Skip to content

Commit 3a47400

Browse files
oZakarioZakari
committed
Align permissiosn with github
1 parent 300beaa commit 3a47400

4 files changed

Lines changed: 78 additions & 25 deletions

File tree

‎alz/azuredevops/pipelines/bicep-avm/templates/cd-template.yaml‎

Lines changed: 18 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -57,21 +57,21 @@ stages:
5757
azurePowerShellVersion: LatestVersion
5858
ScriptType: "InlineScript"
5959
Inline: |
60-
$managementGroupId = "$$(MANAGEMENT_GROUP_ID)"
61-
$intRootMgId = "$$managementGroupId-int-root"
60+
$managementGroupId = $env:MANAGEMENT_GROUP_ID
61+
$intRootMgId = "$managementGroupId-int-root"
6262
$managementGroups = Get-AzManagementGroup
63-
$intRootMg = $$managementGroups | Where-Object { $$.Name -eq $$intRootMgId }
63+
$intRootMg = $managementGroups | Where-Object { $_.Name -eq $intRootMgId }
6464
65-
$firstDeployment = $$true
65+
$firstDeployment = $true
6666
67-
if($$intRootMg -eq $$null) {
68-
Write-Warning "Cannot find the $$intRootMgId Management Group, so assuming this is the first deployment. We must skip what-if for some deployments since their dependent resources do not exist yet."
67+
if($intRootMg -eq $null) {
68+
Write-Warning "Cannot find the $intRootMgId Management Group, so assuming this is the first deployment. We must skip what-if for some deployments since their dependent resources do not exist yet."
6969
} else {
70-
Write-Host "Found the $$intRootMgId Management Group, so assuming this is not the first deployment."
71-
$$firstDeployment = $$false
70+
Write-Host "Found the $intRootMgId Management Group, so assuming this is not the first deployment."
71+
$firstDeployment = $false
7272
}
7373
74-
Write-Host "##vso[task.setvariable variable=FIRST_DEPLOYMENT;]$$firstDeployment"
74+
Write-Host "##vso[task.setvariable variable=FIRST_DEPLOYMENT;]$firstDeployment"
7575
7676
- template: ./helpers/bicep-avm-installer.yaml
7777
parameters:
@@ -155,21 +155,21 @@ stages:
155155
azurePowerShellVersion: LatestVersion
156156
ScriptType: "InlineScript"
157157
Inline: |
158-
$managementGroupId = "$$(MANAGEMENT_GROUP_ID)"
159-
$intRootMgId = "$$managementGroupId-int-root"
158+
$managementGroupId = $env:MANAGEMENT_GROUP_ID
159+
$intRootMgId = "$managementGroupId-int-root"
160160
$managementGroups = Get-AzManagementGroup
161-
$intRootMg = $$managementGroups | Where-Object { $$.Name -eq $$intRootMgId }
161+
$intRootMg = $managementGroups | Where-Object { $_.Name -eq $intRootMgId }
162162
163-
$firstDeployment = $$true
163+
$firstDeployment = $true
164164
165-
if($$intRootMg -eq $$null) {
166-
Write-Warning "Cannot find the $$intRootMgId Management Group, so assuming this is the first deployment."
165+
if($intRootMg -eq $null) {
166+
Write-Warning "Cannot find the $intRootMgId Management Group, so assuming this is the first deployment."
167167
} else {
168-
Write-Host "Found the $$intRootMgId Management Group, so assuming this is not the first deployment."
169-
$$firstDeployment = $$false
168+
Write-Host "Found the $intRootMgId Management Group, so assuming this is not the first deployment."
169+
$firstDeployment = $false
170170
}
171171
172-
Write-Host "##vso[task.setvariable variable=FIRST_DEPLOYMENT;]$$firstDeployment"
172+
Write-Host "##vso[task.setvariable variable=FIRST_DEPLOYMENT;]$firstDeployment"
173173
174174
- template: ./helpers/bicep-avm-installer.yaml
175175
parameters:

‎alz/azuredevops/pipelines/bicep-avm/templates/ci-template.yaml‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -65,6 +65,30 @@ stages:
6565
parameters:
6666
parametersFileName: $(PARAMETERS_FILE_NAME)
6767

68+
- task: AzurePowerShell@5
69+
displayName: 'Check for First Deployment'
70+
inputs:
71+
azureSubscription: '${service_connection_name_plan}'
72+
pwsh: true
73+
azurePowerShellVersion: LatestVersion
74+
ScriptType: "InlineScript"
75+
Inline: |
76+
$managementGroupId = $env:MANAGEMENT_GROUP_ID
77+
$intRootMgId = "$managementGroupId-int-root"
78+
$managementGroups = Get-AzManagementGroup
79+
$intRootMg = $managementGroups | Where-Object { $_.Name -eq $intRootMgId }
80+
81+
$firstDeployment = $true
82+
83+
if($intRootMg -eq $null) {
84+
Write-Warning "Cannot find the $intRootMgId Management Group, so assuming this is the first deployment. We must skip what-if for some deployments since their dependent resources do not exist yet."
85+
} else {
86+
Write-Host "Found the $intRootMgId Management Group, so assuming this is not the first deployment."
87+
$firstDeployment = $false
88+
}
89+
90+
Write-Host "##vso[task.setvariable variable=FIRST_DEPLOYMENT;]$firstDeployment"
91+
6892
- template: ./helpers/bicep-avm-installer.yaml
6993
parameters:
7094
serviceConnection: '${service_connection_name_plan}'

