Skip to content

Commit fccbb15

Browse files
jtracey93jtracey93
authored
feat: update alz custom roles (#117)
* remove ARM deployment and stacks from TF * refine roles
1 parent f0304df commit fccbb15

3 files changed

Lines changed: 84 additions & 216 deletions

File tree

‎alz/azuredevops/variables.tf‎

Lines changed: 28 additions & 72 deletions
Original file line numberDiff line numberDiff line change
@@ -384,7 +384,7 @@ variable "custom_role_definitions_terraform" {
384384
})
385385
}))
386386
default = {
387-
alz_managment_group_contributor = {
387+
alz_management_group_contributor = {
388388
name = "Azure Landing Zones Management Group Contributor ({{service_name}}-{{environment_name}})"
389389
description = "This is a custom role created by the Azure Landing Zones Accelerator for Writing the Management Group Structure."
390390
permissions = {
@@ -403,23 +403,14 @@ variable "custom_role_definitions_terraform" {
403403
"Microsoft.Authorization/policyAssignments/write",
404404
"Microsoft.Authorization/roleDefinitions/write",
405405
"Microsoft.Authorization/*/read",
406-
"Microsoft.Resources/deployments/whatIf/action",
407-
"Microsoft.Resources/deployments/write",
408-
"Microsoft.Resources/deployments/validate/action",
409-
"Microsoft.Resources/deployments/read",
410-
"Microsoft.Resources/deployments/operationStatuses/read",
411-
"Microsoft.Resources/deploymentStacks/read",
412-
"Microsoft.Resources/deploymentStacks/write",
413-
"Microsoft.Resources/deploymentStacks/delete",
414-
"Microsoft.Resources/deploymentStacks/validate/action",
415406
"Microsoft.Authorization/roleAssignments/write",
416407
"Microsoft.Authorization/roleAssignments/delete",
417408
"Microsoft.Insights/diagnosticSettings/write"
418409
]
419410
not_actions = []
420411
}
421412
}
422-
alz_managment_group_reader = {
413+
alz_management_group_reader = {
423414
name = "Azure Landing Zones Management Group Reader ({{service_name}}-{{environment_name}})"
424415
description = "This is a custom role created by the Azure Landing Zones Accelerator for Reading the Management Group Structure."
425416
permissions = {
@@ -488,60 +479,34 @@ variable "custom_role_definitions_bicep" {
488479
})
489480
}))
490481
default = {
491-
alz_managment_group_contributor = {
482+
alz_management_group_contributor = {
492483
name = "Azure Landing Zones Management Group Contributor ({{service_name}}-{{environment_name}})"
493-
description = "This is a custom role created by the Azure Landing Zones Accelerator for Writing the Management Group Structure."
484+
description = "This is a custom role created by the Azure Landing Zones Accelerator for creating and managing the Management Group hierarchy and its associated governance resources such as policy, RBAC etc..."
494485
permissions = {
495486
actions = [
496-
"Microsoft.Management/managementGroups/delete",
497-
"Microsoft.Management/managementGroups/read",
498-
"Microsoft.Management/managementGroups/subscriptions/delete",
499-
"Microsoft.Management/managementGroups/subscriptions/write",
500-
"Microsoft.Management/managementGroups/settings/read",
501-
"Microsoft.Management/managementGroups/settings/write",
502-
"Microsoft.Management/managementGroups/settings/delete",
503-
"Microsoft.Management/managementGroups/write",
504-
"Microsoft.Management/managementGroups/subscriptions/read",
505-
"Microsoft.Authorization/policyDefinitions/write",
506-
"Microsoft.Authorization/policySetDefinitions/write",
507-
"Microsoft.Authorization/policyAssignments/write",
508-
"Microsoft.Authorization/roleDefinitions/write",
509-
"Microsoft.Authorization/*/read",
510-
"Microsoft.Resources/deployments/whatIf/action",
511-
"Microsoft.Resources/deployments/write",
512-
"Microsoft.Resources/deployments/validate/action",
513-
"Microsoft.Resources/deployments/read",
514-
"Microsoft.Resources/deployments/operationStatuses/read",
515-
"Microsoft.Resources/deploymentStacks/read",
516-
"Microsoft.Resources/deploymentStacks/write",
517-
"Microsoft.Resources/deploymentStacks/delete",
518-
"Microsoft.Resources/deploymentStacks/validate/action",
519-
"Microsoft.Authorization/roleAssignments/write",
520-
"Microsoft.Authorization/roleAssignments/delete",
521-
"Microsoft.Insights/diagnosticSettings/write"
487+
"*/read",
488+
"Microsoft.Management/*",
489+
"Microsoft.Authorization/*",
490+
"Microsoft.Resources/*",
491+
"Microsoft.Support/*",
492+
"Microsoft.Insights/diagnosticSettings/*"
493+
]
494+
not_actions = [
495+
"Microsoft.Resources/subscriptions/resourceGroups/write",
496+
"Microsoft.Resources/subscriptions/resourceGroups/delete"
522497
]
523-
not_actions = []
524498
}
525499
}
526-
alz_managment_group_reader = {
500+
alz_management_group_reader = {
527501
