Azure Devops Provider: Example Usage

Download as pdf or txt
Download as pdf or txt
You are on page 1of 59

(https://www.hashicorp.

com)

Azure DevOps provider


The Azure DevOps provider can be used to configure Azure DevOps project in Microsoft Azure
(https://azure.microsoft.com/en-us/) using Azure DevOps Service REST API (https://docs.microsoft.com/en-
us/rest/api/azure/devops/?view=azure-devops-rest-5.1)

Use the navigation to the left to read about the available resources.

Example Usage

provider "azuredevops" {
version = ">= 0.0.1"
}

resource "azuredevops_project" "project" {


project_name = "Project Name"
description = "Project Description"
}

Argument Reference
The following arguments are supported in the provider block:

org_service_url - (Required) This is the Azure DevOps organization url. It can also be sourced from the
AZDO_ORG_SERVICE_URL environment variable.

personal_access_token - (Required) This is the Azure DevOps organization personal access token. The
account corresponding to the token will need "owner" privileges for this organization. It can also be sourced
from the AZDO_PERSONAL_ACCESS_TOKEN environment variable.
(https://www.hashicorp.com)

Data Source: azuredevops_agent_pool


Use this data source to access information about an existing Agent Pool within Azure DevOps.

Example Usage

data "azuredevops_agent_pool" "pool" {


name = "Sample Agent Pool"
}

output "name" {
value = data.azuredevops_agent_pool.pool.name
}

output "pool_type" {
value = data.azuredevops_agent_pool.pool.pool_type
}

output "auto_provision" {
value = data.azuredevops_agent_pool.pool.auto_provision
}

Argument Reference

The following arguments are supported:

name - (Required) Name of the Agent Pool.

Attributes Reference

The following attributes are exported:

name - The name of the agent pool pool_type - Specifies whether the agent pool type is Automation or
Deployment. auto_provision - Specifies whether or not a queue should be automatically provisioned for each
project collection.

Relevant Links

Azure DevOps Service REST API 5.1 - Agent Pools - Get (https://docs.microsoft.com/en-
us/rest/api/azure/devops/distributedtask/pools/get?view=azure-devops-rest-5.1)
(https://www.hashicorp.com)

Data Source: azuredevops_agent_pools


Use this data source to access information about existing Agent Pools within Azure DevOps.

Example Usage

data "azuredevops_agent_pools" "pools" {


}

output "agent_pool_name" {
value = data.azuredevops_agent_pools.pools.agent_pools.*.name
}

output "auto_provision" {
value = data.azuredevops_agent_pools.pools.agent_pools.*.auto_provision
}

output "pool_type" {
value = data.azuredevops_agent_pools.pools.agent_pools.*.pool_type
}

Argument Reference

This data source has no arguments

Attributes Reference

The following attributes are exported:

agent_pools - A list of existing agent pools in your Azure DevOps Organization with the following details
about every agent pool:
name - The name of the agent pool

pool_type - Specifies whether the agent pool type is Automation or Deployment.

auto_provision - Specifies whether or not a queue should be automatically provisioned for each
project collection.

Relevant Links

Azure DevOps Service REST API 5.1 - Agent Pools - Get (https://docs.microsoft.com/en-
us/rest/api/azure/devops/distributedtask/pools/get?view=azure-devops-rest-5.1)
(https://www.hashicorp.com)

Data Source: azuredevops_client_config


Use this data source to access information about the Azure DevOps organization configured for the provider.

Example Usage

data "azuredevops_client_config" "c" {}

output "org_url" {
value = data.azuredevops_client_config.c.organization_url
}

Argument Reference

This data source has no arguments

Attributes Reference

The following attributes are exported:

organization_url - The organization configured for the provider


(https://www.hashicorp.com)

Data Source: azuredevops_git_repositories


Use this data source to access information about an existing Git Repositories within Azure DevOps.

Example Usage

data "azuredevops_project" "p" {


project_name = "contoso-project"
}

data "azuredevops_git_repositories" "all_repos" {


project_id = data.azuredevops_project.p.id
include_hidden = true
}

data "azuredevops_git_repositories" "single_repo" {


project_id = data.azuredevops_project.p.id
name = "contoso-repo"
}

Argument Reference

The following arguments are supported:

project_id - (Optional) ID of project to list Git repositories

name - (Optional) Name of the Git repository to retrieve; requires project_id to be specified as well

include_hidden - (Optional, default: false)

DataSource without specifying any arguments will return all Git repositories of an organization.

Attributes Reference

The following attributes are exported:

repositories - A list of existing projects in your Azure DevOps Organization with details about every project
which includes:

id - Git repository identifier.


name - Git repository name.

url - Details REST API endpoint for the Git Repository.

ssh_url - SSH Url to clone the Git repository

web_url - Url of the Git repository web view

remote_url - HTTPS Url to clone the Git repository

project_id - Project identifier to which the Git repository belongs.

size - Compressed size (bytes) of the repository.

default_branch - The ref of the default branch.

Relevant Links

Azure DevOps Service REST API 5.1 - Git API (https://docs.microsoft.com/en-


us/rest/api/azure/devops/git/?view=azure-devops-rest-5.1)
(https://www.hashicorp.com)

Data Source: azuredevops_group


Use this data source to access information about an existing Group within Azure DevOps

Example Usage

data "azuredevops_project" "p" {


project_name = "contoso-project"
}

data "azuredevops_group" "test" {


project_id = data.azuredevops_project.p.id
name = "Test Group"
}

output "group_id" {
value = data.azuredevops_group.test.id
}

output "group_descriptor" {
value = data.azuredevops_group.test.descriptor
}

Argument Reference

The following arguments are supported:

project_id - (Required) The Project Id.

name - (Required) The Group Name.

Attributes Reference

The following attributes are exported:

id - The ID for this resource is the group descriptor. See below.

descriptor - The Descriptor is the primary way to reference the graph subject. This field will uniquely identify
the same graph subject across both Accounts and Organizations.

Relevant Links
Azure DevOps Service REST API 5.1 - Groups - Get (https://docs.microsoft.com/en-
us/rest/api/azure/devops/graph/groups/get?view=azure-devops-rest-5.1)
(https://www.hashicorp.com)

Data Source: azuredevops_project


Use this data source to access information about an existing Project within Azure DevOps.

Example Usage

data "azuredevops_project" "p" {


project_name = "Sample Project"
}

output "id" {
value = data.azuredevops_project.p.id
}

output "project_name" {
value = data.azuredevops_project.p.project_name
}

output "visibility" {
value = data.azuredevops_project.p.visibility
}

output "version_control" {
value = data.azuredevops_project.p.version_control
}

output "work_item_template" {
value = data.azuredevops_project.p.work_item_template
}

output "process_template_id" {
value = data.azuredevops_project.p.process_template_id
}

Argument Reference

The following arguments are supported:

project_name - (Required) Name of the Project.

