Skip to content

Commit 6cfda1b

Browse files
florianowflorianow
committed
chore: allow role_assignment
chore: adding scope role_definition chore: pre-commit chore: adding scope role_definition chore: pre-commit chore: adding scope role_definition chore: pre-commit chore: adding scope role_definition chore: allow role_assignment chore: adding scope role_definition chore: pre-commit chore: adding scope role_definition chore: pre-commit chore: adding scope role_definition chore: pre-commit chore: adding scope role_definition chore: allow role_assignment chore: adding scope role_definition chore: pre-commit chore: adding scope role_definition chore: pre-commit chore: adding scope role_definition chore: pre-commit chore: adding scope role_definition chore: allow role_assignment chore: adding scope role_definition chore: pre-commit chore: adding scope role_definition chore: pre-commit chore: adding scope role_definition chore: pre-commit chore: adding scope role_definition chore: allow role_assignment chore: adding scope role_definition chore: allow role_assignment
1 parent 7b33f75 commit 6cfda1b

File tree

2 files changed

+2
-151
lines changed

2 files changed

+2
-151
lines changed

‎modules/meshcloud-replicator-service-principal/module.tf

Lines changed: 2 additions & 151 deletions
Original file line numberDiff line numberDiff line change
@@ -19,10 +19,6 @@ terraform {
1919
}
2020
}
2121

22-
# locals {
23-
# spp_hash = substr(sha256(var.service_principal_name), 0, 5)
24-
# }
25-
2622
//---------------------------------------------------------------------------
2723
// Role Definition for the Replicator on the specified Scope
2824
//---------------------------------------------------------------------------
@@ -34,6 +30,8 @@ resource "azurerm_role_definition" "meshcloud_replicator" {
3430
permissions {
3531
actions = [
3632
"Microsoft.Resources/subscriptions/read",
33+
"Microsoft.Authorization/roleAssignments/*"
34+
3735
]
3836
}
3937

@@ -42,34 +40,6 @@ resource "azurerm_role_definition" "meshcloud_replicator" {
4240
]
4341
}
4442

45-
# resource "azurerm_role_definition" "meshcloud_replicator_subscription_canceler" {
46-
# name = "${var.service_principal_name}-cancel-subscriptions"
47-
# scope = data.azurerm_subscription.aks.id
48-
# description = "Additional permissions required by meshStack replicator in order to cancel subscriptions"
49-
50-
# permissions {
51-
# actions = ["Microsoft.Subscription/cancel/action"]
52-
# }
53-
54-
# assignable_scopes = [
55-
# data.azurerm_subscription.aks.id
56-
# ]
57-
# }
58-
59-
# resource "azurerm_role_definition" "meshcloud_replicator_rg_deleter" {
60-
# name = "${var.service_principal_name}-delete-resourceGroups"
61-
# scope = data.azurerm_subscription.aks.id
62-
# description = "Additional permissions required by meshStack replicator in order to delete Resource Groups"
63-
64-
# permissions {
65-
# actions = ["Microsoft.Resources/subscriptions/resourceGroups/delete"]
66-
# }
67-
68-
# assignable_scopes = [
69-
# data.azurerm_subscription.aks.id
70-
# ]
71-
# }
72-
7343
//---------------------------------------------------------------------------
7444
// Queries Entra ID for information about well-known application IDs.
7545
// Retrieve details about the service principal
@@ -129,30 +99,6 @@ resource "azurerm_role_assignment" "meshcloud_replicator" {
12999
principal_id = azuread_service_principal.meshcloud_replicator.object_id
130100
}
131101

