Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix KeyVault access policy param #41955

Merged
merged 2 commits into from
Feb 14, 2024
Merged

Fix KeyVault access policy param #41955

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
8161bd4
Fix KeyVault access policy param
JoshLove-msft Feb 14, 2024
83bb4a9
Fix
JoshLove-msft Feb 14, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 8 additions & 1 deletion sdk/provisioning/Azure.Provisioning/src/Resource.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -104,7 +104,14 @@ protected Resource(IConstruct scope, Resource? parent, string resourceName, Reso
/// <param name="parameter">The <see cref="Parameter"/> to assign.</param>
public void AssignParameter(object instance, string propertyName, Parameter parameter)
{
ParameterOverrides.Add(instance, new Dictionary<string, string> { { propertyName, parameter.Name } });
if (ParameterOverrides.TryGetValue(instance, out var overrides))
{
overrides[propertyName] = parameter.Name;
}
else
{
ParameterOverrides.Add(instance, new Dictionary<string, string> { { propertyName, parameter.Name } });
}
Parameters.Add(parameter);
}

Expand Down
7 changes: 4 additions & 3 deletions sdk/provisioning/Azure.Provisioning/src/keyvault/KeyVaultAddAccessPolicy.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,8 @@ public KeyVaultAddAccessPolicy(IConstruct scope, Parameter principalIdParameter,
{
new KeyVaultAccessPolicy(
scope.Root.Properties.TenantId!.Value,
GetParamValue(principalIdParameter, scope),
// this value will be replaced by the parameter reference
"dummy",
new IdentityAccessPermissions()
{
Secrets =
Expand All @@ -31,14 +32,14 @@ public KeyVaultAddAccessPolicy(IConstruct scope, Parameter principalIdParameter,
})
}))
{
ParameterOverrides.Add(Properties, new Dictionary<string, string> { { "objectId", GetParamValue(principalIdParameter, scope) } });
ParameterOverrides.Add(Properties.AccessPolicies[0], new Dictionary<string, string> { { nameof(KeyVaultAccessPolicy.ObjectId), GetParamValue(principalIdParameter, scope) } });
}

private static string GetParamValue(Parameter principalIdParameter, IConstruct scope)
{
if (principalIdParameter.Source is null || ReferenceEquals(principalIdParameter.Source, scope))
{
return principalIdParameter.Name;
return principalIdParameter.Value!;
}
else
{
Expand Down
4 changes: 2 additions & 2 deletions sdk/provisioning/Azure.Provisioning/tests/Infrastructure/WebSiteUsingL1/main.bicep
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -83,7 +83,7 @@ resource keyVaultAddAccessPolicy_OttgS6uaT 'Microsoft.KeyVault/vaults/accessPoli
accessPolicies: [
{
tenantId: '00000000-0000-0000-0000-000000000000'
objectId: 'SERVICE_API_IDENTITY_PRINCIPAL_ID'
objectId: webSite_W5EweSXEq.identity.principalId
permissions: {
secrets: [
'get'
Expand All @@ -99,7 +99,7 @@ resource keyVaultSecret_nMDmVNMVq 'Microsoft.KeyVault/vaults/secrets@2023-02-01'
parent: keyVault_CRoMbemLF
name: 'sqlAdminPassword'
properties: {
value: '00000000-0000-0000-0000-000000000000'
value: sqlAdminPassword
}
}

Expand Down
2 changes: 1 addition & 1 deletion sdk/provisioning/Azure.Provisioning/tests/Infrastructure/WebSiteUsingL2/main.bicep
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,7 +50,7 @@ resource keyVaultAddAccessPolicy_OttgS6uaT 'Microsoft.KeyVault/vaults/accessPoli
accessPolicies: [
{
tenantId: '00000000-0000-0000-0000-000000000000'
objectId: 'TestFrontEndWebSite.outputs.SERVICE_API_IDENTITY_PRINCIPAL_ID'
objectId: TestFrontEndWebSite.outputs.SERVICE_API_IDENTITY_PRINCIPAL_ID
permissions: {
secrets: [
'get'
Expand Down
2 changes: 1 addition & 1 deletion ...ucture/WebSiteUsingL3/resources/TestWebSiteWithSqlBackEnd/TestWebSiteWithSqlBackEnd.bicep
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,7 +40,7 @@ resource keyVaultAddAccessPolicy_OttgS6uaT 'Microsoft.KeyVault/vaults/accessPoli
accessPolicies: [
{
tenantId: '00000000-0000-0000-0000-000000000000'
objectId: 'TestFrontEndWebSite.outputs.SERVICE_API_IDENTITY_PRINCIPAL_ID'
objectId: TestFrontEndWebSite.outputs.SERVICE_API_IDENTITY_PRINCIPAL_ID
permissions: {
secrets: [
'get'
Expand Down
2 changes: 1 addition & 1 deletion sdk/provisioning/Azure.Provisioning/tests/ProvisioningTests.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,7 +39,7 @@ public void WebSiteUsingL1()
.AddAccessPolicy(frontEndPrincipalId); // frontEnd.properties.identity.principalId

KeyVaultSecret sqlAdminSecret = new KeyVaultSecret(infra, "sqlAdminPassword");
sqlAdminSecret.AssignParameter(sqlAdminSecret.Properties.Properties, sqlAdminSecret.Properties.Properties.Value, sqlAdminPasswordParam);
sqlAdminSecret.AssignParameter(sqlAdminSecret.Properties.Properties, nameof(sqlAdminSecret.Properties.Properties.Value), sqlAdminPasswordParam);

KeyVaultSecret appUserSecret = new KeyVaultSecret(infra, "appUserPassword");
appUserSecret.AssignParameter(appUserSecret.Properties.Properties, nameof(appUserSecret.Properties.Properties.Value), appUserPasswordParam);
Expand Down