Skip to main content

Azure Setup With Terraform Module

Use the Terraform path when your organization manages cloud onboarding through infrastructure as code.

Before applying the module, confirm the Terraform identity has the required Entra, Azure RBAC, billing export, and storage permissions. If those permissions are activated through PIM or just-in-time access, see Operator Permissions And PIM.

Module​

The Spotto Terraform Module is published here:

terraform-azurerm-spotto

The onboarding module can create the Azure app registration and service principal, assign the required Azure roles including Security Reader for Defender for Cloud posture, grant the complete Microsoft Graph read permission set, and optionally configure billing exports. The eleven Graph defaults include LicenseAssignment.Read.All, Organization.Read.All, User.Read.All, Reports.Read.All and AuditLog.Read.All for license capacity/assignments, subscription renewal dates, enabled/disabled user metadata, Office/Copilot reports and successful-sign-in recency, alongside existing governance reads such as Policy.Read.All.

Graph application permissions are tenant-wide and require authorized admin consent. They do not grant mailbox or document contents or license changes. enable_graph_permission defaults to true; set it to false for the existing Graph opt-out. Existing installations require a module version containing these defaults and an authorized apply to add missing grants. Review the plan before applying.

By default, new module deployments create the Entra application with the display name Spotto.

Minimal Example​

module "spotto_onboarding" {
  source = "github.com/spottoai/terraform-azurerm-spotto//modules/onboarding"

  subscription_ids = ["00000000-0000-0000-0000-000000000000"]
}

Enable Billing Exports​

Billing exports are opt-in in Terraform. Enable them when you want Terraform to create or manage the export storage, container, role assignment, recurring exports, and backfill export definitions.

module "spotto_onboarding" {
  source = "github.com/spottoai/terraform-azurerm-spotto//modules/onboarding"

  subscription_ids = ["00000000-0000-0000-0000-000000000000"]

  enable_billing_exports = true
}

When enable_billing_exports = true, the module can:

  • Create or use a customer-owned storage account.
  • Create a private export container, defaulting to spotto-cost-exports.
  • Grant the Spotto service principal Storage Blob Data Reader on the container.
  • Create daily actual and amortized Cost Management exports where supported.
  • Create one-time backfill export definitions for previous closed months.

Backfill run queueing is an explicit operational choice in Terraform because Terraform cannot reliably observe whether Azure completed previous imperative export runs.

Enable Azure Policy Exemptions​

This permission is independently opt-in:

grant_policy_exemption_permissions = true

# Only for initiatives inherited from these exact management groups.
policy_assignment_exempt_scopes = [
  "/providers/Microsoft.Management/managementGroups/production"
]

The subscription role receives the two exemption actions. The separate management-group role contains only Microsoft.Authorization/policyAssignments/exempt/action. See Azure Policy exemption permissions.

Required Operator Permissions​

The Terraform operator needs enough Azure and Entra permission to:

  • Create or update the Entra ID application and service principal.
  • Assign Azure RBAC roles at the selected subscription, management group, and provider scopes, including Reservations Reader and Reservations Contributor at /providers/Microsoft.Capacity.
  • Grant Microsoft Graph application permissions with tenant admin consent if enabled, using Privileged Role Administrator, Global Administrator or equivalent consent authority. App-management permission alone is insufficient; see Operator Permissions.
  • Register required resource providers where your organization allows Terraform to do so.
  • Create or update billing export storage and Cost Management exports when billing exports are enabled.
  • Assign Storage Blob Data Reader at the export container scope.

Outputs To Enter In Spotto​

After terraform apply, use the module outputs to add or update the Azure account in Spotto:

  • Application client ID
  • Tenant ID
  • Client secret
  • Client secret expiry
caution

Terraform state can contain the client secret and billing export resource IDs. Store state in a secure remote backend and treat it as sensitive.