Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Role Assignments: Principal Type Update + Uplift API Version for Module #714

Merged
merged 7 commits into from
Dec 8, 2021
Merged

Role Assignments: Principal Type Update + Uplift API Version for Module #714

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
e226c18
updated Principal Type and Readme
ahmadabdalla Dec 4, 2021
ca81ae5
updated the main
ahmadabdalla Dec 4, 2021
8c0ad02
supported Any() for principalType to supress validation for null
ahmadabdalla Dec 4, 2021
1650b75
updated readme to a known API version as the latest does not exist yet
ahmadabdalla Dec 4, 2021
127c0b7
updated for linter
ahmadabdalla Dec 4, 2021
5c40def
Merge remote-tracking branch 'origin/main' into users/ahmad/rbacPrinc…
ahmadabdalla Dec 6, 2021
8065139
moved any() to the principal type instead of all
ahmadabdalla Dec 6, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 12 additions & 4 deletions arm/Microsoft.Authorization/roleAssignments/.bicep/nested_rbac_mg.bicep
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,8 +24,16 @@ param condition string = ''
])
param conditionVersion string = '2.0'

@sys.description('Optional. The principal type of the assigned principal ID. Allowed Values "ServicePrincipal", "Group", "User", "ForeignGroup", "Device"')
param principalType string = 'ServicePrincipal'
@sys.description('Optional. The principal type of the assigned principal ID.')
@allowed([
'ServicePrincipal'
'Group'
'User'
'ForeignGroup'
'Device'
''
])
param principalType string = ''

var builtInRoleNames_var = {
'AcrPush': '/providers/Microsoft.Authorization/roleDefinitions/8311e382-0749-4cb8-b61a-304f252e45ec'
Expand Down Expand Up @@ -313,13 +321,13 @@ var builtInRoleNames_var = {

var roleDefinitionId_var = (contains(builtInRoleNames_var, roleDefinitionIdOrName) ? builtInRoleNames_var[roleDefinitionIdOrName] : roleDefinitionIdOrName)

resource roleAssignment 'Microsoft.Authorization/roleAssignments@2020-04-01-preview' = {
resource roleAssignment 'Microsoft.Authorization/roleAssignments@2021-04-01-preview' = {
name: guid(managementGroupId, roleDefinitionId_var, principalId)
properties: {
roleDefinitionId: roleDefinitionId_var
principalId: principalId
description: !empty(description) ? description : null
principalType: !empty(principalType) ? principalType : null
principalType: !empty(principalType) ? any(principalType) : null
delegatedManagedIdentityResourceId: !empty(delegatedManagedIdentityResourceId) ? delegatedManagedIdentityResourceId : null
conditionVersion: !empty(conditionVersion) && !empty(condition) ? conditionVersion : null
condition: !empty(condition) ? condition : null
Expand Down
16 changes: 12 additions & 4 deletions arm/Microsoft.Authorization/roleAssignments/.bicep/nested_rbac_rg.bicep
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,8 +27,16 @@ param condition string = ''
])
param conditionVersion string = '2.0'

@sys.description('Optional. The principal type of the assigned principal ID. Allowed Values "ServicePrincipal", "Group", "User", "ForeignGroup", "Device"')
param principalType string = 'ServicePrincipal'
@sys.description('Optional. The principal type of the assigned principal ID.')
@allowed([
'ServicePrincipal'
'Group'
'User'
'ForeignGroup'
'Device'
''
])
param principalType string = ''

var builtInRoleNames_var = {
'AcrPush': '/providers/Microsoft.Authorization/roleDefinitions/8311e382-0749-4cb8-b61a-304f252e45ec'
Expand Down Expand Up @@ -316,13 +324,13 @@ var builtInRoleNames_var = {

var roleDefinitionId_var = (contains(builtInRoleNames_var, roleDefinitionIdOrName) ? builtInRoleNames_var[roleDefinitionIdOrName] : roleDefinitionIdOrName)

resource roleAssignment 'Microsoft.Authorization/roleAssignments@2020-04-01-preview' = {
resource roleAssignment 'Microsoft.Authorization/roleAssignments@2021-04-01-preview' = {
name: guid(subscriptionId, resourceGroupName, roleDefinitionId_var, principalId)
properties: {
roleDefinitionId: roleDefinitionId_var
principalId: principalId
description: !empty(description) ? description : null
principalType: !empty(principalType) ? principalType : null
principalType: !empty(principalType) ? any(principalType) : null
delegatedManagedIdentityResourceId: !empty(delegatedManagedIdentityResourceId) ? delegatedManagedIdentityResourceId : null
conditionVersion: !empty(conditionVersion) && !empty(condition) ? conditionVersion : null
condition: !empty(condition) ? condition : null
Expand Down
16 changes: 12 additions & 4 deletions arm/Microsoft.Authorization/roleAssignments/.bicep/nested_rbac_sub.bicep
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,8 +24,16 @@ param condition string = ''
])
param conditionVersion string = '2.0'

