Azure Entra ID (Azure AD) RBAC & Infrastructure as Code with Terraform

Managing Enterprise Identity & Cloud Resources on Azure

Enforcing Least Privilege Access Management across Azure Subscriptions using Role-Based Access Control (RBAC) and declarative Terraform code.

1. Custom Azure RBAC Role Definition

{
  "Name": "DevOps Infrastructure Operator",
  "IsDataAction": false,
  "Description": "Grants rights to deploy Virtual Machines, Storage, and Virtual Networks without IAM modifications.",
  "Actions": [
    "Microsoft.Compute/virtualMachines/*",
    "Microsoft.Network/virtualNetworks/*",
    "Microsoft.Storage/storageAccounts/*"
  ],
  "NotActions": [
    "Microsoft.Authorization/*/Write",
    "Microsoft.Authorization/*/Delete"
  ],
  "AssignableScopes": [
    "/subscriptions/00000000-0000-0000-0000-000000000000"
  ]
}

2. Terraform Azure Provider Setup

terraform {
  required_version = ">= 1.5.0"
  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "~> 3.90.0"
    }
  }
  backend "azurerm" {
    resource_group_name  = "tfstate-rg"
    storage_account_name = "linuxlabtfstate"
    container_name       = "tfstate"
    key                  = "prod.terraform.tfstate"
  }
}

provider "azurerm" {
  features {}
}