Skip to content

Commit a8d968f

Browse files
jaredfholgatejaredfholgate
authored
fix: align subscription_ids variable across azuredevops, github, and local (#134)
* fix: align subscription_ids variable across azuredevops, github, and local - Simplify GUID regex in azuredevops to match github/local pattern - Remove identity from required subscription keys (only management and connectivity required) - Fix extra space in local description * feat: add required_subscription_keys variable and filter empty subscription IDs - Add required_subscription_keys variable to control which subscriptions need valid GUIDs - Update subscription_ids validation to allow null/empty for non-required keys - Filter out null/empty values from target_subscriptions in all locals.tf files * refactor: remove unused azurerm_client_config data source
1 parent a64d524 commit a8d968f

7 files changed

Lines changed: 70 additions & 24 deletions

File tree

‎alz/azuredevops/locals.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@ locals {
3434
}
3535

3636
locals {
37-
target_subscriptions = distinct(values(var.subscription_ids))
37+
target_subscriptions = distinct([for v in values(var.subscription_ids) : v if v != null && v != ""])
3838
}
3939

4040
locals {

‎alz/azuredevops/variables.tf‎

Lines changed: 22 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -26,12 +26,28 @@ variable "root_parent_management_group_id" {
2626
default = ""
2727
}
2828

29+
variable "required_subscription_keys" {
30+
description = <<-EOT
31+
**(Optional, default: `["management", "connectivity"]`)** List of subscription keys that must be present with valid GUID values.
32+
33+
Keys not in this list may have null or empty string values.
34+
Valid keys: 'management', 'connectivity', 'identity', 'security'
35+
EOT
36+
type = list(string)
37+
default = ["management", "connectivity"]
38+
nullable = false
39+
validation {
40+
condition = alltrue([for key in var.required_subscription_keys : contains(["management", "connectivity", "identity", "security"], key)])
41+
error_message = "The required_subscription_keys must be one of 'management', 'connectivity', 'identity' or 'security'"
42+
}
43+
}
44+
2945
variable "subscription_ids" {
3046
description = <<-EOT
3147
**(Optional, default: `{}`)** Map of Azure subscription IDs where Platform Landing Zone resources will be deployed.
3248
3349
Keys must be one of: 'management', 'connectivity', 'identity', 'security'
34-
Values must be valid Azure subscription GUIDs.
50+
Values must be valid Azure subscription GUIDs, or null/empty for non-required keys.
3551
3652
Example:
3753
```
@@ -45,16 +61,16 @@ variable "subscription_ids" {
4561
default = {}
4662
nullable = false
4763
validation {
48-
condition = alltrue([for id in values(var.subscription_ids) : can(regex("^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})$", id))])
49-
error_message = "All subscription IDs must be valid GUIDs"
64+
condition = alltrue([for key, id in var.subscription_ids : contains(var.required_subscription_keys, key) ? can(regex("^[0-9a-fA-F-]{36}$", id)) : (id == null || id == "" || can(regex("^[0-9a-fA-F-]{36}$", id)))])
65+
error_message = "Required subscription IDs must be valid GUIDs. Optional subscription IDs must be valid GUIDs, null, or empty string."
5066
}
5167
validation {
52-
condition = alltrue([for id in keys(var.subscription_ids) : contains(["management", "connectivity", "identity", "security"], id)])
68+
condition = alltrue([for key in keys(var.subscription_ids) : contains(["management", "connectivity", "identity", "security"], key)])
5369
error_message = "The keys of the subscription_ids map must be one of 'management', 'connectivity', 'identity' or 'security'"
5470
}
5571
validation {
56-
condition = contains(keys(var.subscription_ids), "management") && contains(keys(var.subscription_ids), "connectivity") && contains(keys(var.subscription_ids), "identity")
57-
error_message = "You must provide subscription IDs for: 'management', 'connectivity', and 'identity'"
72+
condition = alltrue([for key in var.required_subscription_keys : contains(keys(var.subscription_ids), key)])
73+
error_message = "You must provide subscription IDs for all required subscription keys."
5874
}
5975
}
6076

‎alz/github/locals.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,7 @@ locals {
4141
}
4242

4343
locals {
44-
target_subscriptions = distinct(values(var.subscription_ids))
44+
target_subscriptions = distinct([for v in values(var.subscription_ids) : v if v != null && v != ""])
4545
}
4646

4747
locals {

‎alz/github/variables.tf‎

Lines changed: 22 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -26,12 +26,28 @@ variable "root_parent_management_group_id" {
2626
default = ""
2727
}
2828

29+
variable "required_subscription_keys" {
30+
description = <<-EOT
31+
**(Optional, default: `["management", "connectivity"]`)** List of subscription keys that must be present with valid GUID values.
32+
33+
Keys not in this list may have null or empty string values.
34+
Valid keys: 'management', 'connectivity', 'identity', 'security'
35+
EOT
36+
type = list(string)
37+
default = ["management", "connectivity"]
38+
nullable = false
39+
validation {
40+
condition = alltrue([for key in var.required_subscription_keys : contains(["management", "connectivity", "identity", "security"], key)])
41+
error_message = "The required_subscription_keys must be one of 'management', 'connectivity', 'identity' or 'security'"
42+
}
43+
}
44+
2945
variable "subscription_ids" {
3046
description = <<-EOT
3147
**(Optional, default: `{}`)** Map of Azure subscription IDs where Platform Landing Zone resources will be deployed.
3248
3349
Keys must be one of: 'management', 'connectivity', 'identity', 'security'
34-
Values must be valid Azure subscription GUIDs.
50+
Values must be valid Azure subscription GUIDs, or null/empty for non-required keys.
3551
3652
Example:
3753
```
@@ -45,16 +61,16 @@ variable "subscription_ids" {
4561
default = {}
4662
nullable = false
4763
validation {
48-
condition = alltrue([for id in values(var.subscription_ids) : can(regex("^[0-9a-fA-F-]{36}$", id))])
49-
error_message = "All subscription IDs must be valid GUIDs"
64+
condition = alltrue([for key, id in var.subscription_ids : contains(var.required_subscription_keys, key) ? can(regex("^[0-9a-fA-F-]{36}$", id)) : (id == null || id == "" || can(regex("^[0-9a-fA-F-]{36}$", id)))])
65+
error_message = "Required subscription IDs must be valid GUIDs. Optional subscription IDs must be valid GUIDs, null, or empty string."
5066
}
5167
validation {
52-
condition = alltrue([for id in keys(var.subscription_ids) : contains(["management", "connectivity", "identity", "security"], id)])
68+
condition = alltrue([for key in keys(var.subscription_ids) : contains(["management", "connectivity", "identity", "security"], key)])
5369
error_message = "The keys of the subscription_ids map must be one of 'management', 'connectivity', 'identity' or 'security'"
5470
}
5571
validation {
56-
condition = contains(keys(var.subscription_ids), "management") && contains(keys(var.subscription_ids), "connectivity") && contains(keys(var.subscription_ids), "identity")
57-
error_message = "You must provide subscription IDs for: 'management', 'connectivity', and 'identity'"
72+
condition = alltrue([for key in var.required_subscription_keys : contains(keys(var.subscription_ids), key)])
73+
error_message = "You must provide subscription IDs for all required subscription keys."
5874
}
5975
}
6076

