Skip to content

Commit 1800994

Browse files
Pavan-MicrosoftPavan-Microsoft
committed
use proper naming for managedIdentityResourceId
1 parent 5f74394 commit 1800994

File tree

4 files changed

+26
-18
lines changed

4 files changed

+26
-18
lines changed

‎infra/deploy_index_scripts.bicep‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ param solutionLocation string
33

44
param baseUrl string
55
param keyVaultName string
6-
param managedIdentityObjectId string
6+
param managedIdentityResourceId string
77
param managedIdentityClientId string
88

99
resource create_index 'Microsoft.Resources/deploymentScripts@2023-08-01' = {
@@ -13,7 +13,7 @@ resource create_index 'Microsoft.Resources/deploymentScripts@2023-08-01' = {
1313
identity: {
1414
type: 'UserAssigned'
1515
userAssignedIdentities: {
16-
'${managedIdentityObjectId}' : {}
16+
'${managedIdentityResourceId}' : {}
1717
}
1818
}
1919
properties: {

‎infra/deploy_upload_files_script.bicep‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,8 @@
11
@description('Specifies the location for resources.')
22
param solutionLocation string
33
param baseUrl string
4-
param managedIdentityObjectId string
4+
param managedIdentityResourceId string
5+
param managedIdentityClientId string
56
param storageAccountName string
67
param containerName string
78

@@ -12,13 +13,13 @@ resource copy_demo_Data 'Microsoft.Resources/deploymentScripts@2023-08-01' = {
1213
identity:{
1314
type:'UserAssigned'
1415
userAssignedIdentities: {
15-
'${managedIdentityObjectId}' : {}
16+
'${managedIdentityResourceId}' : {}
1617
}
1718
}
1819
properties: {
1920
azCliVersion: '2.52.0'
2021
primaryScriptUri: '${baseUrl}infra/scripts/copy_kb_files.sh'
21-
arguments: '${storageAccountName} ${containerName} ${baseUrl} ${managedIdentityObjectId}'
22+
arguments: '${storageAccountName} ${containerName} ${baseUrl} ${managedIdentityClientId}'
2223
timeout: 'PT1H'
2324
retentionInterval: 'PT1H'
2425
cleanupPreference:'OnSuccess'

‎infra/main.bicep‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -202,7 +202,8 @@ module uploadFiles 'deploy_upload_files_script.bicep' = {
202202
baseUrl: baseUrl
203203
storageAccountName: storageAccount.outputs.storageName
204204
containerName: storageAccount.outputs.storageContainer
205-
managedIdentityObjectId:managedIdentityModule.outputs.managedIdentityOutput.id
205+
managedIdentityResourceId:managedIdentityModule.outputs.managedIdentityOutput.id
206+
managedIdentityClientId:managedIdentityModule.outputs.managedIdentityOutput.clientId
206207
}
207208
}
208209

@@ -211,7 +212,7 @@ module createIndex 'deploy_index_scripts.bicep' = {
211212
name : 'deploy_index_scripts'
212213
params:{
213214
solutionLocation: secondaryLocation
214-
managedIdentityObjectId:managedIdentityModule.outputs.managedIdentityOutput.id
215+
managedIdentityResourceId:managedIdentityModule.outputs.managedIdentityOutput.id
215216
managedIdentityClientId:managedIdentityModule.outputs.managedIdentityOutput.clientId
216217
baseUrl:baseUrl
217218
keyVaultName:aifoundry.outputs.keyvaultName

