如何通过Terraform配置Azure DevOps的AD用户/组分配及自定义团队

一、定义通用配置变量 #

通过Terraform变量抽象可配置项，方便快速复用和修改：

# Azure DevOps项目基础信息
variable "project_id" {
  type        = string
  description = "目标Azure DevOps项目的ID"
}

variable "repo_name" {
  type        = string
  description = "要创建的新Git仓库名称"
}

# 内置默认组的AD成员映射（键为组名，值为AD用户/组ID列表）
variable "built_in_group_memberships" {
  type        = map(list(string))
  description = "Azure DevOps内置组（如Readers、Contributors）与AD用户/组的关联配置"
  validation {
    condition     = contains(["Readers", "Contributors", "Project Administrators", "Build Administrators"], keys(var.built_in_group_memberships))
    error_message = "仅支持Azure DevOps内置默认组名称作为键。"
  }
}

# 自定义团队配置列表
variable "custom_teams" {
  type = list(object({
    name        = string
    description = string
    members     = list(string) # 包含AD用户/组ID，格式为aaduser://<object-id>或aadgroup://<object-id>
  }))
  description = "需要创建的自定义团队及对应的AD成员配置"
}

二、分配AD用户/组到内置默认组 #

通过数据资源获取内置组ID，再批量创建成员关系：

# 获取Azure DevOps内置默认组的ID
data "azuredevops_project_group" "built_in_groups" {
  for_each = toset(keys(var.built_in_group_memberships))
  project_id = var.project_id
  name       = each.key
}

# 为内置组添加AD成员
resource "azuredevops_group_membership" "built_in_group_members" {
  for_each  = var.built_in_group_memberships
  group_id  = data.azuredevops_project_group.built_in_groups[each.key].id
  members   = each.value
}

三、创建自定义团队并分配AD成员 #

先创建团队，再获取自动生成的团队组ID，最后添加成员：

# 创建自定义团队
resource "azuredevops_team" "custom_teams" {
  for_each    = { for team in var.custom_teams : team.name => team }
  project_id  = var.project_id
  name        = each.value.name
  description = each.value.description
}

# 获取自定义团队对应的Azure DevOps组ID（每个团队会自动生成同名组）
data "azuredevops_group" "custom_team_groups" {
  for_each  = azuredevops_team.custom_teams
  project_id = var.project_id
  name       = each.value.name
}

# 为自定义团队添加AD成员
resource "azuredevops_group_membership" "custom_team_members" {
  for_each  = azuredevops_team.custom_teams
  group_id  = data.azuredevops_group.custom_team_groups[each.key].id
  members   = each.value.members
}

四、创建目标Git仓库 #

resource "azuredevops_git_repository" "new_repository" {
  project_id = var.project_id
  name       = var.repo_name
  
  initialization {
    init_type = "Clean" # 创建空仓库，也可指定"Import"导入现有仓库
  }
}

关键说明 #

• AD用户/组的ID格式必须为aaduser://<AD用户对象ID>或aadgroup://<AD组对象ID>，可通过Azure Portal或Azure CLI获取对象ID
• 内置组名称需严格匹配Azure DevOps的默认组名（如Readers、Contributors），避免拼写错误
• 可通过修改variable块的默认值或传入tfvars文件，快速适配不同项目的权限配置

内容的提问来源于stack exchange，提问作者Adam