Attributes Reference

The following attributes are exported:


description - The description of the referenced project visibility - The visibility of the referenced project
version_control - The version control of the referenced project work_item_template - The work item template
for the referenced project process_template_id - The process template ID for the referenced project

Relevant Links

Azure DevOps Service REST API 5.1 - Projects - Get (https://docs.microsoft.com/en-


us/rest/api/azure/devops/core/projects/get?view=azure-devops-rest-5.1)
(https://www.hashicorp.com)

Data Source: azuredevops_projects


Use this data source to access information about existing Projects within Azure DevOps.

Example Usage

data "azuredevops_projects" "test" {


project_name = "contoso"
state = "wellFormed"
}

output "project_id" {
value = data.azuredevops_projects.test.projects.*.project_id
}

output "project_name" {
value = data.azuredevops_projects.test.projects.*.name
}

output "project_url" {
value = data.azuredevops_projects.test.projects.*.project_url
}

output "state" {
value = data.azuredevops_projects.test.projects.*.state
}

Argument Reference

The following arguments are supported:

project_name - (Optional) Name of the Project, if not specified all projects will be returned.

state - (Optional) State of the Project, if not specified all projects will be returned. Valid values are all ,
deleting , new , wellFormed , createPending , unchanged , deleted .

DataSource without specifying any arguments will return all projects.

Attributes Reference

The following attributes are exported:

projects - A list of existing projects in your Azure DevOps Organization with details about every project
which includes:
project_id - Project identifier.

name - Project name.

project_url - Url to the full version of the object.

state - Project state.

Relevant Links

Azure DevOps Service REST API 5.1 - Projects - Get (https://docs.microsoft.com/en-


us/rest/api/azure/devops/core/projects/get?view=azure-devops-rest-5.1)
(https://www.hashicorp.com)

Data Source: azuredevops_users


Use this data source to access information about an existing users within Azure DevOps.

Example Usage

data "azuredevops_users" "user" {


principal_name = "[email protected]"
}

data "azuredevops_users" "all-users" {


}

data "azuredevops_users" "all-from-origin" {


origin = "aad"
}

data "azuredevops_users" "all-from-subject_types" {


subject_types = [ "aad", "msa" ]
}

data "azuredevops_users" "all-from-origin-id" {


origin = "aad"
origin_id = "a7ead982-8438-4cd2-b9e3-c3aa51a7b675"
}

Argument Reference

The following arguments are supported:

principal_name - (Optional) The PrincipalName of this graph member from the source provider.

subject_types - (Optional) A list of user subject subtypes to reduce the retrieved results, e.g. msa , aad , svc
(service identity), imp (imported identity), etc. The supported subject types are listed below.

origin - (Optional) The type of source provider for the origin_id parameter (ex:AD, AAD, MSA) The
supported origins are listed below.

origin_id - (Optional) The unique identifier from the system of origin.

DataSource without specifying any arguments will return all users inside an organization.
List of possible subject types

AadUser = "aad" # Azure Active Directory Tenant


MsaUser = "msa" # Windows Live
UnknownUser = "unusr"
BindPendingUser = "bnd" # Invited user with pending redeem status
WindowsIdentity = "win" # Windows Active Directory user
UnauthenticatedIdentity = "uauth"
ServiceIdentity = "svc"
AggregateIdentity = "agg"
ImportedIdentity = "imp"
ServerTestIdentity = "tst"
GroupScopeType = "scp"
CspPartnerIdentity = "csp"
SystemServicePrincipal = "s2s"
SystemLicense = "slic"
SystemScope = "sscp"
SystemCspPartner = "scsp"
SystemPublicAccess = "spa"
SystemAccessControl = "sace"
AcsServiceIdentity = "acs"
Unknown = "ukn"

List of possible origins

ActiveDirectory = "ad" # Windows Active Directory


AzureActiveDirectory = "aad" # Azure Active Directory
MicrosoftAccount = "msa" # Windows Live Account
VisualStudioTeamServices = "vsts" # DevOps
GitHubDirectory = "ghb" # GitHub

Attributes Reference

The following attributes are exported:

users - A list of existing users in your Azure DevOps Organization with details about every single user which
includes:

descriptor - The descriptor is the primary way to reference the graph subject while the system is
running. This field will uniquely identify the same graph subject across both Accounts and Organizations.

principal_name - This is the PrincipalName of this graph member from the source provider. The source
provider may change this field over time and it is not guaranteed to be immutable for the life of the
graph member by VSTS.

origin - The type of source provider for the origin identifier (ex:AD, AAD, MSA)

origin_id - The unique identifier from the system of origin. Typically a sid, object id or Guid. Linking
and unlinking operations can cause this value to change for a user because the user is not backed by a
different provider and has a different unique id in the new provider.
display_name - This is the non-unique display name of the graph subject. To change this field, you
must alter its value in the source provider.

mail_address - The email address of record for a given graph member. This may be different than the
principal name.

Relevant Links

Azure DevOps Service REST API 5.1 - Graph Users API (https://docs.microsoft.com/en-
us/rest/api/azure/devops/graph/users?view=azure-devops-rest-5.1)
(https://www.hashicorp.com)

Azure DevOps Provider: Authenticating using the


Personal Access Token
Azure DevOps provider support personal access token for authenticating to Azure DevOps.

Create a personal access token


1. Go to your Azure DevOps. Select an organization.
2. Click the icon next to your icon at the right top corner.
3. Select "Personal access tokens".
4. Click "New Token" then create a new personal access token with the access required by your template. This will be
driven primarily based on which resources you need to provision in Azure DevOps. A token with Full access scope will
work but may provide more access than you need.

5. Copy the personal access token.

Configure Environment Variables


Set the two environment variables. For more details, see theReadme (../../../README.md). AZDO_PERSONAL_ACCESS_TOKEN
and AZDO_ORG_SERVICE_URL . If you use bash, you can try this.

$ export AZDO_PERSONAL_ACCESS_TOKEN=<Personal Access Token>


$ export AZDO_ORG_SERVICE_URL=https://dev.azure.com/<Your Org Name>

Configuration
Configuration file requires azuredevops provider section. Then use any resources and data sources you want.

provider "azuredevops" {
version = ">= 0.0.1"
}

resource "azuredevops_project" "project" {


project_name = "Test Project"
description = "Test Project Description"
}

Custom Defined PAT Scopes


Personal access tokens can be used to authorize full or scoped access associated with the token for deployment of different
Azure DevOps resources. If you wish to limit the PAT scope select a custom defined authorization for the token and select
the permission required for management of the respective resource.
(https://www.hashicorp.com)

azuredevops_agent_pool
Manages an agent pool within Azure DevOps.

Example Usage

resource "azuredevops_agent_pool" "pool" {


name = "sample-pool"
auto_provision = false
}

Argument Reference

The following arguments are supported:

name - (Required) The name of the agent pool.

auto_provision - (Optional) Specifies whether or not a queue should be automatically provisioned for each
project collection. Defaults to false .

pool_type - (Optional) Specifies whether the agent pool type is Automation or Deployment. Defaults to
automation .

Attributes Reference

In addition to all arguments above, the following attributes are exported:

id - The ID of the agent pool.

