Azure Subscription

Defined insandboxes.hcl

The azure_subscription resource provisions sandboxed Azure subscriptions for lab environments. It creates controlled Azure subscriptions with user management, service principal access, and resource restrictions suitable for educational and training purposes.

Use Cases

As a lab author, you can use azure_subscription resources to:

• Azure Training Labs: Create realistic Azure environments for hands-on cloud training and certification preparation
• Service-Specific Learning: Restrict access to specific Azure services for focused learning experiences

Azure subscription resources provide realistic cloud environments while maintaining educational control and cost management.

HCL Syntax

Basic Syntax

resource "azure_subscription" "name" {
  regions = ["westeurope"]
  services = ["Microsoft.Compute", "Microsoft.Storage"]

  user "student" {
    roles = ["Contributor"]
  }
}

Full Syntax

resource "azure_subscription" "name" {
  regions = ["westeurope", "eastus"]
  services = ["Microsoft.Compute", "Microsoft.Storage", "Microsoft.Network"]

  tags = {
    Environment = "Training"
    Purpose = "Lab"
    Team = "Education"
  }

  user "admin" {
    roles = ["Owner", "User Access Administrator"]
  }

  user "developer" {
    roles = ["Contributor"]
  }

  service_principal "automation" {
    roles = ["Reader", "Contributor"]
  }
}

Fields

Field	Type	Required	Description
services	list(string)	—	Specify which Azure services users can access. Leave empty to allow all services. Constraintsat least one service must be specified
regions	list(string)	—	Limit resource provisioning to specific Azure regions (e.g., 'eastus', 'westeurope'). Leave empty to allow all. Constraintsat least one region must be specified
tags	map(string)	—	Add metadata tags to organize and track Azure resources (e.g., 'Department: Engineering').
user	block	—	Define Azure AD users with specific RBAC roles for lab participants.repeatable
service_principal	block	—	Define service principals for application authentication with specific RBAC roles.repeatable

User

azure_subscription→User

Azure AD users to create in the subscription

Field	Type	Required	Description
slug	label	—	Unique identifier for the Azure AD user (e.g., 'alice', 'operator').
roles	list(string)	—	Assign Azure RBAC roles (e.g., 'Contributor', 'Reader').

Service Principal

azure_subscription→Service Principal

Azure AD service principals to create in the subscription

Field	Type	Required	Description
slug	label	—	Unique identifier for the service principal (e.g., 'app-backend', 'ci-cd').
roles	list(string)	—	Assign Azure RBAC roles (e.g., 'Storage Blob Data Contributor').

Computed Attributes

These attributes are set by the system and are read-only.

Attribute	Type	Description
subscription_id	string	The Azure subscription ID assigned to this sandbox
tenant_id	string	The Azure AD tenant ID for this subscription
user[].user_id	string	The Azure AD user object ID
user[].username	string	The Azure AD username (UPN)
user[].password	string	The password for this Azure AD user
service_principal[].service_principal_id	string	The Azure AD service principal object ID
service_principal[].app_id	string	The Azure AD application (client) ID
service_principal[].password	string	The client secret for this service principal

User Block

azure_subscription → user

User blocks define Azure AD users to create within the subscription:

Field	Required	Type	Description
name	✓	label	Username for the Azure AD user (specified as block label)
roles	✓	list(string)	Azure RBAC roles to assign to the user.

Service Principal Block

azure_subscription → service_principal

Service principal blocks define Azure AD service principals for application authentication:

Field	Required	Type	Description
name	✓	label	Name for the Azure AD service principal (specified as block label)
roles		list(string)	Azure RBAC roles to assign to the service principal. Defaults to empty list.

