Skip to content

Commit 39ee3d7

Browse files
oZakarioZakari
committed
Update permissions
1 parent 3a47400 commit 39ee3d7

3 files changed

Lines changed: 87 additions & 42 deletions

File tree

‎alz/azuredevops/variables.tf‎

Lines changed: 12 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -468,13 +468,7 @@ variable "custom_role_definitions_terraform" {
468468
description = "This is a custom role created by the Azure Landing Zones Accelerator for Writing in platform subscriptions."
469469
permissions = {
470470
actions = [
471-
"*",
472-
"Microsoft.Resources/deployments/whatIf/action",
473-
"Microsoft.Resources/deployments/write",
474-
"Microsoft.Resources/deploymentStacks/read",
475-
"Microsoft.Resources/deploymentStacks/write",
476-
"Microsoft.Resources/deploymentStacks/delete",
477-
"Microsoft.Resources/deploymentStacks/validate/action"
471+
"*"
478472
]
479473
not_actions = []
480474
}
@@ -524,11 +518,11 @@ variable "custom_role_definitions_bicep" {
524518
"Microsoft.Management/managementGroups/read",
525519
"Microsoft.Management/managementGroups/subscriptions/delete",
526520
"Microsoft.Management/managementGroups/subscriptions/write",
527-
"Microsoft.Management/managementGroups/write",
528-
"Microsoft.Management/managementGroups/subscriptions/read",
529521
"Microsoft.Management/managementGroups/settings/read",
530522
"Microsoft.Management/managementGroups/settings/write",
531523
"Microsoft.Management/managementGroups/settings/delete",
524+
"Microsoft.Management/managementGroups/write",
525+
"Microsoft.Management/managementGroups/subscriptions/read",
532526
"Microsoft.Authorization/policyDefinitions/write",
533527
"Microsoft.Authorization/policySetDefinitions/write",
534528
"Microsoft.Authorization/policyAssignments/write",
@@ -539,6 +533,10 @@ variable "custom_role_definitions_bicep" {
539533
"Microsoft.Resources/deployments/validate/action",
540534
"Microsoft.Resources/deployments/read",
541535
"Microsoft.Resources/deployments/operationStatuses/read",
536+
"Microsoft.Resources/deploymentStacks/read",
537+
"Microsoft.Resources/deploymentStacks/write",
538+
"Microsoft.Resources/deploymentStacks/delete",
539+
"Microsoft.Resources/deploymentStacks/validate/action",
542540
"Microsoft.Authorization/roleAssignments/write",
543541
"Microsoft.Authorization/roleAssignments/delete",
544542
"Microsoft.Insights/diagnosticSettings/write"
@@ -562,7 +560,9 @@ variable "custom_role_definitions_bicep" {
562560
"Microsoft.Insights/diagnosticSettings/write",
563561
"Microsoft.Insights/diagnosticSettings/read",
564562
"Microsoft.Resources/deployments/whatIf/action",
565-
"Microsoft.Resources/deployments/write"
563+
"Microsoft.Resources/deployments/write",
564+
"Microsoft.Resources/deploymentStacks/read",
565+
"Microsoft.Resources/deploymentStacks/validate/action"
566566
]
567567
not_actions = []
568568
}
@@ -572,9 +572,7 @@ variable "custom_role_definitions_bicep" {
572572
description = "This is a custom role created by the Azure Landing Zones Accelerator for Writing in platform subscriptions."
573573
permissions = {
574574
actions = [
575-
"*",
576-
"Microsoft.Resources/deployments/whatIf/action",
577-
"Microsoft.Resources/deployments/write"
575+
"*"
578576
]
579577
not_actions = []
580578
}
@@ -596,6 +594,7 @@ variable "custom_role_definitions_bicep" {
596594
"Microsoft.Network/*/write",
597595
"Microsoft.Resources/deployments/whatIf/action",
598596
"Microsoft.Resources/deployments/write",
597+
"Microsoft.Resources/deploymentStacks/read",
599598
"Microsoft.SecurityInsights/onboardingStates/write"
600599
]
601600
not_actions = []