Relevant Links

Azure DevOps Service REST API 5.1 - Agent Pools (https://docs.microsoft.com/en-


us/rest/api/azure/devops/distributedtask/pools?view=azure-devops-rest-5.1)

Import

Azure DevOps Agent Pools can be imported using the agent pool Id, e.g.
terraform import azuredevops_agent_pool.pool 42
(https://www.hashicorp.com)

azuredevops_agent_queue
Manages an agent queue within Azure DevOps. In the UI, this is equivelant to adding an Organization defined pool
to a project.

The created queue is not authorized for use by all pipeliens in the project. However, the
azuredevops_resource_authorization resource can be used to grant authorization.

Example Usage

resource "azuredevops_project" "p" {


project_name = "Sample Project"
}

data "azuredevops_agent_pool" "p" {


name = "contoso-pool"
}

resource "azuredevops_agent_queue" "q" {


project_id = azuredevops_project.p.id
agent_pool_id = data.azuredevops_agent_pool.p.id
}

resource "azuredevops_resource_authorization" "auth" {


project_id = azuredevops_project.p.id
resource_id = azuredevops_agent_queue.q.id
type = "queue"
authorized = true
}

Argument Reference

The following arguments are supported:

project_id - (Required) The ID of the project in which to create the resource.

agent_pool_id - (Required) The ID of the organization agent pool.

Attributes Reference

In addition to all arguments above, the following attributes are exported:

id - The ID of the agent queue reference.


Relevant Links

Azure DevOps Service REST API 5.1 - Agent Queues (https://docs.microsoft.com/en-


us/rest/api/azure/devops/distributedtask/queues?view=azure-devops-rest-5.1)

Import

Azure DevOps Agent Pools can be imported using the project ID and agent queue ID, e.g.

terraform import azuredevops_agent_queue.q 44cbf614-4dfd-4032-9fae-87b0da3bec30/1381


(https://www.hashicorp.com)

azuredevops_git_repository
Manages a git repository within Azure DevOps.

Example Usage

Create Git repository

resource "azuredevops_project" "project" {


project_name = "Sample Project"
visibility = "private"
version_control = "Git"
work_item_template = "Agile"
}

resource "azuredevops_git_repository" "repo" {


project_id = azuredevops_project.project.id
name = "Sample Empty Git Repository"
initialization {
init_type = "Clean"
}
}

Create Fork of another Azure DevOps Git repository

resource "azuredevops_git_repository" "repo" {


project_id = azuredevops_project.project.id
name = "Sample Fork an Existing Repository"
parent_id = azuredevops_git_repository.parent.id
}

Argument Reference

The following arguments are supported:

project_id - (Required) The project ID or project name.

name - (Required) The name of the git repository.

parent_id - (Optional) The ID of a Git project from which a fork is to be created.

initialization - (Optional) An initialization block as documented below.


initialization block supports the following:

init_type - (Required) The type of repository to create. Valid values: Uninitialized , Clean , or Import .
Defaults to Uninitialized .

source_type - (Optional) Type type of the source repository. Used if the init_type is Import .

source_url - (Optional) The URL of the source repository. Used if the init_type is Import .

Attributes Reference

In addition to all arguments above, except initialization , the following attributes are exported:

id - The ID of the Git repository.

default_branch - The ref of the default branch.

is_fork - True if the repository was created as a fork.

remote_url - Git HTTPS URL of the repository

size - Size in bytes.

ssh_url - Git SSH URL of the repository.

url - REST API URL of the repository.

web_url - Web link to the repository.

Relevant Links

Azure DevOps Service REST API 5.1 - Agent Pools (https://docs.microsoft.com/en-


us/rest/api/azure/devops/git/repositories?view=azure-devops-rest-5.1)
(https://www.hashicorp.com)

azuredevops_branch_policy_build_validation
Manages a build validation branch policy within Azure DevOps.

Example Usage
resource "azuredevops_project" "p" {
project_name = "Sample Project"
}

resource "azuredevops_git_repository" "r" {


project_id = azuredevops_project.p.id
name = "Sample Repo"
initialization {
init_type = "Clean"
}
}

resource "azuredevops_build_definition" "b" {


project_id = azuredevops_project.p.id
name = "Sample Build Definition"

repository {
repo_type = "TfsGit"
repo_id = azuredevops_git_repository.r.id
yml_path = "azure-pipelines.yml"
}
}

resource "azuredevops_branch_policy_build_validation" "p" {


project_id = azuredevops_project.p.id

enabled = true
blocking = true

settings {
display_name = "Don't break the build!"
build_definition_id = azuredevops_build_definition.b.id
valid_duration = 720

scope {
repository_id = azuredevops_git_repository.r.id
repository_ref = azuredevops_git_repository.r.default_branch
match_type = "Exact"
}

scope {
repository_id = azuredevops_git_repository.r.id
repository_ref = "refs/heads/releases"
match_type = "Prefix"
}
}
}

Argument Reference

The following arguments are supported:

project_id - (Required) The ID of the project in which the policy will be created.

enabled - (Optional) A flag indicating if the policy should be enabled. Defaults to true .
blocking - (Optional) A flag indicating if the policy should be blocking. Defaults to true .

settings - (Required) Configuration for the policy. This block must be defined exactly once.

A settings block supports the following:

build_definition_id - (Required) The ID of the build to monitor for the policy.

display_name - (Required) The display name for the policy.

manual_queue_only - (Optional) If set to true, the build will need to be manually queued. Defaults to false

queue_on_source_update_only - (Optional) True if the build should queue on source updates only. Defaults to
true .

valid_duration - (Optional) The number of minutes for which the build is valid. If 0 , the build will not expire.
Defaults to 720 (12 hours).

scope (Required) Controls which repositories and branches the policy will be enabled for. This block must be
defined at least once.

A settings scope block supports the following: * repository_id - (Optional) The repository ID. Needed only if
the scope of the policy will be limited to a single repository. * repository_ref - (Optional) The ref pattern to use for
the match. If match_type is Exact , this should be a qualified ref such as refs/heads/master . If match_type is
Prefix , this should be a ref path such as refs/heads/releases . * match_type (Optional) The match type to use
when applying the policy. Supported values are Exact (default) or Prefix .

Attributes Reference

In addition to all arguments above, the following attributes are exported:

id - The ID of branch policy configuration.

Relevant Links

Azure DevOps Service REST API 5.1 - Policy Configurations (https://docs.microsoft.com/en-


us/rest/api/azure/devops/policy/configurations/create?view=azure-devops-rest-5.1)

Import

Azure DevOps Branch Policies can be imported using the project ID and policy configuration ID:

terraform import azuredevops_branch_policy_build_validation.p aa4a9756-8a86-4588-86d7-b3ee2d88b033/60`


``
(https://www.hashicorp.com)

azuredevops_branch_policy_min_reviewers
Manages a minimum reviewer branch policy within Azure DevOps.