name = "Azure Landing Zones Management Group What If ({{service_name}}-{{environment_name}})"
528-
description = "This is a custom role created by the Azure Landing Zones Accelerator for running Bicep What If for the Management Group Structure."
502+
description = "This is a custom role created by the Azure Landing Zones Accelerator for running Bicep What If for the Management Group hierarchy and its associated governance resources such as policy, RBAC etc... You must use the `--validation-level providerNoRbac` (Az CLI 2.75.0 or later) or `-ValidationLevel providerNoRbac` (Az PowerShell 13.4.0 or later (Az.Resources 7.10.0 or later)) flag when running Bicep What If with this role."
529503
permissions = {
530504
actions = [
531-
"Microsoft.Management/managementGroups/read",
532-
"Microsoft.Management/managementGroups/subscriptions/read",
533-
"Microsoft.Management/managementGroups/settings/read",
534-
"Microsoft.Authorization/*/read",
535-
"Microsoft.Authorization/policyDefinitions/write",
536-
"Microsoft.Authorization/policySetDefinitions/write",
537-
"Microsoft.Authorization/roleDefinitions/write",
538-
"Microsoft.Authorization/policyAssignments/write",
539-
"Microsoft.Insights/diagnosticSettings/write",
540-
"Microsoft.Insights/diagnosticSettings/read",
505+
"*/read",
541506
"Microsoft.Resources/deployments/whatIf/action",
542-
"Microsoft.Resources/deployments/write",
543-
"Microsoft.Resources/deploymentStacks/read",
544-
"Microsoft.Resources/deploymentStacks/validate/action"
507+
"Microsoft.Resources/deployments/validate/action",
508+
"Microsoft.Resources/subscriptions/operationResults/read",
509+
"Microsoft.Management/operationResults/*/read"
545510
]
546511
not_actions = []
547512
}
@@ -558,23 +523,14 @@ variable "custom_role_definitions_bicep" {
558523
}
559524
alz_subscription_reader = {
560525
name = "Azure Landing Zones Subscription What If ({{service_name}}-{{environment_name}})"
561-
description = "This is a custom role created by the Azure Landing Zones Accelerator for running Bicep What If for the platform subscriptions."
526+
description = "This is a custom role created by the Azure Landing Zones Accelerator for running Bicep What If for the Management Group hierarchy and its associated governance resources such as policy, RBAC etc... You must use the `--validation-level providerNoRbac` (Az CLI 2.75.0 or later) or `-ValidationLevel providerNoRbac` (Az PowerShell 13.4.0 or later (Az.Resources 7.10.0 or later)) flag when running Bicep What If with this role."
562527
permissions = {
563528
actions = [
564529
"*/read",
565-
"Microsoft.Resources/subscriptions/resourceGroups/write",
566-
"Microsoft.ManagedIdentity/userAssignedIdentities/write",
567-
"Microsoft.Automation/automationAccounts/write",
568-
"Microsoft.OperationalInsights/workspaces/write",
569-
"Microsoft.OperationalInsights/workspaces/linkedServices/write",
570-
"Microsoft.OperationsManagement/solutions/write",
571-
"Microsoft.Insights/dataCollectionRules/write",
572-
"Microsoft.Authorization/locks/write",
573-
"Microsoft.Network/*/write",
574530
"Microsoft.Resources/deployments/whatIf/action",
575-
"Microsoft.Resources/deployments/write",
576-
"Microsoft.Resources/deploymentStacks/read",
577-
"Microsoft.SecurityInsights/onboardingStates/write"
531+
"Microsoft.Resources/deployments/validate/action",
532+
"Microsoft.Resources/subscriptions/operationResults/read",
533+
"Microsoft.Management/operationResults/*/read"
578534
]
579535
not_actions = []
580536
}
@@ -591,12 +547,12 @@ variable "role_assignments_terraform" {
591547
}))
592548
default = {
593549
plan_management_group = {
594-
custom_role_definition_key = "alz_managment_group_reader"
550+
custom_role_definition_key = "alz_management_group_reader"
595551
user_assigned_managed_identity_key = "plan"
596552
scope = "management_group"
597553
}
598554
apply_management_group = {
599-
custom_role_definition_key = "alz_managment_group_contributor"
555+
custom_role_definition_key = "alz_management_group_contributor"
600556
user_assigned_managed_identity_key = "apply"
601557
scope = "management_group"
602558
}
@@ -622,12 +578,12 @@ variable "role_assignments_bicep" {
622578
}))
623579
default = {
624580
plan_management_group = {
625-
custom_role_definition_key = "alz_managment_group_reader"
581+
custom_role_definition_key = "alz_management_group_reader"
626582
user_assigned_managed_identity_key = "plan"
627583
scope = "management_group"
628584
}
629585
apply_management_group = {
630-
custom_role_definition_key = "alz_managment_group_contributor"
586+
custom_role_definition_key = "alz_management_group_contributor"
631587
user_assigned_managed_identity_key = "apply"
632588
scope = "management_group"
633589
}

