Exercise 6 ยท 45 minutes

Design inputs and useful outputs

Replace embedded environment values with a clear configuration interface, query the assigned resource group, and expose identifiers that another module could consume.

ModuleVariables and outputsAzure costNoneChangesExisting identity

Before you start

Goal and prerequisites

Your goal

Create a typed, validated interface for the sandbox and return the managed identity's resource ID, client ID, and principal ID as outputs.

You need

  • The managed identity from Exercise 4
  • Exercise 5 completed
  • Your assigned naming and tagging rules
  • The approved resource-group name
  • A clean Git working tree

Participant task

Make the configuration reusable

  1. 01

    Inventory embedded values

    List values that vary by participant or environment. Separate genuine inputs from values Terraform can derive.

  2. 02

    Declare a typed interface

    Add variables for the subscription ID, resource-group name, naming prefix, environment, and required tags. Add descriptions, types, and validation for constrained values. Do not place environment values in defaults.

  3. 03

    Query existing context

    Use an azurerm_resource_group data source to obtain the resource group's location. Use locals to assemble the identity name and merged tags without repeating expressions.

  4. 04

    Add useful outputs

    Expose the managed identity's resource ID, client ID, and principal ID. Decide whether each output is sensitive and be prepared to justify the decision.

  5. 05

    Prove behavior

    Test one invalid environment value, then restore the approved value. Format, validate, save a plan, and confirm that parameterization does not unexpectedly replace the identity.

    terraform fmt
    terraform validate
    terraform plan -out main.tfplan
    terraform apply main.tfplan
    terraform output

Expected outcome

Check the contract

Validation

  • An invalid environment fails before Azure is changed.
  • No subscription-specific value is hard-coded in configuration.
  • The data source supplies the location.
  • All three outputs resolve after apply.

Optional extension

Replace separate tagging variables with a typed object and validation that requires the standard tag keys.

Finish

Retain the managed resource

Commit the interface changes. Keep the identity and current state for the backend migration in Exercise 8.