‎alz/github/variables.tf‎

Lines changed: 33 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -454,18 +454,25 @@ variable "custom_role_definitions_terraform" {
454454
"Microsoft.Management/managementGroups/read",
455455
"Microsoft.Management/managementGroups/subscriptions/delete",
456456
"Microsoft.Management/managementGroups/subscriptions/write",
457-
"Microsoft.Management/managementGroups/write",
458-
"Microsoft.Management/managementGroups/subscriptions/read",
459457
"Microsoft.Management/managementGroups/settings/read",
460458
"Microsoft.Management/managementGroups/settings/write",
461459
"Microsoft.Management/managementGroups/settings/delete",
460+
"Microsoft.Management/managementGroups/write",
461+
"Microsoft.Management/managementGroups/subscriptions/read",
462462
"Microsoft.Authorization/policyDefinitions/write",
463463
"Microsoft.Authorization/policySetDefinitions/write",
464464
"Microsoft.Authorization/policyAssignments/write",
465465
"Microsoft.Authorization/roleDefinitions/write",
466466
"Microsoft.Authorization/*/read",
467+
"Microsoft.Resources/deployments/whatIf/action",
467468
"Microsoft.Resources/deployments/write",
468-
"Microsoft.Resources/deployments/exportTemplate/action",
469+
"Microsoft.Resources/deployments/validate/action",
470+
"Microsoft.Resources/deployments/read",
471+
"Microsoft.Resources/deployments/operationStatuses/read",
472+
"Microsoft.Resources/deploymentStacks/read",
473+
"Microsoft.Resources/deploymentStacks/write",
474+
"Microsoft.Resources/deploymentStacks/delete",
475+
"Microsoft.Resources/deploymentStacks/validate/action",
469476
"Microsoft.Authorization/roleAssignments/write",
470477
"Microsoft.Authorization/roleAssignments/delete",
471478
"Microsoft.Insights/diagnosticSettings/write"
@@ -482,8 +489,16 @@ variable "custom_role_definitions_terraform" {
482489
"Microsoft.Management/managementGroups/subscriptions/read",
483490
"Microsoft.Management/managementGroups/settings/read",
484491
"Microsoft.Authorization/*/read",
492+
"Microsoft.Authorization/policyDefinitions/write",
493+
"Microsoft.Authorization/policySetDefinitions/write",
494+
"Microsoft.Authorization/roleDefinitions/write",
495+
"Microsoft.Authorization/policyAssignments/write",
496+
"Microsoft.Insights/diagnosticSettings/write",
497+
"Microsoft.Insights/diagnosticSettings/read",
498+
"Microsoft.Resources/deployments/whatIf/action",
485499
"Microsoft.Resources/deployments/write",
486-
"Microsoft.Resources/deployments/exportTemplate/action"
500+
"Microsoft.Resources/deploymentStacks/read",
501+
"Microsoft.Resources/deploymentStacks/validate/action"
487502
]
488503
not_actions = []
489504
}
@@ -493,9 +508,7 @@ variable "custom_role_definitions_terraform" {
493508
description = "This is a custom role created by the Azure Landing Zones Accelerator for Writing in platform subscriptions."
494509
permissions = {
495510
actions = [
496-
"*",
497-
"Microsoft.Resources/deployments/write",
498-
"Microsoft.Resources/deployments/exportTemplate/action"
511+
"*"
499512
]
500513
not_actions = []
501514
}
@@ -506,8 +519,18 @@ variable "custom_role_definitions_terraform" {
506519
permissions = {
507520
actions = [
508521
"*/read",
522+
"Microsoft.Resources/subscriptions/resourceGroups/write",
523+
"Microsoft.ManagedIdentity/userAssignedIdentities/write",
524+
"Microsoft.Automation/automationAccounts/write",
525+
"Microsoft.OperationalInsights/workspaces/write",
526+
"Microsoft.OperationalInsights/workspaces/linkedServices/write",
527+
"Microsoft.OperationsManagement/solutions/write",
528+
"Microsoft.Insights/dataCollectionRules/write",
529+
"Microsoft.Authorization/locks/write",
530+
"Microsoft.Network/*/write",
531+
"Microsoft.Resources/deployments/whatIf/action",
509532
"Microsoft.Resources/deployments/write",
510-
"Microsoft.Resources/deployments/exportTemplate/action"
533+
"Microsoft.SecurityInsights/onboardingStates/write"
511534
]
512535
not_actions = []
513536
}
@@ -589,13 +612,7 @@ variable "custom_role_definitions_bicep" {
589612
description = "This is a custom role created by the Azure Landing Zones Accelerator for Writing in platform subscriptions."
590613
permissions = {
591614
actions = [
592-
"*",
593-
"Microsoft.Resources/deployments/whatIf/action",
594-
"Microsoft.Resources/deployments/write",
595-
"Microsoft.Resources/deploymentStacks/read",
596-
"Microsoft.Resources/deploymentStacks/write",
597-
"Microsoft.Resources/deploymentStacks/delete",
598-
"Microsoft.Resources/deploymentStacks/validate/action"
615+
"*"
599616
]
600617
not_actions = []
601618
}
@@ -617,6 +634,7 @@ variable "custom_role_definitions_bicep" {
617634
"Microsoft.Network/*/write",
618635
"Microsoft.Resources/deployments/whatIf/action",
619636
"Microsoft.Resources/deployments/write",
637+
"Microsoft.Resources/deploymentStacks/read",
620638
"Microsoft.SecurityInsights/onboardingStates/write"
621639
]
622640
not_actions = []