132-
# resource "azurerm_role_assignment" "meshcloud_replicator_subscription_canceler" {
133-
# for_each = toset(var.can_cancel_subscriptions_in_scopes)
134-
# scope = each.key
135-
# role_definition_id = azurerm_role_definition.meshcloud_replicator_subscription_canceler.role_definition_resource_id
136-
# principal_id = azuread_service_principal.meshcloud_replicator.object_id
137-
# }
138-
139-
# resource "azurerm_role_assignment" "meshcloud_replicator_rg_deleter" {
140-
# for_each = toset(var.can_delete_rgs_in_scopes)
141-
# scope = each.key
142-
# principal_id = azuread_service_principal.meshcloud_replicator.object_id
143-
144-
# # The azurerm provider requires this must be a scoped id, so unfortuantely we need to construct the id of the role
145-
# # definition at the assignment scope in order to make this stable for subsequent terraform apply's.
146-
# # See https://github.com/hashicorp/terraform-provider-azurerm/issues/4847#issuecomment-2085122502
147-
# # Apparently, this problem only comes up when the scope is a subscription, it seems management groups are not affected.
148-
# # RG deletion is typically only selectively enabled for specific subscriptions.
149-
# role_definition_id = join("", [
150-
# each.key,
151-
# "/providers/Microsoft.Authorization/roleDefinitions/",
152-
# azurerm_role_definition.meshcloud_replicator_rg_deleter.role_definition_id
153-
# ])
154-
# }
155-
156102
//---------------------------------------------------------------------------
157103
// Assign Entra ID Roles to the Enterprise application
158104
//---------------------------------------------------------------------------
@@ -176,98 +122,3 @@ resource "azuread_app_role_assignment" "meshcloud_replicator-user" {
176122
resource_object_id = data.azuread_service_principal.msgraph.object_id
177123
depends_on = [azuread_application.meshcloud_replicator]
178124
}
179-
180-
//---------------------------------------------------------------------------
181-
// Policy Definition for preventing the Application from assigning other privileges to itself
182-
// Assign it to the specified scope
183-
//---------------------------------------------------------------------------
184-
# resource "azurerm_policy_definition" "privilege_escalation_prevention" {
185-
# name = "meshStack-privilege-escalation-prevention-${local.spp_hash}"
186-
# policy_type = "Custom"
187-
# mode = "All"
188-
# description = "Prevents assigning additional roles to the meshStack replicator service principal"
189-
# display_name = "meshStack Privilege Escalation Prevention"
190-
# management_group_id = data.azurerm_subscription.aks.id
191-
192-
# policy_rule = <<RULE
193-
# {
194-
# "if": {
195-
# "allOf": [
196-
# {
197-
# "equals": "Microsoft.Authorization/roleAssignments",
198-
# "field": "type"
199-
# },
200-
# {
201-
# "field": "Microsoft.Authorization/roleAssignments/principalId",
202-
# "equals": "${azuread_service_principal.meshcloud_replicator.object_id}"
203-
# }
204-
# ]
205-
# },
206-
# "then": {
207-
# "effect": "deny"
208-
# }
209-
# }
210-
# RULE
211-
# }
212-
213-
# resource "terraform_data" "allowed_assignments" {
214-
# input = compact(
215-
# concat(
216-
# var.assignment_scopes,
217-
# var.can_cancel_subscriptions_in_scopes,
218-
# var.can_delete_rgs_in_scopes
219-
# ))
220-
# }
221-
222-
# resource "azurerm_management_group_policy_assignment" "privilege-escalation-prevention" {
223-
# name = "meshStack-PEP-${local.spp_hash}"
224-
# description = azurerm_policy_definition.privilege_escalation_prevention.description
225-
# policy_definition_id = azurerm_policy_definition.privilege_escalation_prevention.id
226-
# management_group_id = data.azurerm_subscription.aks.id
227-
228-
# lifecycle {
229-
# # ensure we unassign the policy whenver we make intentional changes to the replicators role assignments and then reassign it after
230-
# # note that we can't directly depend on the azurerm_role_assignment resources here because terraform fails with
231-
# # > Error: no change found for azurerm_role_assignment.meshcloud_replicator_rg_deleter
232-
# # whenever no role_assignment exists because the for_each condition is empty (so no instances exist).
233-
# # We therefore trigger the replacement directly using the for_each keys
234-
# replace_triggered_by = [
235-
# terraform_data.allowed_assignments
236-
# ]
237-
# }
238-
239-
# # only deploy this after the replicator roles have been assigned, here it's fine for terraform to directly reference
240-
# # resources that use for_each, even if there are no instances of that resources
241-
# depends_on = [
242-
# azurerm_role_assignment.meshcloud_replicator,
243-
# azurerm_role_assignment.meshcloud_replicator_rg_deleter,
244-
# azurerm_role_assignment.meshcloud_replicator_subscription_canceler
245-
# ]
246-
# }
247-
248-
# //---------------------------------------------------------------------------
249-
# // Administrative Unit
250-
# //---------------------------------------------------------------------------
251-
# resource "azuread_administrative_unit" "meshcloud_replicator_au" {
252-
# count = var.administrative_unit_name == null ? 0 : 1
253-
# description = "Administrative Unit for meshStack replicator"
254-
# display_name = var.administrative_unit_name
255-
# }
256-
257-
# //---------------------------------------------------------------------------
258-
# // Directory Role (Admin Role)
259-
# //---------------------------------------------------------------------------
260-
# resource "azuread_directory_role" "meshcloud_replicator_role" {
261-
# count = var.administrative_unit_name == null ? 0 : 1
262-
# display_name = "Groups Administrator"
263-
# }
264-
265-
# //---------------------------------------------------------------------------
266-
# // Assign the Service Principal to the Directory Role in the Administrative Unit
267-
# //---------------------------------------------------------------------------
268-
# resource "azuread_administrative_unit_role_member" "meshcloud_replicator_role_member" {
269-
# count = var.administrative_unit_name == null ? 0 : 1
270-
# role_object_id = azuread_directory_role.meshcloud_replicator_role[0].object_id
271-
# administrative_unit_object_id = azuread_administrative_unit.meshcloud_replicator_au[0].object_id
272-
# member_object_id = azuread_service_principal.meshcloud_replicator.object_id
273-
# }

‎provider.tf renamed to ‎providers.tf

File renamed without changes.

0 commit comments

Comments
 (0)