‎alz/azuredevops/pipelines/bicep-avm/templates/helpers/bicep-avm-deploy.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,7 @@ steps:
4141
ScriptType: 'InlineScript'
4242
Inline: |
4343
$deploymentType = "$${{ parameters.deploymentType }}"
44-
$whatIfEnabled = $${{ parameters.whatIfEnabled }}
44+
$whatIfEnabled = [System.Convert]::ToBoolean("$${{ parameters.whatIfEnabled }}")
4545
4646
# Check if we should skip what-if for first deployment
4747
$firstDeploymentString = $env:FIRST_DEPLOYMENT

‎alz/azuredevops/variables.tf‎

Lines changed: 35 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -414,18 +414,25 @@ variable "custom_role_definitions_terraform" {
414414
"Microsoft.Management/managementGroups/read",
415415
"Microsoft.Management/managementGroups/subscriptions/delete",
416416
"Microsoft.Management/managementGroups/subscriptions/write",
417-
"Microsoft.Management/managementGroups/write",
418-
"Microsoft.Management/managementGroups/subscriptions/read",
419417
"Microsoft.Management/managementGroups/settings/read",
420418
"Microsoft.Management/managementGroups/settings/write",
421419
"Microsoft.Management/managementGroups/settings/delete",
420+
"Microsoft.Management/managementGroups/write",
421+
"Microsoft.Management/managementGroups/subscriptions/read",
422422
"Microsoft.Authorization/policyDefinitions/write",
423423
"Microsoft.Authorization/policySetDefinitions/write",
424424
"Microsoft.Authorization/policyAssignments/write",
425425
"Microsoft.Authorization/roleDefinitions/write",
426426
"Microsoft.Authorization/*/read",
427+
"Microsoft.Resources/deployments/whatIf/action",
427428
"Microsoft.Resources/deployments/write",
428-
"Microsoft.Resources/deployments/exportTemplate/action",
429+
"Microsoft.Resources/deployments/validate/action",
430+
"Microsoft.Resources/deployments/read",
431+
"Microsoft.Resources/deployments/operationStatuses/read",
432+
"Microsoft.Resources/deploymentStacks/read",
433+
"Microsoft.Resources/deploymentStacks/write",
434+
"Microsoft.Resources/deploymentStacks/delete",
435+
"Microsoft.Resources/deploymentStacks/validate/action",
429436
"Microsoft.Authorization/roleAssignments/write",
430437
"Microsoft.Authorization/roleAssignments/delete",
431438
"Microsoft.Insights/diagnosticSettings/write"
@@ -442,8 +449,16 @@ variable "custom_role_definitions_terraform" {
442449
"Microsoft.Management/managementGroups/subscriptions/read",
443450
"Microsoft.Management/managementGroups/settings/read",
444451
"Microsoft.Authorization/*/read",
452+
"Microsoft.Authorization/policyDefinitions/write",
453+
"Microsoft.Authorization/policySetDefinitions/write",
454+
"Microsoft.Authorization/roleDefinitions/write",
455+
"Microsoft.Authorization/policyAssignments/write",
456+
"Microsoft.Insights/diagnosticSettings/write",
457+
"Microsoft.Insights/diagnosticSettings/read",
458+
"Microsoft.Resources/deployments/whatIf/action",
445459
"Microsoft.Resources/deployments/write",
446-
"Microsoft.Resources/deployments/exportTemplate/action"
460+
"Microsoft.Resources/deploymentStacks/read",
461+
"Microsoft.Resources/deploymentStacks/validate/action"
447462
]
448463
not_actions = []
449464
}
@@ -454,8 +469,12 @@ variable "custom_role_definitions_terraform" {
454469
permissions = {
455470
actions = [
456471
"*",
472+
"Microsoft.Resources/deployments/whatIf/action",
457473
"Microsoft.Resources/deployments/write",
458-
"Microsoft.Resources/deployments/exportTemplate/action"
474+
"Microsoft.Resources/deploymentStacks/read",
475+
"Microsoft.Resources/deploymentStacks/write",
476+
"Microsoft.Resources/deploymentStacks/delete",
477+
"Microsoft.Resources/deploymentStacks/validate/action"
459478
]
460479
not_actions = []
461480
}
@@ -466,8 +485,18 @@ variable "custom_role_definitions_terraform" {
466485
permissions = {
467486
actions = [
468487
"*/read",
488+
"Microsoft.Resources/subscriptions/resourceGroups/write",
489+
"Microsoft.ManagedIdentity/userAssignedIdentities/write",
490+
"Microsoft.Automation/automationAccounts/write",
491+
"Microsoft.OperationalInsights/workspaces/write",
492+
"Microsoft.OperationalInsights/workspaces/linkedServices/write",
493+
"Microsoft.OperationsManagement/solutions/write",
494+
"Microsoft.Insights/dataCollectionRules/write",
495+
"Microsoft.Authorization/locks/write",
496+
"Microsoft.Network/*/write",
497+
"Microsoft.Resources/deployments/whatIf/action",
469498
"Microsoft.Resources/deployments/write",
470-
"Microsoft.Resources/deployments/exportTemplate/action"
499+
"Microsoft.SecurityInsights/onboardingStates/write"
471500
]
472501
not_actions = []
473502
}

0 commit comments

Comments
 (0)