‎alz/local/variables.tf‎

Lines changed: 42 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -240,18 +240,25 @@ variable "custom_role_definitions_terraform" {
240240
"Microsoft.Management/managementGroups/read",
241241
"Microsoft.Management/managementGroups/subscriptions/delete",
242242
"Microsoft.Management/managementGroups/subscriptions/write",
243-
"Microsoft.Management/managementGroups/write",
244-
"Microsoft.Management/managementGroups/subscriptions/read",
245243
"Microsoft.Management/managementGroups/settings/read",
246244
"Microsoft.Management/managementGroups/settings/write",
247245
"Microsoft.Management/managementGroups/settings/delete",
246+
"Microsoft.Management/managementGroups/write",
247+
"Microsoft.Management/managementGroups/subscriptions/read",
248248
"Microsoft.Authorization/policyDefinitions/write",
249249
"Microsoft.Authorization/policySetDefinitions/write",
250250
"Microsoft.Authorization/policyAssignments/write",
251251
"Microsoft.Authorization/roleDefinitions/write",
252252
"Microsoft.Authorization/*/read",
253+
"Microsoft.Resources/deployments/whatIf/action",
253254
"Microsoft.Resources/deployments/write",
254-
"Microsoft.Resources/deployments/exportTemplate/action",
255+
"Microsoft.Resources/deployments/validate/action",
256+
"Microsoft.Resources/deployments/read",
257+
"Microsoft.Resources/deployments/operationStatuses/read",
258+
"Microsoft.Resources/deploymentStacks/read",
259+
"Microsoft.Resources/deploymentStacks/write",
260+
"Microsoft.Resources/deploymentStacks/delete",
261+
"Microsoft.Resources/deploymentStacks/validate/action",
255262
"Microsoft.Authorization/roleAssignments/write",
256263
"Microsoft.Authorization/roleAssignments/delete",
257264
"Microsoft.Insights/diagnosticSettings/write"
@@ -268,8 +275,16 @@ variable "custom_role_definitions_terraform" {
268275
"Microsoft.Management/managementGroups/subscriptions/read",
269276
"Microsoft.Management/managementGroups/settings/read",
270277
"Microsoft.Authorization/*/read",
278+
"Microsoft.Authorization/policyDefinitions/write",
279+
"Microsoft.Authorization/policySetDefinitions/write",
280+
"Microsoft.Authorization/roleDefinitions/write",
281+
"Microsoft.Authorization/policyAssignments/write",
282+
"Microsoft.Insights/diagnosticSettings/write",
283+
"Microsoft.Insights/diagnosticSettings/read",
284+
"Microsoft.Resources/deployments/whatIf/action",
271285
"Microsoft.Resources/deployments/write",
272-
"Microsoft.Resources/deployments/exportTemplate/action"
286+
"Microsoft.Resources/deploymentStacks/read",
287+
"Microsoft.Resources/deploymentStacks/validate/action"
273288
]
274289
not_actions = []
275290
}
@@ -279,9 +294,7 @@ variable "custom_role_definitions_terraform" {
279294
description = "This is a custom role created by the Azure Landing Zones Accelerator for Writing in platform subscriptions."
280295
permissions = {
281296
actions = [
282-
"*",
283-
"Microsoft.Resources/deployments/write",
284-
"Microsoft.Resources/deployments/exportTemplate/action"
297+
"*"
285298
]
286299
not_actions = []
287300
}
@@ -292,8 +305,18 @@ variable "custom_role_definitions_terraform" {
292305
permissions = {
293306
actions = [
294307
"*/read",
308+
"Microsoft.Resources/subscriptions/resourceGroups/write",
309+
"Microsoft.ManagedIdentity/userAssignedIdentities/write",
310+
