Skip to main content

Azure Setup With Terraform Module

Use the Terraform path when your organization manages cloud onboarding through infrastructure as code.

Before applying the module, confirm the Terraform identity has the required Entra, Azure RBAC, billing export, and storage permissions. If those permissions are activated through PIM or just-in-time access, see Operator Permissions And PIM.

Module​

The Spotto Terraform Module is published here:

terraform-azurerm-spotto

The onboarding module can create the Azure app registration and service principal, assign the required Azure roles including Security Reader for Defender for Cloud posture, grant the complete Microsoft Graph governance permission set, and optionally configure billing exports. The Graph set includes Policy.Read.All and LicenseAssignment.Read.All for tenant policy and subscribed-license posture.

By default, new module deployments create the Entra application with the display name Spotto.

Minimal Example​

module "spotto_onboarding" {
  source = "github.com/spottoai/terraform-azurerm-spotto//modules/onboarding"

  subscription_ids = ["00000000-0000-0000-0000-000000000000"]
}

Enable Billing Exports​

Billing exports are opt-in in Terraform. Enable them when you want Terraform to create or manage the export storage, container, role assignment, recurring exports, and backfill export definitions.

module "spotto_onboarding" {
  source = "github.com/spottoai/terraform-azurerm-spotto//modules/onboarding"

  subscription_ids = ["00000000-0000-0000-0000-000000000000"]

  enable_billing_exports = true
}

When enable_billing_exports = true, the module can:

  • Create or use a customer-owned storage account.
  • Create a private export container, defaulting to spotto-cost-exports.
  • Grant the Spotto service principal Storage Blob Data Reader on the container.
  • Create daily actual and amortized Cost Management exports where supported.
  • Create one-time backfill export definitions for previous closed months.

Backfill run queueing is an explicit operational choice in Terraform because Terraform cannot reliably observe whether Azure completed previous imperative export runs.

Enable Azure Policy Exemptions​

This permission is independently opt-in:

grant_policy_exemption_permissions = true

# Only for initiatives inherited from these exact management groups.
policy_assignment_exempt_scopes = [
  "/providers/Microsoft.Management/managementGroups/production"
]

The subscription role receives the two exemption actions. The separate management-group role contains only Microsoft.Authorization/policyAssignments/exempt/action. See Azure Policy exemption permissions.

Required Operator Permissions​

The Terraform operator needs enough Azure and Entra permission to:

  • Create or update the Entra ID application and service principal.
  • Assign Azure RBAC roles at the selected subscription, management group, and provider scopes, including Reservations Reader and Reservations Contributor at /providers/Microsoft.Capacity.
  • Grant Microsoft Graph governance permissions with admin consent if enabled.
  • Register required resource providers where your organization allows Terraform to do so.
  • Create or update billing export storage and Cost Management exports when billing exports are enabled.
  • Assign Storage Blob Data Reader at the export container scope.

Outputs To Enter In Spotto​

After terraform apply, use the module outputs to add or update the Azure account in Spotto:

  • Application client ID
  • Tenant ID
  • Client secret
  • Client secret expiry
caution

Terraform state can contain the client secret and billing export resource IDs. Store state in a secure remote backend and treat it as sensitive.