Skip to content
This repository was archived by the owner on May 27, 2025. It is now read-only.

Commit 4f8ff8e

Browse files
jgbradley1jgbradley1
committed
reorganize rbac assignments to be cleaner
1 parent 4f2734d commit 4f8ff8e

File tree

5 files changed

+86
-95
lines changed

5 files changed

+86
-95
lines changed

‎infra/core/ai-search/ai-search.bicep‎

Lines changed: 1 addition & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -7,10 +7,7 @@ param name string
77
@description('The location of the Managed Cluster resource.')
88
param location string = resourceGroup().location
99

10-
@description('Array of objects with fields principalId, principalType, roleDefinitionId')
11-
param roleAssignments array = []
12-
13-
@allowed([ 'enabled', 'disabled' ])
10+
@allowed(['enabled', 'disabled'])
1411
param publicNetworkAccess string = 'enabled'
1512

1613
resource aiSearch 'Microsoft.Search/searchServices@2024-03-01-preview' = {
@@ -28,13 +25,5 @@ resource aiSearch 'Microsoft.Search/searchServices@2024-03-01-preview' = {
2825
}
2926
}
3027

31-
resource roleAssignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = [
32-
for role in roleAssignments: {
33-
name: guid('${role.principalId}-${role.principalType}-${role.roleDefinitionId}')
34-
scope: resourceGroup()
35-
properties: role
36-
}
37-
]
38-
3928
output name string = aiSearch.name
4029
output id string = aiSearch.id

‎infra/core/monitor/app-insights.bicep‎

Lines changed: 0 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -13,9 +13,6 @@ param appInsightsPublicNetworkAccessForIngestion string = 'Disabled'
1313
@description('Workspace id of a Log Analytics resource.')
1414
param logAnalyticsWorkspaceId string
1515

16-
@description('Array of objects with fields principalId, principalType, roleDefinitionId')
17-
param roleAssignments array = []
18-
1916
resource appInsights 'Microsoft.Insights/components@2020-02-02' = {
2017
name: appInsightsName
2118
location: location
@@ -28,20 +25,6 @@ resource appInsights 'Microsoft.Insights/components@2020-02-02' = {
2825
}
2926
}
3027

31-
resource roleAssignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = [
32-
for role in roleAssignments: {
33-
name: guid(
34-
subscription().subscriptionId,
35-
resourceGroup().name,
36-
role.principalId,
37-
role.principalType,
38-
role.roleDefinitionId
39-
)
40-
scope: resourceGroup()
41-
properties: role
42-
}
43-
]
44-
4528
output id string = appInsights.id
4629
output connectionString string = appInsights.properties.ConnectionString
4730
output instrumentationKey string = appInsights.properties.InstrumentationKey

‎infra/core/storage/storage.bicep‎

Lines changed: 3 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -7,18 +7,15 @@ param name string
77
@description('The location of the Storage Account resource.')
88
param location string = resourceGroup().location
99

10-
@allowed([ 'Hot', 'Cool', 'Premium' ])
10+
@allowed(['Hot', 'Cool', 'Premium'])
1111
param accessTier string = 'Hot'
1212

13-
@allowed([ 'AzureDnsZone', 'Standard' ])
13+
@allowed(['AzureDnsZone', 'Standard'])
1414
param dnsEndpointType string = 'Standard'
1515

16-
@allowed([ 'Enabled', 'Disabled' ])
16+
@allowed(['Enabled', 'Disabled'])
1717
param publicNetworkAccess string = 'Disabled'
1818

19-
@description('Array of objects with fields principalId, principalType, roleDefinitionId')
20-
param roleAssignments array = []
21-
2219
param tags object = {}
2320
param allowBlobPublicAccess bool = false
2421
param allowCrossTenantReplication bool = true
@@ -29,7 +26,6 @@ param kind string = 'StorageV2'
2926
param minimumTlsVersion string = 'TLS1_2'
3027
param containers array = []
3128

32-
3329
resource storage 'Microsoft.Storage/storageAccounts@2023-01-01' = {
3430
name: name
3531
location: location
@@ -68,14 +64,6 @@ resource storage 'Microsoft.Storage/storageAccounts@2023-01-01' = {
6864
}
6965
}
7066

