Azure Active Directory Domain Services Domain Service

azurerm_active_directory_domain_service (Terraform)

The Domain Service in Active Directory Domain Services can be configured in Terraform with the resource name azurerm_active_directory_domain_service. The following sections describe 7 examples of how to use the resource and its parameters.

Example Usage from GitHub

gilyas/infracost

resource "azurerm_active_directory_domain_service" "standard" {
  name                = "example-aadds_1"
  location            = "australiaeast"
  resource_group_name = "aadds-rg"

  domain_name           = "widgetslogin.net"

infracost/infracost

resource "azurerm_active_directory_domain_service" "standard" {
  name                = "example-aadds_1"
  location            = "australiaeast"
  resource_group_name = "aadds-rg"

  domain_name           = "widgetslogin.net"

chad-neal/avdtf-with-modules

resource "azurerm_active_directory_domain_service" "avd-domain" {
  name                = var.avd_domain_name
  location            = module.rg.rg_location
  resource_group_name = module.rg.rg_name

  domain_name           = var.avd_domain_name

gilyas/infracost

resource "azurerm_active_directory_domain_service" "example" {
  name                = "example-aadds_3"
  location            = "australiaeast"
  resource_group_name = "aadds-rg"

  domain_name           = "widgetslogin.net"

infracost/infracost

resource "azurerm_active_directory_domain_service" "example" {
  name                = "example-aadds_3"
  location            = "australiaeast"
  resource_group_name = "aadds-rg"

  domain_name           = "widgetslogin.net"

timwebster9/azure-avd

resource "azurerm_active_directory_domain_service" "aadds" {
  name                = var.name
  location            = azurerm_resource_group.aadds_rg.location
  resource_group_name = azurerm_resource_group.aadds_rg.name

  domain_name           = var.domain_name

timwebster9/azure-avd

resource "azurerm_active_directory_domain_service" "adds" {
  name                = "avd-adds"
  location            = azurerm_resource_group.adds.location
  resource_group_name = azurerm_resource_group.adds.name

  domain_name           = var.adds_domain

Parameters

The following arguments are supported:

• domain_name - (Required) The Active Directory domain to use. See official documentation for constraints and recommendations.

• filtered_sync_enabled - Whether to enable group-based filtered sync (also called scoped synchronisation). Defaults to false.

• secure_ldap - (Optional) A secure_ldap block as defined below.

• location - (Required) The Azure location where the Domain Service exists. Changing this forces a new resource to be created.

• name - (Required) The display name for your managed Active Directory Domain Service resource. Changing this forces a new resource to be created.

• notifications - (Optional) A notifications block as defined below.

• initial_replica_set - (Required) An initial_replica_set block as defined below. The initial replica set inherits the same location as the Domain Service resource.

• resource_group_name - (Required) The name of the Resource Group in which the Domain Service should exist. Changing this forces a new resource to be created.

• security - (Optional) A security block as defined below.

• sku - (Required) The SKU to use when provisioning the Domain Service resource. One of Standard, Enterprise or Premium.

• tags - (Optional) A mapping of tags assigned to the resource.

A secure_ldap block supports the following:

• enabled - (Required) Whether to enable secure LDAP for the managed domain. Defaults to false.

• external_access_enabled - (Optional) Whether to enable external access to LDAPS over the Internet. Defaults to false.

• pfx_certificate - (Required) The certificate/private key to use for LDAPS, as a base64-encoded TripleDES-SHA1 encrypted PKCS#12 bundle (PFX file).

• pfx_certificate_password - (Required) The password to use for decrypting the PKCS#12 bundle (PFX file).

A notifications block supports the following:

• additional_recipients - (Optional) A list of additional email addresses to notify when there are alerts in the managed domain.

• notify_dc_admins - (Optional) Whether to notify members of the AAD DC Administrators group when there are alerts in the managed domain.

• notify_global_admins - (Optional) Whether to notify all Global Administrators when there are alerts in the managed domain.

An initial_replica_set block supports the following:

• subnet_id - (Required) The ID of the subnet in which to place the initial replica set.

A security block supports the following:

• ntlm_v1_enabled - (Optional) Whether to enable legacy NTLM v1 support. Defaults to false.

• sync_kerberos_passwords - (Optional) Whether to synchronize Kerberos password hashes to the managed domain. Defaults to false.

• sync_ntlm_passwords - (Optional) Whether to synchronize NTLM password hashes to the managed domain. Defaults to false.

• sync_on_prem_passwords - (Optional) Whether to synchronize on-premises password hashes to the managed domain. Defaults to false.

• tls_v1_enabled - (Optional) Whether to enable legacy TLS v1 support. Defaults to false.

In addition to all arguments above, the following attributes are exported:

• id - The ID of the Domain Service.

• deployment_id - A unique ID for the managed domain deployment.

• resource_id - The Azure resource ID for the domain service.

A secure_ldap block exports the following:

• external_access_ip_address - The publicly routable IP address for LDAPS clients to connect to.

An initial_replica_set block exports the following:

• domain_controller_ip_addresses - A list of subnet IP addresses for the domain controllers in the initial replica set, typically two.

• external_access_ip_address - The publicly routable IP address for the domain controllers in the initial replica set.

• location - The Azure location in which the initialreplica set resides.

• replica_set_id - A unique ID for the replica set.

• service_status - The current service status for the initial replica set.

Explanation in Terraform Registry

Manages an Active Directory Domain Service.

Implementation Note: Before using this resource, there must exist in your tenant a service principal for the Domain Services published application. This service principal cannot be easily managed by Terraform and it's recommended to create this manually, as it does not exist by default. See official documentation for details. -> Supported Modes: At present this resource only supports User Forest mode and not Resource Forest mode. Read more about the different operation modes for this service.