‎infra/main.json‎

Lines changed: 17 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@
55
"_generator": {
66
"name": "bicep",
77
"version": "0.36.177.2456",
8-
"templateHash": "15970509425891056575"
8+
"templateHash": "8960822814596420700"
99
}
1010
},
1111
"parameters": {
@@ -2677,7 +2677,7 @@
26772677
}
26782678
},
26792679
"variables": {
2680-
"$fxv#0": "#Requires -Version 7.2\r\n\r\n<#\r\n.SYNOPSIS\r\n Creates a SQL user and assigns the user account to one or more roles.\r\n\r\n.DESCRIPTION\r\n During an application deployment, the managed identity (and potentially the developer identity)\r\n must be added to the SQL database as a user and assigned to one or more roles. This script\r\n accomplishes this task using the owner-managed identity for authentication.\r\n\r\n.PARAMETER SqlServerName\r\n The name of the Azure SQL Server resource.\r\n\r\n.PARAMETER SqlDatabaseName\r\n The name of the Azure SQL Database where the user will be created.\r\n\r\n.PARAMETER ClientId\r\n The Client (Principal) ID (GUID) of the identity to be added.\r\n\r\n.PARAMETER DisplayName\r\n The Object (Principal) display name of the identity to be added.\r\n\r\n.PARAMETER DatabaseRoles\r\n A comma-separated string of database roles to assign (e.g., 'db_datareader,db_datawriter')\r\n#>\r\n\r\nParam(\r\n [string] $SqlServerName,\r\n [string] $SqlDatabaseName,\r\n [string] $ClientId,\r\n [string] $DisplayName,\r\n [string] $DatabaseRoles\r\n)\r\n\r\n# Using specific version of SqlServer module to avoid issues with newer versions\r\n$SqlServerModuleVersion = \"22.3.0\"\r\n\r\nfunction Resolve-Module($moduleName) {\r\n # If module is imported; say that and do nothing\r\n if (Get-Module | Where-Object { $_.Name -eq $moduleName }) {\r\n Write-Debug \"Module $moduleName is already imported\"\r\n } elseif (Get-Module -ListAvailable | Where-Object { $_.Name -eq $moduleName }) {\r\n Import-Module $moduleName\r\n } elseif (Find-Module -Name $moduleName | Where-Object { $_.Name -eq $moduleName }) {\r\n # Use specific version for SqlServer\r\n if ($ModuleName -eq \"SqlServer\") {\r\n Install-Module -Name $ModuleName -RequiredVersion $SqlServerModuleVersion -Force -Scope CurrentUser\r\n } else {\r\n Install-Module -Name $ModuleName -Force\r\n }\r\n Import-Module $moduleName\r\n } else {\r\n Write-Error \"Module $moduleName not found\"\r\n [Environment]::exit(1)\r\n }\r\n}\r\n\r\n###\r\n### MAIN SCRIPT\r\n###\r\nResolve-Module -moduleName Az.Resources\r\nResolve-Module -moduleName SqlServer\r\n\r\n# Split comma-separated roles into an array\r\n$roleArray = $DatabaseRoles -split ','\r\n\r\n$roleSql = \"\"\r\nforeach ($role in $roleArray) {\r\n $trimmedRole = $role.Trim()\r\n $roleSql += \"EXEC sp_addrolemember N'$trimmedRole', N'$DisplayName';`n\"\r\n}\r\n\r\n$sql = @\"\r\nDECLARE @username nvarchar(max) = N'$($DisplayName)';\r\nDECLARE @clientId uniqueidentifier = '$($ClientId)';\r\nDECLARE @sid NVARCHAR(max) = CONVERT(VARCHAR(max), CONVERT(VARBINARY(16), @clientId), 1);\r\nDECLARE @cmd NVARCHAR(max) = N'CREATE USER [' + @username + '] WITH SID = ' + @sid + ', TYPE = E;';\r\nIF NOT EXISTS (SELECT * FROM sys.database_principals WHERE name = @username)\r\nBEGIN\r\n EXEC(@cmd)\r\nEND\r\n$($roleSql)\r\n\"@\r\n\r\nWrite-Output \"`nSQL:`n$($sql)`n`n\"\r\n\r\n$token = (Get-AzAccessToken -AsSecureString -ResourceUrl https://database.windows.net/).Token\r\n$ssPtr = [System.Runtime.InteropServices.Marshal]::SecureStringToBSTR($token)\r\ntry {\r\n $serverInstance = if ($SqlServerName -like \"*.database.windows.net\") { \r\n $SqlServerName \r\n } else { \r\n \"$SqlServerName.database.windows.net\" \r\n }\r\n $plaintext = [System.Runtime.InteropServices.Marshal]::PtrToStringBSTR($ssPtr)\r\n Invoke-Sqlcmd -ServerInstance $serverInstance -Database $SqlDatabaseName -AccessToken $plaintext -Query $sql -ErrorAction 'Stop'\r\n} finally {\r\n # The following line ensures that sensitive data is not left in memory.\r\n $plainText = [System.Runtime.InteropServices.Marshal]::ZeroFreeBSTR($ssPtr)\r\n}"
