How to get Group in Azure AD in Pulumi?

Question

I'm trying to get a group in the Azure AD.

var group = Output.Create(
    GetGroup.InvokeAsync(
        new GetGroupArgs
        {
            Name = "Administrators"
        }));

PS C:\dev\___> pulumi preview
Previewing update (dev):
     Type                 Name          Plan     Info
     pulumi:pulumi:Stack  Frontend-dev           1 error

Diagnostics:
  pulumi:pulumi:Stack (Frontend-dev):
    error: Running program 'C:\dev\___\bin\Debug\netcoreapp3.1\Frontend.dll' failed with an unhandled exception:
    Grpc.Core.RpcException: Status(StatusCode=Unknown, Detail="invocation of azuread:index/getGroup:getGroup returned an error: Error building AzureAD Client: Authenticating using the Azure CLI is only supported as a User (not a Service Principal).

    To authenticate to Azure using a Service Principal, you can use the separate 'Authenticate using a Service Principal'
    auth method - instructions for which can be found here:

    Alternatively you can authenticate using the Azure CLI by using a User Account.")
       at Pulumi.GrpcMonitor.InvokeAsync(InvokeRequest request)
       at Pulumi.Deployment.InvokeAsync[T](String token, InvokeArgs args, InvokeOptions options, Boolean convertResult)
       at Pulumi.Output`1.ApplyHelperAsync[U](Task`1 dataTask, Func`2 func)
       at Pulumi.Output`1.Pulumi.IOutput.GetDataAsync()
       at Pulumi.Serialization.Serializer.SerializeAsync(String ctx, Object prop)
       at Pulumi.Deployment.SerializeFilteredPropertiesAsync(String label, IDictionary`2 args, Predicate`1 acceptKey)
       at Pulumi.Deployment.SerializeAllPropertiesAsync(String label, IDictionary`2 args)
       at Pulumi.Deployment.RegisterResourceOutputsAsync(Resource resource, Output`1 outputs)
       at Pulumi.Deployment.Runner.WhileRunningAsync()

The Pulumi.dev.yaml contains the service principal credentials.

I followed the instructions to create a service principal and configure it with the appropriate permissions.

The error message talks about some instructions:

To authenticate to Azure using a Service Principal, you can use the separate 'Authenticate using a Service Principal' auth method - instructions for which can be found here: <- No link

Can anyone help me find those instructions so that I can sort out what I may have missed?

Could you please open an issue in https://github.com/pulumi/pulumi-azuread/ ? — Mikhail Shilkov, Jun 08 '20 at 12:53

Fabio Milheiro · Answer 1 · 2020-06-09T21:01:05.087

Somewhere in the documentation, we're asked to put the credentials in the Pulumi.<stack>.yml via pulumi config set azure:* commands which led me to believe that that should be enough.

The thing is Pulumi.Azure will look for the settings in the azure namespace but Pulumi.AzureAD will look for the same settings in the azuread namespace.

So we not only need this:

pulumi config set azure:clientId "00000000000000000000000"
pulumi config set azure:clientSecret "00000000000000000000000" --secret
pulumi config set azure:tenantId "00000000000000000000000"
pulumi config set azure:subscriptionId "00000000000000000000000"

But we also need run the below:

pulumi config set azuread:clientId "00000000000000000000000"
pulumi config set azuread:clientSecret "00000000000000000000000" --secret
pulumi config set azuread:tenantId "00000000000000000000000"
pulumi config set azuread:subscriptionId "00000000000000000000000"

Which will get us a Pulumi.<stack>.yml similar to this:

config:
  azure:clientId: 00000000000000000000000
  azure:clientSecret:
    secure: 00000000000000000000000000000000000000000000000XqZFM=
  azure:location: WestEurope
  azure:subscriptionId: 00000000000000000000000
  azure:tenantId: 00000000000000000000000
  azuread:clientId: 00000000000000000000000
  azuread:clientSecret:
    secure: 0000000000000000000000000000000000000000000000l3xbaY=
  azuread:subscriptionId: 00000000000000000000000
  azuread:tenantId: 00000000000000000000000

Alternatively, you may also specify environment variables in powershell:

$env:ARM_CLIENT_ID="0000000000000000000000000"
$env:ARM_CLIENT_SECRET="0000000000000000000000000"
$env:ARM_TENANT_ID="0000000000000000000000000"
$env:ARM_SUBSCRIPTION_ID="0000000000000000000000000"

After doing that, my Pulumi stack was able to retrieve the Azure AD group object id successfully.

There's github issue resolved.

How to get Group in Azure AD in Pulumi?

1 Answers1

Linked