Example Usage

resource "azuredevops_project" "p" {


project_name = "Sample Project"
}

resource "azuredevops_git_repository" "r" {


project_id = azuredevops_project.p.id
name = "Sample Repo"
initialization {
init_type = "Clean"
}
}

resource "azuredevops_branch_policy_min_reviewers" "p" {


project_id = azuredevops_project.p.id

enabled = true
blocking = true

settings {
reviewer_count = 2
submitter_can_vote = false

scope {
repository_id = azuredevops_git_repository.r.id
repository_ref = azuredevops_git_repository.r.default_branch
match_type = "Exact"
}

scope {
repository_id = azuredevops_git_repository.r.id
repository_ref = "refs/heads/releases"
match_type = "Prefix"
}
}
}

Argument Reference

The following arguments are supported:

project_id - (Required) The ID of the project in which the policy will be created.
enabled - (Optional) A flag indicating if the policy should be enabled. Defaults to true .

blocking - (Optional) A flag indicating if the policy should be blocking. Defaults to true .

settings - (Required) Configuration for the policy. This block must be defined exactly once.

A settings block supports the following:

reviewer_count - (Required) The number of reviewrs needed to approve.

submitter_can_vote - (Optional) Controls whether or not the submitter's vote counts. Defaults to false .

scope (Required) Controls which repositories and branches the policy will be enabled for. This block must be
defined at least once.

A settings scope block supports the following: * repository_id - (Optional) The repository ID. Needed only if
the scope of the policy will be limited to a single repository. * repository_ref - (Optional) The ref pattern to use for
the match. If match_type is Exact , this should be a qualified ref such as refs/heads/master . If match_type is
Prefix , this should be a ref path such as refs/heads/releases . * match_type (Optional) The match type to use
when applying the policy. Supported values are Exact (default) or Prefix .

Attributes Reference

In addition to all arguments above, the following attributes are exported:

id - The ID of branch policy configuration.

Relevant Links

Azure DevOps Service REST API 5.1 - Policy Configurations (https://docs.microsoft.com/en-


us/rest/api/azure/devops/policy/configurations/create?view=azure-devops-rest-5.1)

Import

Azure DevOps Branch Policies can be imported using the project ID and policy configuration ID:

terraform import azuredevops_branch_policy_min_reviewers.p aa4a9756-8a86-4588-86d7-b3ee2d88b033/60``


`
(https://www.hashicorp.com)

azuredevops_build_definition
Manages a Build Definition within Azure DevOps.

Example Usage

resource "azuredevops_project" "project" {


project_name = "Sample Project"
visibility = "private"
version_control = "Git"
work_item_template = "Agile"
}

resource "azuredevops_git_repository" "repository" {


project_id = azuredevops_project.project.id
name = "Sample Repository"
initialization {
init_type = "Clean"
}
}

resource "azuredevops_variable_group" "vars" {


project_id = azuredevops_project.project.id
name = "Infrastructure Pipeline Variables"
description = "Managed by Terraform"
allow_access = true

variable {
name = "FOO"
value = "BAR"
}
}

resource "azuredevops_build_definition" "build" {


project_id = azuredevops_project.project.id
name = "Sample Build Definition"
path = "\\ExampleFolder"

ci_trigger {
use_yaml = true
}

repository {
repo_type = "TfsGit"
repo_id = azuredevops_git_repository.repository.id
branch_name = azuredevops_git_repository.repository.default_branch
yml_path = "azure-pipelines.yml"
}

variable_groups = [
azuredevops_variable_group.vars.id
]

variable {
name = "PipelineVariable"
value = "Go Microsoft!"
}

variable {
name = "PipelineSecret"
secret_value = "ZGV2cw"
is_secret = true
}
}

Argument Reference

The following arguments are supported:

project_id - (Required) The project ID or project name.

name - (Optional) The name of the build definition.

agent_pool_name - (Optional) The agent pool that should execute the build. Defaults to Hosted Ubuntu 1604 .

repository - (Required) A repository block as documented below.

ci_trigger - (Optional) Continuous Integration Integration trigger.

pull_request_trigger - (Optional) Pull Request Integration Integration trigger.

variable_groups - (Optional) A list of variable group IDs (integers) to link to the build definition.

variable - (Optional) A list of variable blocks, as documented below.

variable block supports the following:

name - (Required) The name of the variable.

value - (Optional) The value of the variable.

secret_value - (Optional) The secret value of the variable. Used when is_secret set to true .

is_secret - (Optional) True if the variable is a secret. Defaults to false .

allow_override - (Optional) True if the variable can be overridden. Defaults to true .

repository block supports the following:

branch_name - (Optional) The branch name for which builds are triggered. Defaults to master .

repo_id - (Required) The id of the repository. For TfsGit repos, this is simply the ID of the repository. For
Github repos, this will take the form of <GitHub Org>/<Repo Name> . For Bitbucket repos, this will take the
form of <Workspace ID>/<Repo Name> .
repo_type - (Optional) The repository type. Valid values: GitHub or TfsGit or Bitbucket . Defaults to
Github .

service_connection_id - (Optional) The service connection ID. Used if the repo_type is GitHub .

yml_path - (Required) The path of the Yaml file describing the build definition.

ci_trigger block supports the following:

use_yaml - (Optional) Use the azure-pipeline file for the build configuration. Defaults to false .

override - (Optional) Override the azure-pipeline file and use a this configuration for all builds.

ci_trigger override block supports the following:

batch - (Optional) If you set batch to true, when a pipeline is running, the system waits until the run is
completed, then starts another run with all changes that have not yet been built. Defaults to true .

branch_filter - (Optional) The branches to include and exclude from the trigger.

path_filter - (Optional) Specify file paths to include or exclude. Note that the wildcard syntax is different
between branches/tags and file paths.

max_concurrent_builds_per_branch - (Optional) The number of max builds per branch. Defaults to 1 .

polling_interval - (Optional) How often the external repository is polled. Defaults to 0 .

polling_job_id - (Computed) This is the ID of the polling job that polls the external repository. Once the
build definition is saved/updated, this value is set.

pull_request_trigger block supports the following:

use_yaml - (Optional) Use the azure-pipeline file for the build configuration. Defaults to false .

initial_branch - (Optional) When use_yaml is true set this to the name of the branch that the azure-
pipelines.yml exists on. Defaults to Managed by Terraform .

forks - (Required) Set permissions for Forked repositories.

override - (Optional) Override the azure-pipeline file and use a this configuration for all builds.

forks block supports the following:

enabled - (Required) Build pull requests form forms of this repository.

share_secrets - (Required) Make secrets available to builds of forks.

pull_request_trigger override block supports the following:

auto_cancel - (Optional) . Defaults to true .

branch_filter - (Optional) The branches to include and exclude from the trigger.

path_filter - (Optional) Specify file paths to include or exclude. Note that the wildcard syntax is different
between branches/tags and file paths.
branch_filter block supports the following:

include - (Optional) List of branch patterns to include.

exclude - (Optional) List of branch patterns to exclude.

path_filter block supports the following:

include - (Optional) List of path patterns to include.

exclude - (Optional) List of path patterns to exclude.

