Azure Subscription

The azure_subscription resource provisions sandboxed Azure subscriptions for lab environments. It creates controlled Azure subscriptions with user management, service principal access, and resource restrictions suitable for educational and training purposes.

Use Cases

As a lab author, you can use azure_subscription resources to:

• Azure Training Labs: Create realistic Azure environments for hands-on cloud training and certification preparation
• Service-Specific Learning: Restrict access to specific Azure services for focused learning experiences

Azure subscription resources provide realistic cloud environments while maintaining educational control and cost management.

HCL Syntax

Basic Syntax

resource "azure_subscription" "name" {
  regions = ["westeurope"]
  services = ["Microsoft.Compute", "Microsoft.Storage"]

  user "student" {
    roles = ["Contributor"]
  }
}

Full Syntax

resource "azure_subscription" "name" {
  regions = ["westeurope", "eastus"]
  services = ["Microsoft.Compute", "Microsoft.Storage", "Microsoft.Network"]

  tags = {
    Environment = "Training"
    Purpose = "Lab"
    Team = "Education"
  }

  user "admin" {
    roles = ["Owner", "User Access Administrator"]
  }

  user "developer" {
    roles = ["Contributor"]
  }

  service_principal "automation" {
    roles = ["Reader", "Contributor"]
  }
}

Fields

Field	Required	Type	Description
regions		list(string)	Azure regions where resources can be provisioned. Defaults to empty list.
services		list(string)	Azure services that users can access. Defaults to empty list.
tags		map(string)	Tags to apply to the Azure subscription. Defaults to empty map.

User Block

azure_subscription → user

User blocks define Azure AD users to create within the subscription:

Field	Required	Type	Description
name	✓	label	Username for the Azure AD user (specified as block label)
roles		list(string)	Azure RBAC roles to assign to the user. Defaults to empty list.

Service Principal Block

azure_subscription → service_principal

Service principal blocks define Azure AD service principals for application authentication:

Field	Required	Type	Description
name	✓	label	Name for the Azure AD service principal (specified as block label)
roles		list(string)	Azure RBAC roles to assign to the service principal. Defaults to empty list.

Computed Attributes

These attributes are set by the system after subscription provisioning:

Field	Type	Description
tenant_id	string	The Azure AD tenant ID
subscription_id	string	The Azure subscription ID

User Computed Attributes

For each user block, these attributes are computed:

Field	Type	Description
user_id	string	The Azure AD user object ID
username	string	The Azure AD username
password	string	The user's password for Azure portal access

Service Principal Computed Attributes

For each service_principal block, these attributes are computed:

Field	Type	Description
service_principal_id	string	The Azure AD service principal object ID
app_id	string	The application (client) ID
password	string	The service principal secret for authentication

Validation Rules

• Region names must be valid Azure regions (e.g., “westeurope”, “eastus”, “southeastasia”)
• Service names must be valid Azure resource provider names (e.g., “Microsoft.Compute”, “Microsoft.Storage”)
• Role names must be valid Azure RBAC roles (e.g., “Owner”, “Contributor”, “Reader”)
• User and service principal names must follow Azure AD naming requirements

Examples

Basic Azure Training Environment

resource "azure_subscription" "training" {
  regions = ["westeurope"]
  services = ["Microsoft.Compute", "Microsoft.Storage", "Microsoft.Network"]

  tags = {
    Environment = "Training"
    Course = "Azure Fundamentals"
  }

  user "student" {
    roles = ["Contributor"]
  }
}

output "student_credentials" {
  value = {
    username = resource.azure_subscription.training.user.student.username       # e.g., "student@contoso.onmicrosoft.com"
    password = resource.azure_subscription.training.user.student.password       # e.g., "TempPass123!"
    tenant_id = resource.azure_subscription.training.tenant_id                  # e.g., "12345678-1234-1234-1234-123456789012"
  }
  sensitive = true
}

Multi-User Workshop Environment

resource "azure_subscription" "workshop" {
  regions = ["westeurope", "eastus"]
  services = [
    "Microsoft.Compute",
    "Microsoft.Storage",
    "Microsoft.Network",
    "Microsoft.Web",
    "Microsoft.Sql"
  ]

  tags = {
    Environment = "Workshop"
    Event = "Azure Solutions Architect Training"
    Instructor = "Jane Doe"
  }

  # Instructor with full access
  user "instructor" {
    roles = ["Owner", "User Access Administrator"]
  }

  # Student with contributor access
  user "student" {
    roles = ["Contributor"]
  }

  # Observer with read-only access
  user "observer" {
    roles = ["Reader"]
  }

  # Service principal for automation
  service_principal "automation" {
    roles = ["Contributor"]
  }
}

Service Principal Integration Lab

resource "azure_subscription" "automation_lab" {
  regions = ["westeurope"]
  services = [
    "Microsoft.Compute",
    "Microsoft.Storage",
    "Microsoft.Resources"
  ]

  tags = {
    Environment = "Automation-Lab"
    Technology = "Service-Principals"
    Level = "Advanced"
  }

  user "developer" {
    roles = ["Contributor"]
  }

  service_principal "ci_cd" {
    roles = ["Contributor"]
  }

  service_principal "monitoring" {
    roles = ["Reader", "Monitoring Reader"]
  }
}

resource "container" "azure_cli" {
  image {
    name = "mcr.microsoft.com/azure-cli"
  }

  environment = {
    AZURE_CLIENT_ID = resource.azure_subscription.automation_lab.service_principal.ci_cd.app_id              # e.g., "12345678-1234-1234-1234-123456789012"
    AZURE_CLIENT_SECRET = resource.azure_subscription.automation_lab.service_principal.ci_cd.password        # e.g., "abcdef123456..."
    AZURE_TENANT_ID = resource.azure_subscription.automation_lab.tenant_id                                   # e.g., "87654321-4321-4321-4321-210987654321"
    AZURE_SUBSCRIPTION_ID = resource.azure_subscription.automation_lab.subscription_id                       # e.g., "11111111-2222-3333-4444-555555555555"
  }
}

