求基于Terraform的Azure DevOps组创建、成员添加及权限配置代码

1. YAML配置文件示例 #

先准备包含组信息、成员列表及权限规则的配置文件（如groups.yaml）：

azure_devops_groups:
  - group_name: "Project Custom Contributors"
    description: "自定义项目贡献者组"
    members:
      - "user1@your-domain.com"
      - "user2@your-domain.com"
    permissions:
      - namespace: "Microsoft.TeamFoundation.Identity"
        token: "PROJECT:$"
        allow: ["CreateTag"]
        deny: []
      - namespace: "Microsoft.TeamFoundation.WorkItemTracking"
        token: "PROJECT:$\WorkItemAreaPath"
        allow: ["EditWorkItems"]
        deny: ["DeleteWorkItems"]
  - group_name: "Project Viewers Limited"
    description: "受限项目查看组"
    members:
      - "user3@your-domain.com"
    permissions:
      - namespace: "Microsoft.TeamFoundation.VersionControl"
        token: "PROJECT:$\GitRepos"
        allow: ["Read"]
        deny: ["Contribute"]

2. Terraform代码实现 #

2.1 配置Provider与依赖 #

terraform {
  required_providers {
    azuredevops = {
      source  = "microsoft/azuredevops"
      version = ">= 0.6.0"
    }
    yaml = {
      source  = "hashicorp/yaml"
      version = ">= 2.2.0"
    }
  }
}

provider "azuredevops" {
  org_service_url = "https://dev.azure.com/your-org-name"
  # 可通过环境变量AZURE_DEVOPS_EXT_PAT传入PAT，或直接配置（建议用变量）
  # personal_access_token = var.pat
}

2.2 读取YAML配置 #

data "yaml_config" "groups" {
  file_path = "${path.module}/groups.yaml"
}

locals {
  azure_devops_groups = data.yaml_config.groups.values.azure_devops_groups
}

2.3 检查/创建组并添加成员 #

# 检查项目中已存在的组
data "azuredevops_group" "existing" {
  for_each = { for g in local.azure_devops_groups : g.group_name => g }
  project_id = var.project_id
  name       = each.value.group_name
}

# 创建不存在的新组
resource "azuredevops_group" "new" {
  for_each = {
    for g in local.azure_devops_groups : g.group_name => g
    if !contains(keys(data.azuredevops_group.existing), g.group_name)
  }
  project_id  = var.project_id
  name        = each.value.group_name
  description = each.value.description
}

# 合并已存在组与新建组的ID映射
locals {
  all_group_ids = merge(
    { for k, v in data.azuredevops_group.existing : k => v.id },
    { for k, v in azuredevops_group.new : k => v.id }
  )
}

# 获取成员用户ID
data "azuredevops_user" "members" {
  for_each = toset(flatten([for g in local.azure_devops_groups : g.members]))
  email = each.value
}

# 为组添加成员
resource "azuredevops_group_membership" "assign" {
  for_each = local.azure_devops_groups
  group_id = local.all_group_ids[each.value.group_name]

  members = [
    for member in each.value.members : data.azuredevops_user.members[member].id
  ]
}

2.4 分配权限 #

# 批量配置组权限
resource "azuredevops_permissions" "group" {
  for_each = {
    for g in local.azure_devops_groups :
    "${g.group_name}-${p.namespace}-${p.token}" => merge(g, { perm_rule = p })
    for p in g.permissions
  }

  principal_id = local.all_group_ids[each.value.group_name]
  namespace    = each.value.perm_rule.namespace
  token        = each.value.perm_rule.token

  # 配置允许权限
  permissions = {
    for perm in each.value.perm_rule.allow : perm => "Allow"
  }

  # 配置拒绝权限
  dynamic "permissions" {
    for_each = each.value.perm_rule.deny
    content {
      permission = permissions.value
      action     = "Deny"
    }
  }
}

3. 变量定义示例 #

variable "project_id" {
  type        = string
  description = "目标Azure DevOps项目ID"
}

variable "pat" {
  type        = string
  description = "Azure DevOps个人访问令牌（PAT）"
  sensitive   = true
}

内容的提问来源于stack exchange，提问作者Geetha Hassan