‎alz/local/locals.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ locals {
1717
}
1818

1919
locals {
20-
target_subscriptions = distinct(values(var.subscription_ids))
20+
target_subscriptions = distinct([for v in values(var.subscription_ids) : v if v != null && v != ""])
2121
}
2222

2323
locals {

‎alz/local/variables.tf‎

Lines changed: 23 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -26,12 +26,28 @@ variable "root_parent_management_group_id" {
2626
default = ""
2727
}
2828

29+
variable "required_subscription_keys" {
30+
description = <<-EOT
31+
**(Optional, default: `["management", "connectivity"]`)** List of subscription keys that must be present with valid GUID values.
32+
33+
Keys not in this list may have null or empty string values.
34+
Valid keys: 'management', 'connectivity', 'identity', 'security'
35+
EOT
36+
type = list(string)
37+
default = ["management", "connectivity"]
38+
nullable = false
39+
validation {
40+
condition = alltrue([for key in var.required_subscription_keys : contains(["management", "connectivity", "identity", "security"], key)])
41+
error_message = "The required_subscription_keys must be one of 'management', 'connectivity', 'identity' or 'security'"
42+
}
43+
}
44+
2945
variable "subscription_ids" {
3046
description = <<-EOT
31-
**(Optional, default: `{}`)** Map of Azure subscription IDs where Platform Landing Zone resources will be deployed.
47+
**(Optional, default: `{}`)** Map of Azure subscription IDs where Platform Landing Zone resources will be deployed.
3248
3349
Keys must be one of: 'management', 'connectivity', 'identity', 'security'
34-
Values must be valid Azure subscription GUIDs.
50+
Values must be valid Azure subscription GUIDs, or null/empty for non-required keys.
3551
3652
Example:
3753
```
@@ -45,16 +61,16 @@ variable "subscription_ids" {
4561
default = {}
4662
nullable = false
4763
validation {
48-
condition = alltrue([for id in values(var.subscription_ids) : can(regex("^[0-9a-fA-F-]{36}$", id))])
49-
error_message = "All subscription IDs must be valid GUIDs"
64+
condition = alltrue([for key, id in var.subscription_ids : contains(var.required_subscription_keys, key) ? can(regex("^[0-9a-fA-F-]{36}$", id)) : (id == null || id == "" || can(regex("^[0-9a-fA-F-]{36}$", id)))])
65+
error_message = "Required subscription IDs must be valid GUIDs. Optional subscription IDs must be valid GUIDs, null, or empty string."
5066
}
5167
validation {
52-
condition = alltrue([for id in keys(var.subscription_ids) : contains(["management", "connectivity", "identity", "security"], id)])
68+
condition = alltrue([for key in keys(var.subscription_ids) : contains(["management", "connectivity", "identity", "security"], key)])
5369
error_message = "The keys of the subscription_ids map must be one of 'management', 'connectivity', 'identity' or 'security'"
5470
}
5571
validation {
56-
condition = contains(keys(var.subscription_ids), "management") && contains(keys(var.subscription_ids), "connectivity") && contains(keys(var.subscription_ids), "identity")
57-
error_message = "You must provide subscription IDs for: 'management', 'connectivity', and 'identity'"
72+
condition = alltrue([for key in var.required_subscription_keys : contains(keys(var.subscription_ids), key)])
73+
error_message = "You must provide subscription IDs for all required subscription keys."
5874
}
5975
}
6076

‎modules/azure/data.tf‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,3 @@
1-
data "azurerm_client_config" "alz" {}
2-
31
data "azurerm_subscription" "alz" {
42
for_each = local.subscription_ids
53
subscription_id = each.key

0 commit comments

Comments
 (0)