"Microsoft.Automation/automationAccounts/write",
311+
"Microsoft.OperationalInsights/workspaces/write",
312+
"Microsoft.OperationalInsights/workspaces/linkedServices/write",
313+
"Microsoft.OperationsManagement/solutions/write",
314+
"Microsoft.Insights/dataCollectionRules/write",
315+
"Microsoft.Authorization/locks/write",
316+
"Microsoft.Network/*/write",
317+
"Microsoft.Resources/deployments/whatIf/action",
295318
"Microsoft.Resources/deployments/write",
296-
"Microsoft.Resources/deployments/exportTemplate/action"
319+
"Microsoft.SecurityInsights/onboardingStates/write"
297320
]
298321
not_actions = []
299322
}
@@ -321,11 +344,11 @@ variable "custom_role_definitions_bicep" {
321344
"Microsoft.Management/managementGroups/read",
322345
"Microsoft.Management/managementGroups/subscriptions/delete",
323346
"Microsoft.Management/managementGroups/subscriptions/write",
324-
"Microsoft.Management/managementGroups/write",
325-
"Microsoft.Management/managementGroups/subscriptions/read",
326347
"Microsoft.Management/managementGroups/settings/read",
327348
"Microsoft.Management/managementGroups/settings/write",
328349
"Microsoft.Management/managementGroups/settings/delete",
350+
"Microsoft.Management/managementGroups/write",
351+
"Microsoft.Management/managementGroups/subscriptions/read",
329352
"Microsoft.Authorization/policyDefinitions/write",
330353
"Microsoft.Authorization/policySetDefinitions/write",
331354
"Microsoft.Authorization/policyAssignments/write",
@@ -336,6 +359,10 @@ variable "custom_role_definitions_bicep" {
336359
"Microsoft.Resources/deployments/validate/action",
337360
"Microsoft.Resources/deployments/read",
338361
"Microsoft.Resources/deployments/operationStatuses/read",
362+
"Microsoft.Resources/deploymentStacks/read",
363+
"Microsoft.Resources/deploymentStacks/write",
364+
"Microsoft.Resources/deploymentStacks/delete",
365+
"Microsoft.Resources/deploymentStacks/validate/action",
339366
"Microsoft.Authorization/roleAssignments/write",
340367
"Microsoft.Authorization/roleAssignments/delete",
341368
"Microsoft.Insights/diagnosticSettings/write"
@@ -359,7 +386,9 @@ variable "custom_role_definitions_bicep" {
359386
"Microsoft.Insights/diagnosticSettings/write",
360387
"Microsoft.Insights/diagnosticSettings/read",
361388
"Microsoft.Resources/deployments/whatIf/action",
362-
"Microsoft.Resources/deployments/write"
389+
"Microsoft.Resources/deployments/write",
390+
"Microsoft.Resources/deploymentStacks/read",
391+
"Microsoft.Resources/deploymentStacks/validate/action"
363392
]
364393
not_actions = []
365394
}
@@ -369,9 +398,7 @@ variable "custom_role_definitions_bicep" {
369398
description = "This is a custom role created by the Azure Landing Zones Accelerator for Writing in platform subscriptions."
370399
permissions = {
371400
actions = [
372-
"*",
373-
"Microsoft.Resources/deployments/whatIf/action",
374-
"Microsoft.Resources/deployments/write"
401+
"*"
375402
]
376403
not_actions = []
377404
}
@@ -393,6 +420,7 @@ variable "custom_role_definitions_bicep" {
393420
"Microsoft.Network/*/write",
394421
"Microsoft.Resources/deployments/whatIf/action",
395422
"Microsoft.Resources/deployments/write",
423+
"Microsoft.Resources/deploymentStacks/read",
396424
"Microsoft.SecurityInsights/onboardingStates/write"
397425
]
398426
not_actions = []

0 commit comments

Comments
 (0)