User Computed Attributes

For each user block, these attributes are computed:

Field	Type	Description
user_id	string	The Azure AD user object ID
username	string	The Azure AD username
password	string	The user’s password for Azure portal access

Service Principal Computed Attributes

For each service_principal block, these attributes are computed:

Field	Type	Description
service_principal_id	string	The Azure AD service principal object ID
app_id	string	The application (client) ID
password	string	The service principal secret for authentication

Examples

Basic Azure Training Environment

resource "azure_subscription" "training" {
  regions = ["westeurope"]
  services = ["Microsoft.Compute", "Microsoft.Storage", "Microsoft.Network"]

  tags = {
    Environment = "Training"
    Course = "Azure Fundamentals"
  }

  user "student" {
    roles = ["Contributor"]
  }
}

output "student_credentials" {
  value = {
    username = resource.azure_subscription.training.user.student.username       # e.g., "student@contoso.onmicrosoft.com"
    password = resource.azure_subscription.training.user.student.password       # e.g., "TempPass123!"
    tenant_id = resource.azure_subscription.training.tenant_id                  # e.g., "12345678-1234-1234-1234-123456789012"
  }
  sensitive = true
}

Multi-User Workshop Environment

resource "azure_subscription" "workshop" {
  regions = ["westeurope", "eastus"]
  services = [
    "Microsoft.Compute",
    "Microsoft.Storage",
    "Microsoft.Network",
    "Microsoft.Web",
    "Microsoft.Sql"
  ]

  tags = {
    Environment = "Workshop"
    Event = "Azure Solutions Architect Training"
    Instructor = "Jane Doe"
  }

  # Instructor with full access
  user "instructor" {
    roles = ["Owner", "User Access Administrator"]
  }

  # Student with contributor access
  user "student" {
    roles = ["Contributor"]
  }

  # Observer with read-only access
  user "observer" {
    roles = ["Reader"]
  }

  # Service principal for automation
  service_principal "automation" {
    roles = ["Contributor"]
  }
}

Service Principal Integration Lab

resource "azure_subscription" "automation_lab" {
  regions = ["westeurope"]
  services = [
    "Microsoft.Compute",
    "Microsoft.Storage",
    "Microsoft.Resources"
  ]

  tags = {
    Environment = "Automation-Lab"
    Technology = "Service-Principals"
    Level = "Advanced"
  }

  user "developer" {
    roles = ["Contributor"]
  }

  service_principal "ci_cd" {
    roles = ["Contributor"]
  }

  service_principal "monitoring" {
    roles = ["Reader", "Monitoring Reader"]
  }
}

resource "container" "azure_cli" {
  image {
    name = "mcr.microsoft.com/azure-cli"
  }

  environment = {
    AZURE_CLIENT_ID = resource.azure_subscription.automation_lab.service_principal.ci_cd.app_id              # e.g., "12345678-1234-1234-1234-123456789012"
    AZURE_CLIENT_SECRET = resource.azure_subscription.automation_lab.service_principal.ci_cd.password        # e.g., "abcdef123456..."
    AZURE_TENANT_ID = resource.azure_subscription.automation_lab.tenant_id                                   # e.g., "87654321-4321-4321-4321-210987654321"
    AZURE_SUBSCRIPTION_ID = resource.azure_subscription.automation_lab.subscription_id                       # e.g., "11111111-2222-3333-4444-555555555555"
  }
}

Template Integration

resource "azure_subscription" "lab" {
  regions = ["westeurope"]
  services = ["Microsoft.Compute", "Microsoft.Storage"]

  user "student" {
    roles = ["Contributor"]
  }

  service_principal "app" {
    roles = ["Reader"]
  }
}

resource "template" "azure_credentials" {
  source = <<-EOF
    # Azure CLI Login
    az login --service-principal \
      --username ${resource.azure_subscription.lab.service_principal.app.app_id} \
      --password ${resource.azure_subscription.lab.service_principal.app.password} \
      --tenant ${resource.azure_subscription.lab.tenant_id}

    # Set subscription context
    az account set --subscription ${resource.azure_subscription.lab.subscription_id}
  EOF

  destination = "./azure-login.sh"
}

resource "template" "lab_info" {
  source = <<-EOF
    # Azure Lab Environment

    ## Subscription Details
    - Tenant ID: ${resource.azure_subscription.lab.tenant_id}                    # e.g., "12345678-1234-1234-1234-123456789012"
    - Subscription ID: ${resource.azure_subscription.lab.subscription_id}        # e.g., "87654321-4321-4321-4321-210987654321"

    ## User Credentials
    - Username: ${resource.azure_subscription.lab.user.student.username}         # e.g., "student@contoso.onmicrosoft.com"
    - Password: ${resource.azure_subscription.lab.user.student.password}         # e.g., "TempPass123!"