@sys.description('Optional. The principal type of the assigned principal ID. Allowed Values "ServicePrincipal", "Group", "User", "ForeignGroup", "Device"')
param principalType string = 'ServicePrincipal'
@sys.description('Optional. The principal type of the assigned principal ID.')
@allowed([
'ServicePrincipal'
'Group'
'User'
'ForeignGroup'
'Device'
''
])
param principalType string = ''

var builtInRoleNames_var = {
'AcrPush': '/providers/Microsoft.Authorization/roleDefinitions/8311e382-0749-4cb8-b61a-304f252e45ec'
Expand Down Expand Up @@ -313,13 +321,13 @@ var builtInRoleNames_var = {

var roleDefinitionId_var = (contains(builtInRoleNames_var, roleDefinitionIdOrName) ? builtInRoleNames_var[roleDefinitionIdOrName] : roleDefinitionIdOrName)

resource roleAssignment 'Microsoft.Authorization/roleAssignments@2020-04-01-preview' = {
resource roleAssignment 'Microsoft.Authorization/roleAssignments@2021-04-01-preview' = {
name: guid(subscriptionId, roleDefinitionId_var, principalId)
properties: {
roleDefinitionId: roleDefinitionId_var
principalId: principalId
description: !empty(description) ? description : null
principalType: !empty(principalType) ? principalType : null
principalType: !empty(principalType) ? any(principalType) : null
delegatedManagedIdentityResourceId: !empty(delegatedManagedIdentityResourceId) ? delegatedManagedIdentityResourceId : null
conditionVersion: !empty(conditionVersion) && !empty(condition) ? conditionVersion : null
condition: !empty(condition) ? condition : null
Expand Down
12 changes: 10 additions & 2 deletions arm/Microsoft.Authorization/roleAssignments/deploy.bicep
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,8 +33,16 @@ param condition string = ''
])
param conditionVersion string = '2.0'

@sys.description('Optional. The principal type of the assigned principal ID. Allowed Values "ServicePrincipal", "Group", "User", "ForeignGroup", "Device"')
param principalType string = 'ServicePrincipal'
@sys.description('Optional. The principal type of the assigned principal ID.')
@allowed([
'ServicePrincipal'
'Group'
'User'
'ForeignGroup'
'Device'
''
])
param principalType string = ''

module roleAssignment_mg '.bicep/nested_rbac_mg.bicep' = if (!empty(managementGroupId) && empty(subscriptionId) && empty(resourceGroupName)) {
name: '${uniqueString(deployment().name, location)}-RoleAssignment-MG-Module'
Expand Down
8 changes: 4 additions & 4 deletions arm/Microsoft.Authorization/roleAssignments/readme.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,20 +6,20 @@ This module deploys Role Assignments.

| Resource Type | API Version |
| :-- | :-- |
| `Microsoft.Authorization/roleAssignments` | 2020-04-01-preview |
| `Microsoft.Authorization/roleAssignments` | 2021-04-01-preview |

## Parameters

| Parameter Name | Type | Default Value | Possible Values | Description |
| :-- | :-- | :-- | :-- | :-- |
| `condition` | string | | | Optional. The conditions on the role assignment. This limits the resources it can be assigned to |
| `conditionVersion` | string | `2.0` | `[2.0]` | Optional. Version of the condition. Currently accepted value is "2.0" |
| `delegatedManagedIdentityResourceId` | string | | | Optional. Id of the delegated managed identity resource |
| `delegatedManagedIdentityResourceId` | string | | | Optional. ID of the delegated managed identity resource |
| `description` | string | | | Optional. Description of role assignment |
| `location` | string | `[deployment().location]` | | Optional. Location for all resources. |
| `managementGroupId` | string | | | Optional. Group ID of the Management Group to assign the RBAC role to. If no Subscription is provided, the module deploys at management group level, therefore assigns the provided RBAC role to the management group. |
| `principalId` | string | | | Required. The Principal or Object ID of the Security Principal (User, Group, Service Principal, Managed Identity) |
| `principalType` | string | `ServicePrincipal` | | Optional. The principal type of the assigned principal ID. Allowed Values "ServicePrincipal", "Group", "User", "ForeignGroup", "Device" |
| `principalType` | string | '' | `[ServicePrincipal, Group, User, ForeignGroup, Device, ]` | Optional. The principal type of the assigned principal ID. |
| `resourceGroupName` | string | | | Optional. Name of the Resource Group to assign the RBAC role to. If no Resource Group name is provided, and Subscription ID is provided, the module deploys at subscription level, therefore assigns the provided RBAC role to the subscription. |
| `roleDefinitionIdOrName` | string | | | Required. You can provide either the display name of the role definition, or it's fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11' |
| `subscriptionId` | string | | | Optional. Subscription ID of the subscription to assign the RBAC role to. If no Resource Group name is provided, the module deploys at subscription level, therefore assigns the provided RBAC role to the subscription. |
Expand Down Expand Up @@ -75,4 +75,4 @@ This module can be deployed at the management group, subscription or resource gr

## Template references

- [Roleassignments](https://docs.microsoft.com/en-us/azure/templates/Microsoft.Authorization/2020-04-01-preview/roleAssignments)
- [Roleassignments](https://docs.microsoft.com/en-us/azure/templates/Microsoft.Authorization/2020-08-01-preview/roleAssignments)