Attributes Reference

In addition to all arguments above, the following attributes are exported:

id - The ID of the build definition

revision - The revision of the build definition

Relevant Links

Azure DevOps Service REST API 5.1 - Build Definitions (https://docs.microsoft.com/en-


us/rest/api/azure/devops/build/definitions?view=azure-devops-rest-5.1)

Import

Azure DevOps Build Definitions can be imported using the project name/definitions Id or by the project
Guid/definitions Id, e.g.

terraform import azuredevops_build_definition.build "Test Project"/10


or
terraform import azuredevops_build_definition.build 782a8123-1019-xxxx-xxxx-xxxxxxxx/10
(https://www.hashicorp.com)

azuredevops_group
Manages a group within Azure DevOps.

Example Usage

resource "azuredevops_project" "p" {


project_name = "Test Project"
}

data "azuredevops_group" "tf-project-readers" {


project_id = azuredevops_project.p.id
name = "Readers"
}

data "azuredevops_group" "tf-project-contributors" {


project_id = azuredevops_project.p.id
name = "Contributors"
}

resource "azuredevops_group" "g" {


scope = azuredevops_project.p.id
display_name = "Test group"
description = "Test description"

members = [
data.azuredevops_group.tf-project-readers.descriptor,
data.azuredevops_group.tf-project-contributors.descriptor
]
}

Argument Reference

The following arguments are supported:

scope - (Optional) The scope of the group. A descriptor referencing the scope (collection, project) in which
the group should be created. If omitted, will be created in the scope of the enclosing account or organization.x

origin_id - (Optional) The OriginID as a reference to a group from an external AD or AAD backed provider.
The scope , mail and display_name arguments cannot be used simultaneously with origin_id .

mail - (Optional) The mail address as a reference to an existing group from an external AD or AAD backed
provider. The scope , origin_id and display_name arguments cannot be used simultaneously with mail .

display_name - (Optional) The name of a new Azure DevOps group that is not backed by an external
provider. The origin_id and mail arguments cannot be used simultaneously with display_name .
description - (Optional) The Description of the Project.

members - (Optional) > NOTE: It's possible to define group members both within the azuredevops_group
resource via the members block and by using the azuredevops_group_membership resource. However it's not
possible to use both methods to manage group members, since there'll be conflicts.

Attributes Reference

In addition to all arguments above, the following attributes are exported:

id - The ID of the Group.

url - This url is the full route to the source resource of this graph subject.

origin - The type of source provider for the origin identifier (ex:AD, AAD, MSA)

subject_kind - This field identifies the type of the graph subject (ex: Group, Scope, User).

domain - This represents the name of the container of origin for a graph member.

principal_name - This is the PrincipalName of this graph member from the source provider.

descriptor - The identity (subject) descriptor of the Group.

Relevant Links

Azure DevOps Service REST API 5.1 - Groups (https://docs.microsoft.com/en-


us/rest/api/azure/devops/graph/groups?view=azure-devops-rest-5.1)

Import

Azure DevOps Projects can be imported using the group identity descriptor, e.g.

terraform import azuredevops_project.id aadgp.Uy0xLTktMTU1MTM3NDI0NS0xMjA0NDAwOTY5LTI0MDI5ODY0MTMtMjE3


OTQwODYxNi0zLTIxNjc2NjQyNTMtMzI1Nzg0NDI4OS0yMjU4MjcwOTc0LTI2MDYxODY2NDU

PAT Permissions Required

Project & Team: Read, Write, & Manage


(https://www.hashicorp.com)

azuredevops_group_membership
Manages group membership within Azure DevOps.

Example Usage

resource "azuredevops_project" "project" {


project_name = "Test Project"
}

resource "azuredevops_user_entitlement" "user" {


principal_name = "[email protected]"
}

data "azuredevops_group" "group" {


project_id = azuredevops_project.project.id
name = "Build Administrators"
}

resource "azuredevops_group_membership" "membership" {


group = data.azuredevops_group.group.descriptor
members = [
azuredevops_user_entitlement.user.descriptor
]
}

Argument Reference

The following arguments are supported:

group - (Required) The descriptor of the group being managed.

members - (Required) A list of user or group descriptors that will become members of the group. > NOTE: It's
possible to define group members both within the azuredevops_group_membership resource via the
members block and by using the azuredevops_group resource. However it's not possible to use both methods
to manage group members, since there'll be conflicts.

mode - (Optional) The mode how the resource manages group members.
mode == add : the resource will ensure that all specified members will be part of the referenced group

mode == overwrite : the resource will replace all existing members with the members specified within
the members block > NOTE: To clear all members from a group, specify an empty list of descriptors in
the members attribute and set the mode member to overwrite .
Attributes Reference

In addition to all arguments above, the following attributes are exported:

id - A random ID for this resource. There is no "natural" ID, so a random one is assigned.

Relevant Links

Azure DevOps Service REST API 5.1 - Memberships (https://docs.microsoft.com/en-


us/rest/api/azure/devops/graph/memberships?view=azure-devops-rest-5.0)

Import

Not supported.

PAT Permissions Required

Deployment Groups: Read & Manage


(https://www.hashicorp.com)

azuredevops_project_features
Manages features for Azure DevOps projects

Example Usage

provider "azuredevops" {
version = ">= 0.0.1"
}

data "azuredevops_project" "tf-project-test-001" {


project_name = "Test Project"
}

resource "azuredevops_project_features" "my-project-features" {


project_id = data.azuredevops_project.tf-project-test-001.id
features = {
"testplans" = "disabled"
"artifacts" = "enabled"
}
}

Argument Reference

The following arguments are supported:

projectd_id - (Required) The id of the project for which the project features will be managed.

features - (Required) Defines the status ( enabled , disabled ) of the project features.
Valid features boards , repositories , pipelines , testplans , artifacts

NOTE:
It's possible to define project features both within the azuredevops_project_features resource
(/docs/providers/ado/r/project_features.html) and via the features block by using the
azuredevops_project resource (/docs/providers/ado/r/project.html). However it's not possible to use both
methods to manage group members, since there'll be conflicts.

Attributes Reference

In addition to all arguments above, the following attributes are exported:


Relevant Links

No official documentation available

Import

Azure DevOps feature settings can be imported using the project id, e.g.

$ terraform import azuredevops_project_features.project_id 2785562e-8f45-4534-a10e-b9ca1666b17e

PAT Permissions Required

Project & Team: Read, Write, & Manage


(https://www.hashicorp.com)

azuredevops_project
Manages a project within Azure DevOps.

Example Usage

resource "azuredevops_project" "project" {


project_name = "Test Project"
description = "Test Project Description"
visibility = "private"
version_control = "Git"
work_item_template = "Agile"

features = {
"testplans" = "disabled"
"artifacts" = "disabled"
}
}

Argument Reference

The following arguments are supported:

project_name - (Required) The Project Name.

description - (Optional) The Description of the Project.

visibility - (Optional) Specifies the visibility of the Project. Valid values: private or public . Defaults to
private .

version_control - (Optional) Specifies the version control system. Valid values: Git or Tfvc . Defaults to
Git .

work_item_template - (Optional) Specifies the work item template. Defaults to Agile .

features - (Optional) Defines the status ( enabled , disabled ) of the project features.
Valid features boards , repositories , pipelines , testplans , artifacts
NOTE:
It's possible to define project features both within the azuredevops_project_features resource
(/docs/providers/ado/r/project_features.html) and via the features block by using the
azuredevops_project resource (/docs/providers/ado/r/project.html). However it's not possible to use both
methods to manage group members, since there'll be conflicts.