2680+
"$fxv#0": "#Requires -Version 7.2\r\n\r\n<#\r\n.SYNOPSIS\r\n Creates a SQL user and assigns the user account to one or more roles.\r\n\r\n.DESCRIPTION\r\n During an application deployment, the managed identity (and potentially the developer identity)\r\n must be added to the SQL database as a user and assigned to one or more roles. This script\r\n accomplishes this task using the owner-managed identity for authentication.\r\n\r\n.PARAMETER SqlServerName\r\n The name of the Azure SQL Server resource.\r\n\r\n.PARAMETER SqlDatabaseName\r\n The name of the Azure SQL Database where the user will be created.\r\n\r\n.PARAMETER ClientId\r\n The Client (Principal) ID (GUID) of the identity to be added.\r\n\r\n.PARAMETER DisplayName\r\n The Object (Principal) display name of the identity to be added.\r\n\r\n.PARAMETER DatabaseRoles\r\n A comma-separated string of database roles to assign (e.g., 'db_datareader,db_datawriter')\r\n#>\r\n\r\nParam(\r\n [string] $SqlServerName,\r\n [string] $SqlDatabaseName,\r\n [string] $ClientId,\r\n [string] $DisplayName,\r\n [string] $DatabaseRoles\r\n)\r\n\r\n# Using specific version of SqlServer module to avoid issues with newer versions\r\n$SqlServerModuleVersion = \"22.3.0\"\r\n\r\nfunction Resolve-Module($moduleName) {\r\n # If module is imported; say that and do nothing\r\n if (Get-Module | Where-Object { $_.Name -eq $moduleName }) {\r\n Write-Debug \"Module $moduleName is already imported\"\r\n } elseif (Get-Module -ListAvailable | Where-Object { $_.Name -eq $moduleName }) {\r\n Import-Module $moduleName\r\n } elseif (Find-Module -Name $moduleName | Where-Object { $_.Name -eq $moduleName }) {\r\n # Use specific version for SqlServer\r\n if ($moduleName -eq \"SqlServer\") {\r\n Install-Module -Name $moduleName -RequiredVersion $SqlServerModuleVersion -Force -Scope CurrentUser\r\n } else {\r\n Install-Module -Name $moduleName -Force\r\n }\r\n Import-Module $moduleName\r\n } else {\r\n Write-Error \"Module $moduleName not found\"\r\n [Environment]::exit(1)\r\n }\r\n}\r\n\r\n###\r\n### MAIN SCRIPT\r\n###\r\nResolve-Module -moduleName Az.Resources\r\nResolve-Module -moduleName SqlServer\r\n\r\n# Split comma-separated roles into an array\r\n$roleArray = $DatabaseRoles -split ','\r\n\r\n$roleSql = \"\"\r\nforeach ($role in $roleArray) {\r\n $trimmedRole = $role.Trim()\r\n $roleSql += \"EXEC sp_addrolemember N'$trimmedRole', N'$DisplayName';`n\"\r\n}\r\n\r\n$sql = @\"\r\nDECLARE @username nvarchar(max) = N'$($DisplayName)';\r\nDECLARE @clientId uniqueidentifier = '$($ClientId)';\r\nDECLARE @sid NVARCHAR(max) = CONVERT(VARCHAR(max), CONVERT(VARBINARY(16), @clientId), 1);\r\nDECLARE @cmd NVARCHAR(max) = N'CREATE USER [' + @username + '] WITH SID = ' + @sid + ', TYPE = E;';\r\nIF NOT EXISTS (SELECT * FROM sys.database_principals WHERE name = @username)\r\nBEGIN\r\n EXEC(@cmd)\r\nEND\r\n$($roleSql)\r\n\"@\r\n\r\nWrite-Output \"`nSQL:`n$($sql)`n`n\"\r\n\r\n$token = (Get-AzAccessToken -AsSecureString -ResourceUrl https://database.windows.net/).Token\r\n$ssPtr = [System.Runtime.InteropServices.Marshal]::SecureStringToBSTR($token)\r\ntry {\r\n $serverInstance = if ($SqlServerName -like \"*.database.windows.net\") { \r\n $SqlServerName \r\n } else { \r\n \"$SqlServerName.database.windows.net\" \r\n }\r\n $plaintext = [System.Runtime.InteropServices.Marshal]::PtrToStringBSTR($ssPtr)\r\n Invoke-Sqlcmd -ServerInstance $serverInstance -Database $SqlDatabaseName -AccessToken $plaintext -Query $sql -ErrorAction 'Stop'\r\n} finally {\r\n # The following line ensures that sensitive data is not left in memory.\r\n $plainText = [System.Runtime.InteropServices.Marshal]::ZeroFreeBSTR($ssPtr)\r\n}"
