform
canonical_url: https://blog.wiseowls.co.nz/index.php/2022/03/20/building-terraform-quick-start-repo-part-3-azure-devops-api/
cover_image: https://blog.wiseowls.co.nz/wp-content/uploads/2022/02/rocket-launch-g30a0082b3_1920.jpg
series: Azure Terraform Bootstrap
---

Now that we’ve got the Terraform part sorted, we’d like to take this project to a logical conclusion and build a reusable template for our future endeavors.

Compile or script?
------------------

Our initial idea was to write a small console app that would gather parameters and make all API calls. But [this repository](https://github.com/hwdsl2/setup-ipsec-vpn) got us thinking, that it’s way more efficient to be able to just run the script off GitHub. So, we went to the drawing board and ended up with a Bash script. It ain’t much but it’s honest work.

Ultimately the script goes to create an ADO Project, imports its own GitHub repo into a newly created project and proceeds to set up the pipeline.

Streamlining process
--------------------

With this tooling, we can now automate most of our process. We’d start by obtaining the parameters and setting up required credentials:

1. In ADO we’ll need to [create and grab a PAT](https://docs.microsoft.com/en-us/azure/devops/organizations/accounts/use-personal-access-tokens-to-authenticate?view=azure-devops&tabs=Windows) of a user with permissions to manage the organization

![Azure DevOps Personal Access Token setup](https://blog.wiseowls.co.nz/wp-content/uploads/2022/03/image.png)2. In target Azure environment we need to start with [finding the tenant id](https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/active-directory-how-to-find-tenant)
3. While we’re collecting intel, we’d also grab target Subscription Name and Id.
4. Next step would be [creating a Service Principal](https://docs.microsoft.com/en-us/azure/active-directory/develop/howto-create-service-principal-portal) for Terraform.

![creating Azure AD Service Principal](https://blog.wiseowls.co.nz/wp-content/uploads/2022/03/aad-create-service-principal-1024x604.gif)5. By default, the principal has no permissions, so we’ll need to give it something like `Contributor` access on a subscription we want to manage

![assigning role to Service Principal](https://blog.wiseowls.co.nz/wp-content/uploads/2022/03/image-1-1024x467.png)6. Finally, it’s good practice to name Azure resources in such a way that it makes sense later. We come up with a distinct prefix for Terraform state storage account. Since storage accounts have strict naming policies, our prefix must be 2-13 characters long and must only contain alphanumerics.

Once all prep work is done, running script should produce an ADO project:

![ADO project build view](https://blog.wiseowls.co.nz/wp-content/uploads/2022/03/image-3-1024x574.png)And running a `default` pipeline there should deploy Terraform management resource group (this is where state file will sit) and an actual workload – in our case it’s a Static Web App

![deployed resources in Azure](https://blog.wiseowls.co.nz/wp-content/uploads/2022/03/image-2.png)Conclusion
----------

[This repository](https://github.com/tkhadimullin/ado-tf-kickstart) gives us a good starting point in our engagements with clients using ADO. As more clients start to pick GitHub as their platform of choice, we may have to upgrade it to use Actions. Until then, happy infrastructure-as-coding!