Azure Active Directory RBAC enable/disable with var rbac_aad_azure_rb…

…ac_enabled
Azure · Nov 14, 2022 · 20193a1 · 20193a1
1 parent 8b90d95
commit 20193a1
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 5 deletions.
diff --git a/locals.tf b/locals.tf
@@ -18,4 +18,6 @@ locals {
       name = var.log_analytics_workspace.name
     }
   ) : null # Finally, the Log Analytics Workspace should be disabled.
-}
+  # If var.rbac_aad_azure_rbac_enabled  is null set the local to false. Otherise set the local to the var true/false value
+  rbac_aad_azure_rbac_enabled = var.rbac_aad_azure_rbac_enabled == null ? false : var.rbac_aad_azure_rbac_enabled
+}
diff --git a/main.tf b/main.tf
@@ -95,17 +95,17 @@ resource "azurerm_kubernetes_cluster" "main" {
     }
   }
   dynamic "azure_active_directory_role_based_access_control" {
-    for_each = var.role_based_access_control_enabled && var.rbac_aad_managed ? ["rbac"] : []
+    for_each = var.role_based_access_control_enabled && local.rbac_aad_azure_rbac_enabled && var.rbac_aad_managed ? ["rbac"] : []
 
     content {
       admin_group_object_ids = var.rbac_aad_admin_group_object_ids
-      azure_rbac_enabled     = var.rbac_aad_azure_rbac_enabled
+      azure_rbac_enabled     = local.rbac_aad_azure_rbac_enabled
       managed                = true
       tenant_id              = var.rbac_aad_tenant_id
     }
   }
   dynamic "azure_active_directory_role_based_access_control" {
-    for_each = var.role_based_access_control_enabled && !var.rbac_aad_managed ? ["rbac"] : []
+    for_each = var.role_based_access_control_enabled && local.rbac_aad_azure_rbac_enabled && !var.rbac_aad_managed ? ["rbac"] : []
 
     content {
       client_app_id     = var.rbac_aad_client_app_id
@@ -253,4 +253,4 @@ resource "azurerm_log_analytics_solution" "main" {
     product   = "OMSGallery/ContainerInsights"
     publisher = "Microsoft"
   }
-}
+}