Share gallery VM images across Azure tenants using an app registration in Terraform

Doran Kerkhofs 0

Hello all,

I was playing around with the Azure Compute Gallery.
I noticed there is a possibility to use the Azure Compute Gallery in other tenants by using a Shared App Registration.

The whole process is described on the following article: https://learn.microsoft.com/en-us/azure/virtual-machines/share-using-app-registration?tabs=cli
the article is very straightforward and easy to get to work.

My question here is if anyone also has experience to make this solution work in Terraform?
I've been trying multiple times but cannot get it to work, and cannot find any similar questions/cases.

Problem i'm facing is that for powershell/CLI it's fairly easy to connect to multiple tenants/contexts, but I'm having a hard time working out this same behaviour in terraform.

Any tips are welcome.

thanks!

anashetty 500 Reputation points Microsoft Vendor

2024-08-22T07:19:43.96+00:00

Hi Doran Kerkhofs,

Welcome to the Microsoft Q&A Platform! Thank you for asking your question here.

Yes, using Terraform to share an Azure Compute Gallery across tenants with a Shared App Registration can be challenging. The primary difficulty is that Terraform doesn't inherently support switching between Azure tenants or contexts as easily as PowerShell or the Azure CLI.

If you have any further queries, do let us know.
anashetty 500 Reputation points Microsoft Vendor

2024-08-23T07:45:03.8933333+00:00

Hi Doran Kerkhofs,

We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution, please do share that same with the community as it can be helpful to others.

If you have any further queries, do let us know.
anashetty 500 Reputation points Microsoft Vendor

2024-08-26T08:00:31+00:00

Hi Doran Kerkhofs,

We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution, please do share that same with the community as it can be helpful to others.

If you have any further queries, do let us know.
Doran Kerkhofs 0 Reputation points

2024-08-26T12:45:23.44+00:00

Hello,

I'm trying to work with different providers in Terraform but so far didn't get it to work.
not giving up yet, so still trying to get it to work.
I'll provide an update later this week with the outcome.

in parrallel i've enrolled for the preview for Compute gallery Sharing, this could maybe also be a good solution for us.

Doran Kerkhofs 0

Hello!

I've been doing some more testing, but didn't got to a solution yet.
I've been playing around by configuring multiple providers in Terraform:

provider "azurerm" {
  features {}
  skip_provider_registration = true
  alias           = "sp-scg-tenant1"
  subscription_id = "xxx"
  client_id       = "xxx"
  client_secret   = "xxx"
  tenant_id       = "xxx"
}

provider "azurerm" {
  features {}
  skip_provider_registration = true
  alias           = "sp-scg-tenant2"
  subscription_id = "xxx"
  client_id       = "xxx"
  client_secret   = "xxx"
  tenant_id       = "xxx"
}

where both of the provider registrations are using the same service principal.
The first is the original sp, in my root tenant (where the Compute gallery is located).

The second one is the tenant where the service principal was invited.

When trying to create the resource I can only reference one provider configuration.
So i've been using the following code for the deployment:

resource "azurerm_virtual_machine" "testingvm" {
  provider            = azurerm.sp-scg-tenant2
  name                = "testingvm"
  resource_group_name = azurerm_resource_group.testingvm.name
  location            = "westeurope"

  vm_size               = "Standard_D2s_v4"
  network_interface_ids = [azurerm_network_interface.testingvm.id]
  os_profile {
    computer_name  = "testingvm"
    admin_username = "adminuser"
    admin_password = "xxx"
  }

  os_profile_windows_config {
    provision_vm_agent = true
  }

  storage_image_reference {
    id = "/subscriptions/xxx/resourceGroups/rg-dor-weu-p-images/providers/Microsoft.Compute/galleries/scgdorweupimages/images/windows-image-definition/versions/0.0.1"
  }

  storage_os_disk {
    name              = "testingvm-os"
    caching           = "ReadWrite"
    create_option     = "FromImage"
    managed_disk_type = "Standard_LRS"
  }
}

the problem i'm facing is that the "storage_image_reference" should be gathered from my other provider configuration: "sp-scg-tenant1". But i cannot seem to find a way to get this to work. Using multiple providers withing one resource doesn't seem to be possible..

i'm receiving the following error message when i try the deployment:

Error: compute.VirtualMachinesClient#CreateOrUpdate: Failure sending request: StatusCode=403 -- Original Error: Code="LinkedAuthorizationFailed" Message="The client has permission to perform action 'Microsoft.Compute/galleries/images/versions/read' on scope '/subscriptions/xxx/resourceGroups/rg-testing/providers/Microsoft.Compute/virtualMachines/testingvm', however the current tenant 'xxx' is not authorized to access linked subscription 'xxx'."

this does however make perfect sense, as my provider configuration is using a service principal connected to tenant two, and trying to gather information from a tenant where it isn't connected to.

Bit stuck on this one, so any help or tips are welcome!

anashetty 500 Reputation points Microsoft Vendor

2024-08-28T05:16:33+00:00

Hi Doran Kerkhofs,

Thanks for getting back with the detailed explanation, we are looking into it and will get back to you soon.
anashetty 500 Reputation points Microsoft Vendor

2024-08-28T07:30:53+00:00

Hi Doran Kerkhofs,

Thanks for getting back with the detailed explanation. This issue needs deeper investigation and Azure technical support team will be able to help with this. I would recommend you open an azure support case. If you don't have the ability to open a technical support ticket, please let me know and I can help you further with this.
anashetty 500 Reputation points Microsoft Vendor

2024-08-29T10:05:02.55+00:00

Hi Doran Kerkhofs,

Thanks for getting back with the detailed explanation. This issue needs deeper investigation and Azure technical support team will be able to help with this. I would recommend you open an azure support case. If you don't have the ability to open a technical support ticket, please let me know and I can help you further with this.

Share via

Share gallery VM images across Azure tenants using an app registration in Terraform

Your answer