Template Integration

resource "azure_subscription" "lab" {
  regions = ["westeurope"]
  services = ["Microsoft.Compute", "Microsoft.Storage"]

  user "student" {
    roles = ["Contributor"]
  }

  service_principal "app" {
    roles = ["Reader"]
  }
}

resource "template" "azure_credentials" {
  source = <<-EOF
    # Azure CLI Login
    az login --service-principal \
      --username ${resource.azure_subscription.lab.service_principal.app.app_id} \
      --password ${resource.azure_subscription.lab.service_principal.app.password} \
      --tenant ${resource.azure_subscription.lab.tenant_id}

    # Set subscription context
    az account set --subscription ${resource.azure_subscription.lab.subscription_id}
  EOF

  destination = "./azure-login.sh"
}

resource "template" "lab_info" {
  source = <<-EOF
    # Azure Lab Environment

    ## Subscription Details
    - Tenant ID: ${resource.azure_subscription.lab.tenant_id}                    # e.g., "12345678-1234-1234-1234-123456789012"
    - Subscription ID: ${resource.azure_subscription.lab.subscription_id}        # e.g., "87654321-4321-4321-4321-210987654321"

    ## User Credentials
    - Username: ${resource.azure_subscription.lab.user.student.username}         # e.g., "student@contoso.onmicrosoft.com"
    - Password: ${resource.azure_subscription.lab.user.student.password}         # e.g., "TempPass123!"

    ## Service Principal
    - App ID: ${resource.azure_subscription.lab.service_principal.app.app_id}    # e.g., "11111111-2222-3333-4444-555555555555"
    - Secret: ${resource.azure_subscription.lab.service_principal.app.password}  # e.g., "abcdef123456..."
  EOF

  destination = "./lab-info.md"
}

Multi-Region Development Environment

resource "azure_subscription" "global_dev" {
  regions = [
    "westeurope",     # West Europe
    "eastus",         # East US
    "southeastasia"   # Southeast Asia
  ]

  services = [
    "Microsoft.Compute",
    "Microsoft.Storage",
    "Microsoft.Network",
    "Microsoft.Web",
    "Microsoft.ContainerRegistry"
  ]

  tags = {
    Environment = "Multi-Region-Dev"
    Purpose = "Global Architecture Training"
    Duration = "2-days"
  }

  user "architect" {
    roles = ["Contributor"]
  }

  service_principal "deployment" {
    roles = ["Contributor"]
  }
}

Role-Based Access Control Lab

resource "azure_subscription" "rbac_lab" {
  regions = ["westeurope"]
  services = ["Microsoft.Compute", "Microsoft.Storage"]

  tags = {
    Environment = "RBAC-Training"
    Focus = "Access-Management"
  }

  # Different users with different permission levels
  user "owner_user" {
    roles = ["Owner"]
  }

  user "contributor_user" {
    roles = ["Contributor"]
  }

  user "reader_user" {
    roles = ["Reader"]
  }

  user "storage_admin" {
    roles = ["Storage Account Contributor"]
  }

  user "vm_admin" {
    roles = ["Virtual Machine Contributor"]
  }

  # Service principals for different scenarios
  service_principal "backup_service" {
    roles = ["Backup Contributor"]
  }

  service_principal "monitoring_service" {
    roles = ["Monitoring Reader"]
  }
}

PowerShell Integration

resource "azure_subscription" "powershell_lab" {
  regions = ["westeurope"]
  services = ["Microsoft.Compute", "Microsoft.Storage"]

  user "admin" {
    roles = ["Owner"]
  }
}

resource "template" "powershell_script" {
  source = <<-EOF
    # Azure PowerShell Login
    $securePassword = ConvertTo-SecureString "${resource.azure_subscription.powershell_lab.user.admin.password}" -AsPlainText -Force
    $credential = New-Object System.Management.Automation.PSCredential("${resource.azure_subscription.powershell_lab.user.admin.username}", $securePassword)

    Connect-AzAccount -Credential $credential -TenantId "${resource.azure_subscription.powershell_lab.tenant_id}"
    Set-AzContext -SubscriptionId "${resource.azure_subscription.powershell_lab.subscription_id}"

    # Verify connection
    Get-AzSubscription
  EOF

  destination = "./azure-connect.ps1"
}

Best Practices

1. Principle of Least Privilege: Assign only the minimum roles required for the lab objectives
2. Service Restrictions: Limit services to those essential for the learning experience
3. Regional Constraints: Restrict regions to control costs and simplify the environment
4. Role Separation: Use different users and service principals for different lab scenarios
5. Service Principal Usage: Demonstrate both user and service principal authentication patterns
6. Cost Controls: Monitor resource usage and implement appropriate restrictions
7. Tagging Strategy: Use consistent tags for cost tracking and resource management
8. Credential Security: Mark credential outputs as sensitive and manage access carefully