Attributes Reference

In addition to all arguments above, the following attributes are exported:

id - The Project ID of the Project.

process_template_id - The Process Template ID used by the Project.

Relevant Links

Azure DevOps Service REST API 5.1 - Projects (https://docs.microsoft.com/en-


us/rest/api/azure/devops/core/projects?view=azure-devops-rest-5.1)

Import

Azure DevOps Projects can be imported using the project name or by the project Guid, e.g.

$ terraform import azuredevops_project.project "Test Project"

or

$ terraform import azuredevops_project.project 782a8123-1019-xxxx-xxxx-xxxxxxxx

PAT Permissions Required

Project & Team: Read, Write, & Manage


(https://www.hashicorp.com)

azuredevops_resource_authorization
Manages authorization of resources, e.g. for access in build pipelines.

Currently supported resources: service endpoint (aka service connection, endpoint).

Example Usage
resource "azuredevops_project" "p" {
project_name = "Test Project"
}

resource "azuredevops_serviceendpoint_bitbucket" "bitbucket_account" {


project_id = azuredevops_project.p.id
username = "xxxx"
password = "xxxx"
service_endpoint_name = "test-bitbucket"
description = "test"
}

resource "azuredevops_resource_authorization" "auth" {


project_id = azuredevops_project.p.id
resource_id = azuredevops_serviceendpoint_bitbucket.bitbucket_account.id
authorized = true
}

Argument Reference
The following arguments are supported:

project_id - (Required) The project ID or project name. Type: string.


resource_id - (Required) The ID of the resource to authorize. Type: string.
authorized - (Required) Set to true to allow public access in the project. Type: boolean.
type - (Optional) The type of the resource to authorize. Type: string. Valid values: endpoint , queue . Default value:
endpoint .

Attributes Reference
The following attributes are exported:

n/a

Relevant Links
Azure DevOps Service REST API 5.1 - Authorize Definition Resource (https://docs.microsoft.com/en-
us/rest/api/azure/devops/build/resources/authorize%20definition%20resources?view=azure-devops-rest-5.1)
(https://www.hashicorp.com)

azuredevops_serviceendpoint_azurerm
Manages Manual or Automatic AzureRM service endpoint within Azure DevOps.

Requirements (Manual AzureRM Service Endpoint)

Before to create a service end point in Azure DevOps, you need to create a Service Principal in your Azure
subscription.

For detailed steps to create a service principal with Azure cli see the documentation
(https://docs.microsoft.com/en-us/cli/azure/create-an-azure-service-principal-azure-cli?view=azure-cli-
latest)

Example Usage

Manual AzureRM Service Endpoint

resource "azuredevops_project" "project" {


project_name = "Sample Project"
visibility = "private"
version_control = "Git"
work_item_template = "Agile"
}

resource "azuredevops_serviceendpoint_azurerm" "endpointazure" {


project_id = azuredevops_project.project.id
service_endpoint_name = "TestServiceRM"
credentials {
serviceprincipalid = "xxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxx"
serviceprincipalkey = "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
}
azurerm_spn_tenantid = "xxxxxxx-xxxx-xxx-xxxxx-xxxxxxxx"
azurerm_subscription_id = "xxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxx"
azurerm_subscription_name = "Sample Subscription"
}

Automatic AzureRM Service Endpoint


resource "azuredevops_project" "project" {
project_name = "Sample Project"
visibility = "private"
version_control = "Git"
work_item_template = "Agile"
}

resource "azuredevops_serviceendpoint_azurerm" "endpointazure" {


project_id = azuredevops_project.project.id
service_endpoint_name = "TestServiceRM"
azurerm_spn_tenantid = "xxxxxxx-xxxx-xxx-xxxxx-xxxxxxxx"
azurerm_subscription_id = "xxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxx"
azurerm_subscription_name = "Microsoft Azure DEMO"
}

Argument Reference

The following arguments are supported:

project_id - (Required) The project ID or project name.

service_endpoint_name - (Required) The Service Endpoint name.

azurerm_spn_tenantid - (Required) The tenant id if the service principal.

azurerm_subscription_id - (Required) The subscription Id of the Azure targets.

azurerm_subscription_name - (Required) The subscription Name of the targets.

credentials - (Optional) A credentials block.

resource_group - (Optional) The resource group used for scope of automatic service endpoint.

A credentials block supports the following:

serviceprincipalid - (Required) The service principal application Id

serviceprincipalkey - (Required) The service principal secret.

Attributes Reference

The following attributes are exported:

id - The ID of the service endpoint.

project_id - The project ID or project name.

service_endpoint_name - The Service Endpoint name.


Relevant Links

Azure DevOps Service REST API 5.1 - Service End points (https://docs.microsoft.com/en-
us/rest/api/azure/devops/serviceendpoint/endpoints?view=azure-devops-rest-5.1)
(https://www.hashicorp.com)

azuredevops_serviceendpoint_bitbucket
Manages a Bitbucket service endpoint within Azure DevOps.

Example Usage

resource "azuredevops_project" "project" {


project_name = "Sample Project"
visibility = "private"
version_control = "Git"
work_item_template = "Agile"
}

resource "azuredevops_serviceendpoint_bitbucket" "serviceendpoint" {


project_id = azuredevops_project.project.id
username = "xxxx"
password = "xxxx"
service_endpoint_name = "test-bitbucket"
description = "test"
}

Argument Reference

The following arguments are supported:

project_id - (Required) The project ID or project name.

service_endpoint_name - (Required) The Service Endpoint name.

username - (Required) Bitbucket account username.

password - (Required) Bitbucket account password.

description - (Optional) The Service Endpoint description. Defaults to Managed by Terraform .

Attributes Reference

The following attributes are exported:

id - The ID of the service endpoint.

project_id - The project ID or project name.

service_endpoint_name - The Service Endpoint name.


Relevant Links

Azure DevOps Service REST API 5.1 - Agent Pools (https://docs.microsoft.com/en-


us/rest/api/azure/devops/serviceendpoint/endpoints?view=azure-devops-rest-5.1)

Import

Azure DevOps Service Endpoint Bitbucket can be imported using the projectID/serviceEndpointID, e.g.

terraform import azuredevops_serviceendpoint_bitbucket.serviceendpoint xxxxxxxx-xxxx-xxxx-xxxx-xxxxxx


xxxxxx/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
(https://www.hashicorp.com)

azuredevops_serviceendpoint_dockerhub
Manages a Docker Hub service endpoint within Azure DevOps.