26812681
},
26822682
"resources": {
26832683
"managedIdentity": {
@@ -2756,8 +2756,11 @@
27562756
"containerName": {
27572757
"value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', 'deploy_storage_account'), '2022-09-01').outputs.storageContainer.value]"
27582758
},
2759-
"managedIdentityObjectId": {
2759+
"managedIdentityResourceId": {
27602760
"value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', 'deploy_managed_identity'), '2022-09-01').outputs.managedIdentityOutput.value.id]"
2761+
},
2762+
"managedIdentityClientId": {
2763+
"value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', 'deploy_managed_identity'), '2022-09-01').outputs.managedIdentityOutput.value.clientId]"
27612764
}
27622765
},
27632766
"template": {
@@ -2767,7 +2770,7 @@
27672770
"_generator": {
27682771
"name": "bicep",
27692772
"version": "0.36.177.2456",
2770-
"templateHash": "13543451525678147122"
2773+
"templateHash": "11731675131496313545"
27712774
}
27722775
},
27732776
"parameters": {
@@ -2780,7 +2783,10 @@
27802783
"baseUrl": {
27812784
"type": "string"
27822785
},
2783-
"managedIdentityObjectId": {
2786+
"managedIdentityResourceId": {
2787+
"type": "string"
2788+
},
2789+
"managedIdentityClientId": {
27842790
"type": "string"
27852791
},
27862792
"storageAccountName": {
@@ -2800,13 +2806,13 @@
28002806
"identity": {
28012807
"type": "UserAssigned",
28022808
"userAssignedIdentities": {
2803-
"[format('{0}', parameters('managedIdentityObjectId'))]": {}
2809+
"[format('{0}', parameters('managedIdentityResourceId'))]": {}
28042810
}
28052811
},
28062812
"properties": {
28072813
"azCliVersion": "2.52.0",
28082814
"primaryScriptUri": "[format('{0}infra/scripts/copy_kb_files.sh', parameters('baseUrl'))]",
2809-
"arguments": "[format('{0} {1} {2} {3}', parameters('storageAccountName'), parameters('containerName'), parameters('baseUrl'), parameters('managedIdentityObjectId'))]",
2815+
"arguments": "[format('{0} {1} {2} {3}', parameters('storageAccountName'), parameters('containerName'), parameters('baseUrl'), parameters('managedIdentityClientId'))]",
28102816
"timeout": "PT1H",
28112817
"retentionInterval": "PT1H",
28122818
"cleanupPreference": "OnSuccess"
@@ -2833,7 +2839,7 @@
28332839
"solutionLocation": {
28342840
"value": "[parameters('secondaryLocation')]"
28352841
},
2836-
"managedIdentityObjectId": {
2842+
"managedIdentityResourceId": {
28372843
"value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', 'deploy_managed_identity'), '2022-09-01').outputs.managedIdentityOutput.value.id]"
28382844
},
28392845
"managedIdentityClientId": {
@@ -2853,7 +2859,7 @@
28532859
"_generator": {
28542860
"name": "bicep",
28552861
"version": "0.36.177.2456",
2856-
"templateHash": "11062122159171182625"
2862+
"templateHash": "13172962234134518300"
28572863
}
28582864
},
28592865
"parameters": {
@@ -2869,7 +2875,7 @@
28692875
"keyVaultName": {
28702876
"type": "string"
28712877
},
2872-
"managedIdentityObjectId": {
2878+
"managedIdentityResourceId": {
28732879
"type": "string"
28742880
},
28752881
"managedIdentityClientId": {
@@ -2886,7 +2892,7 @@
28862892
"identity": {
28872893
"type": "UserAssigned",
28882894
"userAssignedIdentities": {
2889-
"[format('{0}', parameters('managedIdentityObjectId'))]": {}
2895+
"[format('{0}', parameters('managedIdentityResourceId'))]": {}
28902896
}
28912897
},
28922898
"properties": {

0 commit comments

Comments
 (0)