71-
resource storageRoleAssignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = [
72-
for role in roleAssignments: {
73-
name: guid('${role.principalId}-${role.principalType}-${role.roleDefinitionId}')
74-
scope: resourceGroup()
75-
properties: role
76-
}
77-
]
78-
7967
output name string = storage.name
8068
output id string = storage.id
8169
output primaryEndpoints object = storage.properties.primaryEndpoints

‎infra/core/workload-rbac.bicep‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
// Copyright (c) Microsoft Corporation.
2+
// Licensed under the MIT License.
3+
4+
@description('ID of the service principal to assign the RBAC roles to.')
5+
param principalId string
6+
7+
@description('Type of principal to assign the RBAC roles to.')
8+
@allowed(['ServicePrincipal', 'User', 'Group', 'Device', 'ForeignGroup'])
9+
param principalType string
10+
11+
@description('Role definitions for various roles that will be assigned at deployment time. Learn more: https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles')
12+
var roleDefinitions = [
13+
{
14+
id: 'ba92f5b4-2d11-453d-a403-e96b0029c9fe' // Storage Blob Data Contributor Role
15+
}
16+
{
17+
id: 'b24988ac-6180-42a0-ab88-20f7382dd24c' // AI Search Contributor Role
18+
}
19+
{
20+
id: '8ebe5a00-799e-43f5-93ac-243d3dce84a7' // AI Search Index Data Contributor Role
21+
}
22+
{
23+
id: '1407120a-92aa-4202-b7e9-c0e197c71c8f' // AI Search Index Data Reader Role
24+
}
25+
{
26+
id: 'a001fd3d-188f-4b5d-821b-7da978bf7442' // Cognitive Services OpenAI Contributor
27+
}
28+
{
29+
id: '3913510d-42f4-4e42-8a64-420c390055eb' // Monitoring Metrics Publisher Role
30+
}
31+
]
32+
33+
resource roleAssignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = [
34+
for roleDef in roleDefinitions: {
35+
name: guid(subscription().subscriptionId, resourceGroup().name, principalId, principalType, roleDef.id)
36+
scope: resourceGroup()
37+
properties: {
38+
principalId: principalId
39+
principalType: principalType
40+
roleDefinitionId: resourceId('Microsoft.Authorization/roleDefinitions', roleDef.id)
41+
}
42+
}
43+
]

‎infra/main.bicep‎

Lines changed: 39 additions & 51 deletions
Original file line numberDiff line numberDiff line change
@@ -72,22 +72,6 @@ var appUrl = 'http://${appHostname}'
7272

7373
@description('Role definitions for various roles that will be assigned at deployment time. Learn more: https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles')
7474
var roles = {
75-
storageBlobDataContributor: resourceId(
76-
'Microsoft.Authorization/roleDefinitions',
77-
'ba92f5b4-2d11-453d-a403-e96b0029c9fe'
78-
)
79-
aiSearchContributor: resourceId(
80-
'Microsoft.Authorization/roleDefinitions',
81-
'b24988ac-6180-42a0-ab88-20f7382dd24c' // AI Search Contributor Role
82-
)
83-
aiSearchIndexDataContributor: resourceId(
84-
'Microsoft.Authorization/roleDefinitions',
85-
'8ebe5a00-799e-43f5-93ac-243d3dce84a7' // AI Search Index Data Contributor Role
86-
)
87-
aiSearchIndexDataReader: resourceId(
88-
'Microsoft.Authorization/roleDefinitions',
89-
'1407120a-92aa-4202-b7e9-c0e197c71c8f' // AI Search Index Data Reader Role
90-
)
9175
privateDnsZoneContributor: resourceId(
9276
'Microsoft.Authorization/roleDefinitions',
9377
'b12aa53e-6015-4669-85d0-8515ebb3ae7f' // Private DNS Zone Contributor Role
@@ -96,10 +80,6 @@ var roles = {
9680
'Microsoft.Authorization/roleDefinitions',
9781
'4d97b98b-1d4f-4787-a291-c67834d212e7' // Network Contributor Role
9882
)
99-
cognitiveServicesOpenaiContributor: resourceId(
100-
'Microsoft.Authorization/roleDefinitions',
101-
'a001fd3d-188f-4b5d-821b-7da978bf7442' // Cognitive Services OpenAI Contributor
102-
)
10383
acrPull: resourceId(
10484
'Microsoft.Authorization/roleDefinitions',
10585
'7f951dda-4ed3-4680-a7ca-43fe172d538d' // ACR Pull Role
@@ -110,6 +90,14 @@ var roles = {
11090
)
11191
}
11292