Example Usage

resource "azuredevops_project" "project" {


project_name = "Sample Project"
visibility = "private"
version_control = "Git"
work_item_template = "Agile"
}

resource "azuredevops_serviceendpoint_dockerhub" "serviceendpoint" {


project_id = azuredevops_project.project.id
service_endpoint_name = "Sample Docker Hub"

docker_username = "sample"

docker_email = "[email protected]"

docker_password = "12345"

Argument Reference

The following arguments are supported:

project_id - (Required) The project ID or project name.

service_endpoint_name - (Required) The Service Endpoint name.

description - (Required) The Service Endpoint description.

docker_username - (Required) The username for Docker Hub account. Defaults to


AZDO_DOCKERHUB_SERVICE_CONNECTION_USERNAME environment variable, if present.

docker_email - (Required) The email for Docker Hub account. Defaults to


AZDO_DOCKERHUB_SERVICE_CONNECTION_EMAIL environment variable, if present.

docker_password - (Required) The password for Docker Hub account. Defaults to


AZDO_DOCKERHUB_SERVICE_CONNECTION_PASSWORD environment variable, if present.
Attributes Reference

The following attributes are exported:

id - The ID of the service endpoint.

project_id - The project ID or project name.

service_endpoint_name - The Service Endpoint name.

Relevant Links

Azure DevOps Service REST API 5.1 - Agent Pools (https://docs.microsoft.com/en-


us/rest/api/azure/devops/serviceendpoint/endpoints?view=azure-devops-rest-5.1)
(https://www.hashicorp.com)

azuredevops_serviceendpoint_dockerhub
Manages a Docker Registry service endpoint within Azure DevOps.

Example Usage

resource "azuredevops_project" "project" {


project_name = "Sample Project"
visibility = "private"
version_control = "Git"
work_item_template = "Agile"
}

resource "azuredevops_serviceendpoint_dockerregistry" "dockerhubregistry" {


project_id = azuredevops_project.project.id
service_endpoint_name = "Sample Docker Hub"

docker_username = "sample"
docker_email = "[email protected]"
docker_password = "12345"
registry_type = "DockerHub"
}

resource "azuredevops_serviceendpoint_dockerregistry" "otherregistry" {


project_id = azuredevops_project.project.id
service_endpoint_name = "Sample Docker Registry"
docker_registry = "https://sample.azurecr.io/v1"
docker_username = "sample"
docker_password = "12345"
registry_type = "Others"
}

Argument Reference

The following arguments are supported:

project_id - (Required) The project ID or project name.

service_endpoint_name - (Required) The name you will use to refer to this service connection in task inputs.

description - (Optional) The name you will use to refer to this service connection in task inputs.

docker_registry - (Optional) The URL of the Docker registry. (Default: " https://index.docker.io/v1/"
(https://index.docker.io/v1/%22))
docker_username - (Optional) The identifier of the Docker account user.

docker_email - (Optional) The email for Docker account user.

docker_password - (Optional) The password for the account user identified above.

registry_type - (Optional) Can be "DockerHub" or "Others" (Default "DockerHub")

Attributes Reference

The following attributes are exported:

id - The ID of the service endpoint.

project_id - The project ID or project name.

service_endpoint_name - The Service Endpoint name.

Relevant Links

Azure DevOps Service REST API 5.1 - Service Endpoints (https://docs.microsoft.com/en-


us/rest/api/azure/devops/serviceendpoint/endpoints?view=azure-devops-rest-5.1)

Docker Registry Service Connection (https://docs.microsoft.com/en-


us/azure/devops/pipelines/library/service-endpoints?view=azure-devops&tabs=yaml#sep-docreg)
(https://www.hashicorp.com)

azuredevops_serviceendpoint_github
Manages a GitHub service endpoint within Azure DevOps.

Example Usage

resource "azuredevops_project" "project" {


project_name = "Sample Project"
visibility = "private"
version_control = "Git"
work_item_template = "Agile"
}

resource "azuredevops_serviceendpoint_github" "serviceendpoint_gh_1" {


project_id = azuredevops_project.project.id
service_endpoint_name = "Sample GithHub Personal Access Token"

auth_personal {

personal_access_token = "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
}
}

resource "azuredevops_serviceendpoint_github" "serviceendpoint_gh_2" {


project_id = azuredevops_project.project.id
service_endpoint_name = "Sample GithHub Grant"

auth_oauth {
oauth_configuration_id = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
}
}

resource "azuredevops_serviceendpoint_github" "serviceendpoint_gh_3" {


project_id = azuredevops_project.project.id
service_endpoint_name = "Sample GithHub Apps: Azure Pipelines"

description = ""
}

Argument Reference

The following arguments are supported:


project_id - (Required) The project ID or project name.

service_endpoint_name - (Required) The Service Endpoint name.

description - (Optional) The Service Endpoint description. Defaults to Managed by Terraform .

auth_personal - (Optional) An auth_personal block as documented below. Allows connecting using a


personal access token.

auth_oauth - (Optional) An auth_oauth block as documented below. Allows connecting using an Oauth
token.

NOTE: Github Apps can not be created or updated via terraform. You must install and configure the app on Github
and then import it. You must also set the description to "" explicitly."

auth_personal block supports the following:

personal_access_token - (Required) The Personal Access Token for Github.

auth_oauth block supports the following:

oauth_configuration_id - (Required) NOTE: Github OAuth flow can not be performed via terraform. You
must create this on Azure DevOps and then import it. The OAuth Configuration ID.

Attributes Reference

The following attributes are exported:

id - The ID of the service endpoint.

project_id - The project ID or project name.

service_endpoint_name - The Service Endpoint name.

Relevant Links

Azure DevOps Service REST API 5.1 - Agent Pools (https://docs.microsoft.com/en-


us/rest/api/azure/devops/serviceendpoint/endpoints?view=azure-devops-rest-5.1)

Import

Azure DevOps Service Endpoint GitHub can be imported using the serviceendpoint id, e.g.

terraform import azuredevops_serviceendpoint_github.serviceendpoint d81afa1d-9ad2-4c7d-b016-9ebb90f43


5f5
(https://www.hashicorp.com)

azuredevops_serviceendpoint_kubernetes
Manages a Kubernetes service endpoint within Azure DevOps.

