Forum Discussion
Mult-subscription Terraform deployment and Azure DevOps Service Connections
While it is understood that Terraform templates can facilitate multi-subscription deployment through the 'alias' concept, as outlined in the documentation https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/subscription#example-usage---creating-a-new-alias-and-subscription-for-an-enrollment-account, how does this integration function within the framework of Azure DevOps pipelines?
To illustrate, consider the scenario where you aim to execute the 'terraform apply' command for a template using AZ CLI, deploying resources across multiple subscriptions. AZ CLI requires a service connection object mapped to a specific Azure subscription, leading to deployment failures in other subscriptions, even if the same service connection has access. Is there a better approach to address this issue or what is the recommendation in terms of creating service connections so that such template deployment could work?
5 Replies
Hi, for multi-subscription Terraform from Azure DevOps, I would usually avoid relying on only one classic service connection if the deployment needs access across several subscriptions. A cleaner approach is to use one identity with RBAC assigned at the right management group or subscription scopes, then configure provider aliases in Terraform. If separate service connections are required, the pipeline has to authenticate each context explicitly before the matching provider is used.
Use a single Service Principal / Workload Identity that has the required RBAC roles in all target subscriptions, then use Terraform provider aliases to explicitly target each subscription. You don't need one service connection per subscription unless security boundaries require separate identities. The most common and recommended pattern is:
- One Azure DevOps Service Connection.
- One Service Principal/Workload Identity.
- RBAC permissions on all target subscriptions.
- Terraform provider aliases with explicit subscription_id values.
This allows a single terraform plan/apply to deploy resources across multiple Azure subscriptions successfully.
- any solution found for this ?
- Have you posted this question anywhere else and had any responses? I'm looking to solve the exact same problem.
awdavies90 Haven't posted it anywhere else, also haven't found any solution yet.