    ## Service Principal
    - App ID: ${resource.azure_subscription.lab.service_principal.app.app_id}    # e.g., "11111111-2222-3333-4444-555555555555"
    - Secret: ${resource.azure_subscription.lab.service_principal.app.password}  # e.g., "abcdef123456..."
  EOF

  destination = "./lab-info.md"
}

Multi-Region Development Environment

resource "azure_subscription" "global_dev" {
  regions = [
    "westeurope",     # West Europe
    "eastus",         # East US
    "southeastasia"   # Southeast Asia
  ]

  services = [
    "Microsoft.Compute",
    "Microsoft.Storage",
    "Microsoft.Network",
    "Microsoft.Web",
    "Microsoft.ContainerRegistry"
  ]

  tags = {
    Environment = "Multi-Region-Dev"
    Purpose = "Global Architecture Training"
    Duration = "2-days"
  }

  user "architect" {
    roles = ["Contributor"]
  }

  service_principal "deployment" {
    roles = ["Contributor"]
  }
}

Role-Based Access Control Lab

resource "azure_subscription" "rbac_lab" {
  regions = ["westeurope"]
  services = ["Microsoft.Compute", "Microsoft.Storage"]

  tags = {
    Environment = "RBAC-Training"
    Focus = "Access-Management"
  }

  # Different users with different permission levels
  user "owner_user" {
    roles = ["Owner"]
  }

  user "contributor_user" {
    roles = ["Contributor"]
  }

  user "reader_user" {
    roles = ["Reader"]
  }

  user "storage_admin" {
    roles = ["Storage Account Contributor"]
  }

  user "vm_admin" {
    roles = ["Virtual Machine Contributor"]
  }

  # Service principals for different scenarios
  service_principal "backup_service" {
    roles = ["Backup Contributor"]
  }

  service_principal "monitoring_service" {
    roles = ["Monitoring Reader"]
  }
}

PowerShell Integration

resource "azure_subscription" "powershell_lab" {
  regions = ["westeurope"]
  services = ["Microsoft.Compute", "Microsoft.Storage"]

  user "admin" {
    roles = ["Owner"]
  }
}

resource "template" "powershell_script" {
  source = <<-EOF
    # Azure PowerShell Login
    $securePassword = ConvertTo-SecureString "${resource.azure_subscription.powershell_lab.user.admin.password}" -AsPlainText -Force
    $credential = New-Object System.Management.Automation.PSCredential("${resource.azure_subscription.powershell_lab.user.admin.username}", $securePassword)

    Connect-AzAccount -Credential $credential -TenantId "${resource.azure_subscription.powershell_lab.tenant_id}"
    Set-AzContext -SubscriptionId "${resource.azure_subscription.powershell_lab.subscription_id}"

    # Verify connection
    Get-AzSubscription
  EOF

  destination = "./azure-connect.ps1"
}

Best Practices

1. Principle of Least Privilege: Assign only the minimum roles required for the lab objectives
2. Service Restrictions: Limit services to those essential for the learning experience
3. Regional Constraints: Restrict regions to control costs and simplify the environment
4. Role Separation: Use different users and service principals for different lab scenarios
5. Service Principal Usage: Demonstrate both user and service principal authentication patterns
6. Cost Controls: Monitor resource usage and implement appropriate restrictions
7. Tagging Strategy: Use consistent tags for cost tracking and resource management
8. Credential Security: Mark credential outputs as sensitive and manage access carefully