Example Usage
data "azuredevops_project" "p" {
project_name = "contoso"
}

resource "azuredevops_serviceendpoint_kubernetes" "se_azure_sub" {


project_id = data.azuredevops_project.p
service_endpoint_name = "Sample Kubernetes"
apiserver_url = "https://sample-kubernetes-cluster.hcp.westeurope.azmk8s.io"
authorization_type = "AzureSubscription"

azure_subscription {
subscription_id = "001ac454-bb17-475a-8648-82c4234545be"
subscription_name = "Microsoft Azure DEMO"
tenant_id = "8c46c3eb-ca1f-4a0b-8dfa-7c3baaf69d45"
resourcegroup_id = "sample-rg"
namespace = "default"
cluster_name = "sample-aks"
}
}

resource "azuredevops_serviceendpoint_kubernetes" "se_kubeconfig" {


project_id = data.azuredevops_project.p
service_endpoint_name = "Sample Kubernetes"
apiserver_url = "https://sample-kubernetes-cluster.hcp.westeurope.azmk8s.io"
authorization_type = "Kubeconfig"

kubeconfig {
kube_config = <<EOT
apiVersion: v1
clusters:
- cluster:
certificate-authority: fake-ca-file
server: https://1.2.3.4
name: development
contexts:
- context:
cluster: development
namespace: frontend
user: developer
name: dev-frontend
current-context: dev-frontend
kind: Config
preferences: {}
users:
- name: developer
user:
client-certificate: fake-cert-file
client-key: fake-key-file
EOT
accept_untrusted_certs = true
accept_untrusted_certs = true
cluster_context = "dev-frontend"
}
}

resource "azuredevops_serviceendpoint_kubernetes" "se_service_account" {


project_id = data.azuredevops_project.p
service_endpoint_name = "Sample Kubernetes"
apiserver_url = "https://sample-kubernetes-cluster.hcp.westeurope.azmk8s.io"
authorization_type = "ServiceAccount"

service_account {
token = "bXktYXBw[...]K8bPxc2uQ=="
ca_cert = "Mzk1MjgkdmRnN0pi[...]mHHRUH14gw4Q=="
}
}

Argument Reference
The following arguments are supported:

project_id - (Required) The project ID or project name.


service_endpoint_name - (Required) The Service Endpoint name.
apiserver_url - (Required) The Service Endpoint description.
authorization_type - (Required) The authentication method used to authenticate on the Kubernetes cluster. The
value should be one of AzureSubscription, Kubeconfig, ServiceAccount.
azure_subscription - (Optional) The configuration for authorization_type="AzureSubscription".
azure_environment - (Optional) Azure environment refers to whether the public cloud offering or domestic
(government) clouds are being used. Currently, only the public cloud is supported. The value must be AzureCloud.
This is also the default-value.
cluster_name - (Required) The name of the Kubernetes cluster.
subscription_id - (Required) The id of the Azure subscription.
subscription_name - (Required) The name of the Azure subscription.
tenant_id - (Required) The id of the tenant used by the subscription.
resourcegroup_id - (Required) The resource group id, to which the Kubernetes cluster is deployed.
namespace - (Optional) The Kubernetes namespace. Default value is "default".
kubeconfig - (Optional) The configuration for authorization_type="Kubeconfig".
kube_config - (Required) The content of the kubeconfig in yaml notation to be used to communicate with the
API-Server of Kubernetes.
accept_untrusted_certs - (Optional) Set this option to allow clients to accept a self-signed certificate.
cluster_context - (Optional) Context within the kubeconfig file that is to be used for identifying the cluster.
Default value is the current-context set in kubeconfig.
service_account - (Optional) The configuration for authorization_type="ServiceAccount". This type uses the
credentials of a service account currently deployed to the cluster.
token - (Required) The token from a Kubernetes secret object.
ca_cert - (Required) The certificate from a Kubernetes secret object.

Attributes Reference
The following attributes are exported:
id - The ID of the service endpoint.
project_id - The project ID or project name.
service_endpoint_name - The Service Endpoint name.

Relevant Links
Azure DevOps Service REST API 5.1 - Endpoints (https://docs.microsoft.com/en-
us/rest/api/azure/devops/serviceendpoint/endpoints?view=azure-devops-rest-5.1)
(https://www.hashicorp.com)

azuredevops_user_entitlement
Manages a user entitlement within Azure DevOps.

Example Usage

resource "azuredevops_user_entitlement" "user" {


principal_name = "[email protected]"
}

Argument Reference

principal_name - (Optional) The principal name is the PrincipalName of a graph member from the source
provider. Usually, e-mail address.

origin_id - (Optional) The unique identifier from the system of origin. Typically a sid, object id or Guid. e.g.
Used for member of other tenant on Azure Active Directory.

origin - (Optional) The type of source provider for the origin identifier.

account_license_type - (Optional) Type of Account License. Valid values: advanced , earlyAdopter ,


express , none , professional , or stakeholder . Defaults to express . In addition the value basic is allowed
which is an alias for express and reflects the name of the express license used in the Azure DevOps web
interface.

licensing_source - (Optional) The source of the licensing (e.g. Account. MSDN etc.) Valid values: account
(Default), auto , msdn , none , profile , trail

NOTE: A user can only be referenced by it's principal_name or by the combination of origin_id and
origin .

Attributes Reference

The following attributes are exported:

id - The id of the entitlement.

descriptor - The descriptor is the primary way to reference the graph subject while the system is running.
This field will uniquely identify the user graph subject.
Relevant Links

Azure DevOps Service REST API 5.1 - User Entitlements - Add (https://docs.microsoft.com/en-
us/rest/api/azure/devops/memberentitlementmanagement/user%20entitlements/add?view=azure-
devops-rest-5.1)

Import

The resources allows the import via the UUID of a user entitlement or by using the principal name of a user owning
an entitlement.

PAT Permissions Required

Member Entitlement Management: Read & Write


(https://www.hashicorp.com)

azuredevops_variable_group
Manages variable groups within Azure DevOps.

Example Usage

resource "azuredevops_project" "project" {


project_name = "Test Project"
}

resource "azuredevops_variable_group" "variablegroup" {


project_id = azuredevops_project.project.id
name = "Test Variable Group"
description = "Test Variable Group Description"
allow_access = true

variable {
name = "key"
value = "value"
}

variable {
name = "Account Password"
value = "p@ssword123"
is_secret = true
}
}

Argument Reference

The following arguments are supported:

project_id - (Required) The project ID or project name.

name - (Required) The name of the Variable Group.

description - (Optional) The description of the Variable Group.

allow_access - (Required) Boolean that indicate if this variable group is shared by all pipelines of this project.

variable - (Optional) One or more variable blocks as documented below.

A variable block supports the following:

name - (Required) The key value used for the variable. Must be unique within the Variable Group.

value - (Optional) The value of the variable. If omitted, it will default to empty string.
secret_value - (Optional) The secret value of the variable. If omitted, it will default to empty string. Used
when is_secret set to true .

is_secret - (Optional) A boolean flag describing if the variable value is sensitive. Defaults to false .

Attributes Reference

In addition to all arguments above, the following attributes are exported:

id - The ID of the Variable Group returned after creation in Azure DevOps.

Relevant Links

Azure DevOps Service REST API 5.1 - Variable Groups (https://docs.microsoft.com/en-


us/rest/api/azure/devops/distributedtask/variablegroups?view=azure-devops-rest-5.1)

Azure DevOps Service REST API 5.1 - Authorized Resources (https://docs.microsoft.com/en-


us/rest/api/azure/devops/build/authorizedresources?view=azure-devops-rest-5.1)

Import

Azure DevOps Variable groups can be imported using the project name/variable group Id or by the project
Guid/variable group Id, e.g.

terraform import azuredevops_variable_group.variablegroup "Test Project"/10


or
terraform import azuredevops_variable_group.variablegroup 782a8123-1019-xxxx-xxxx-xxxxxxxx/10

Note that for secret variables, the import command retrieve blank value in the tfstate.

PAT Permissions Required

Variable Groups: Read, Create, & Manage

You might also like