93+
module workloadIdentityRBACAssignments 'core/workload-rbac.bicep' = {
94+
name: 'workload-rbac-assignments'
95+
params: {
96+
principalId: workloadIdentity.outputs.principalId
97+
principalType: 'ServicePrincipal'
98+
}
99+
}
100+
113101
module log 'core/log-analytics/log.bicep' = {
114102
name: 'log-analytics-deployment'
115103
params: {
@@ -234,23 +222,23 @@ module aiSearch 'core/ai-search/ai-search.bicep' = {
234222
name: !empty(aiSearchName) ? aiSearchName : '${abbrs.searchSearchServices}${resourceBaseNameFinal}'
235223
location: location
236224
publicNetworkAccess: enablePrivateEndpoints ? 'disabled' : 'enabled'
237-
roleAssignments: [
238-
{
239-
principalId: workloadIdentity.outputs.principalId
240-
principalType: 'ServicePrincipal'
241-
roleDefinitionId: roles.aiSearchContributor
242-
}
243-
{
244-
principalId: workloadIdentity.outputs.principalId
245-
principalType: 'ServicePrincipal'
246-
roleDefinitionId: roles.aiSearchIndexDataContributor
247-
}
248-
{
249-
principalId: workloadIdentity.outputs.principalId
250-
principalType: 'ServicePrincipal'
251-
roleDefinitionId: roles.aiSearchIndexDataReader
252-
}
253-
]
225+
// roleAssignments: [
226+
// {
227+
// principalId: workloadIdentity.outputs.principalId
228+
// principalType: 'ServicePrincipal'
229+
// roleDefinitionId: roles.aiSearchContributor
230+
// }
231+
// {
232+
// principalId: workloadIdentity.outputs.principalId
233+
// principalType: 'ServicePrincipal'
234+
// roleDefinitionId: roles.aiSearchIndexDataContributor
235+
// }
236+
// {
237+
// principalId: workloadIdentity.outputs.principalId
238+
// principalType: 'ServicePrincipal'
239+
// roleDefinitionId: roles.aiSearchIndexDataReader
240+
// }
241+
// ]
254242
}
255243
}
256244

@@ -263,13 +251,13 @@ module storage 'core/storage/storage.bicep' = {
263251
location: location
264252
publicNetworkAccess: enablePrivateEndpoints ? 'Disabled' : 'Enabled'
265253
tags: tags
266-
roleAssignments: [
267-
{
268-
principalId: workloadIdentity.outputs.principalId
269-
principalType: 'ServicePrincipal'
270-
roleDefinitionId: roles.storageBlobDataContributor
271-
}
272-
]
254+
// roleAssignments: [
255+
// {
256+
// principalId: workloadIdentity.outputs.principalId
257+
// principalType: 'ServicePrincipal'
258+
// roleDefinitionId: roles.storageBlobDataContributor
259+
// }
260+
// ]
273261
deleteRetentionPolicy: {
274262
enabled: true
275263
days: 5
@@ -285,13 +273,13 @@ module appInsights 'core/monitor/app-insights.bicep' = {
285273
location: location
286274
appInsightsPublicNetworkAccessForIngestion: enablePrivateEndpoints ? 'Disabled' : 'Enabled'
287275
logAnalyticsWorkspaceId: log.outputs.id
288-
roleAssignments: [
289-
{
290-
principalId: workloadIdentity.outputs.principalId
291-
principalType: 'ServicePrincipal'
292-
roleDefinitionId: roles.monitoringMetricsPublisher
293-
}
294-
]
276+
// roleAssignments: [
277+
// {
278+
// principalId: workloadIdentity.outputs.principalId
279+
// principalType: 'ServicePrincipal'
280+
// roleDefinitionId: roles.monitoringMetricsPublisher
281+
// }
282+
// ]
295283
}
296284
}
297285

0 commit comments

Comments
 (0)