‎alz/github/variables.tf‎

Lines changed: 28 additions & 72 deletions
Original file line numberDiff line numberDiff line change
@@ -419,7 +419,7 @@ variable "custom_role_definitions_terraform" {
419419
})
420420
}))
421421
default = {
422-
alz_managment_group_contributor = {
422+
alz_management_group_contributor = {
423423
name = "Azure Landing Zones Management Group Contributor ({{service_name}}-{{environment_name}})"
424424
description = "This is a custom role created by the Azure Landing Zones Accelerator for Writing the Management Group Structure."
425425
permissions = {
@@ -438,23 +438,14 @@ variable "custom_role_definitions_terraform" {
438438
"Microsoft.Authorization/policyAssignments/write",
439439
"Microsoft.Authorization/roleDefinitions/write",
440440
"Microsoft.Authorization/*/read",
441-
"Microsoft.Resources/deployments/whatIf/action",
442-
"Microsoft.Resources/deployments/write",
443-
"Microsoft.Resources/deployments/validate/action",
444-
"Microsoft.Resources/deployments/read",
445-
"Microsoft.Resources/deployments/operationStatuses/read",
446-
"Microsoft.Resources/deploymentStacks/read",
447-
"Microsoft.Resources/deploymentStacks/write",
448-
"Microsoft.Resources/deploymentStacks/delete",
449-
"Microsoft.Resources/deploymentStacks/validate/action",
450441
"Microsoft.Authorization/roleAssignments/write",
451442
"Microsoft.Authorization/roleAssignments/delete",
452443
"Microsoft.Insights/diagnosticSettings/write"
453444
]
454445
not_actions = []
455446
}
456447
}
457-
alz_managment_group_reader = {
448+
alz_management_group_reader = {
458449
name = "Azure Landing Zones Management Group Reader ({{service_name}}-{{environment_name}})"
459450
description = "This is a custom role created by the Azure Landing Zones Accelerator for Reading the Management Group Structure."
460451
permissions = {
@@ -523,60 +514,34 @@ variable "custom_role_definitions_bicep" {
523514
})
524515
}))
525516
default = {
526-
alz_managment_group_contributor = {
517+
alz_management_group_contributor = {
527518
name = "Azure Landing Zones Management Group Contributor ({{service_name}}-{{environment_name}})"
528-
description = "This is a custom role created by the Azure Landing Zones Accelerator for Writing the Management Group Structure."
519+
description = "This is a custom role created by the Azure Landing Zones Accelerator for creating and managing the Management Group hierarchy and its associated governance resources such as policy, RBAC etc..."
529520
permissions = {
530521
actions = [
531-
"Microsoft.Management/managementGroups/delete",
532-
"Microsoft.Management/managementGroups/read",
533-
"Microsoft.Management/managementGroups/subscriptions/delete",
534-
"Microsoft.Management/managementGroups/subscriptions/write",
535-
"Microsoft.Management/managementGroups/settings/read",
536-
"Microsoft.Management/managementGroups/settings/write",
537-
"Microsoft.Management/managementGroups/settings/delete",
538-
"Microsoft.Management/managementGroups/write",
539-
"Microsoft.Management/managementGroups/subscriptions/read",
540-
"Microsoft.Authorization/policyDefinitions/write",
541-
"Microsoft.Authorization/policySetDefinitions/write",
542-
"Microsoft.Authorization/policyAssignments/write",
543-
"Microsoft.Authorization/roleDefinitions/write",
544-
"Microsoft.Authorization/*/read",
545-
"Microsoft.Resources/deployments/whatIf/action",
546-
"Microsoft.Resources/deployments/write",
547-
"Microsoft.Resources/deployments/validate/action",
548-
"Microsoft.Resources/deployments/read",
549-
"Microsoft.Resources/deployments/operationStatuses/read",
550-
"Microsoft.Resources/deploymentStacks/read",
551-
"Microsoft.Resources/deploymentStacks/write",
552-
"Microsoft.Resources/deploymentStacks/delete",
553-
"Microsoft.Resources/deploymentStacks/validate/action",
554-
"Microsoft.Authorization/roleAssignments/write",
555-
"Microsoft.Authorization/roleAssignments/delete",
556-
"Microsoft.Insights/diagnosticSettings/write"
522+
"*/read",
523+
"Microsoft.Management/*",
524+
"Microsoft.Authorization/*",
525+
"Microsoft.Resources/*",
526+
"Microsoft.Support/*",
527+
"Microsoft.Insights/diagnosticSettings/*"
528+
]
529+
not_actions = [
530+
"Microsoft.Resources/subscriptions/resourceGroups/write",
531+
"Microsoft.Resources/subscriptions/resourceGroups/delete"
557532
]
558-
not_actions = []
559533
}
560534
}
561-
alz_managment_group_reader = {
535+
alz_management_group_reader = {
562536
name = "Azure Landing Zones Management Group What If ({{service_name}}-{{environment_name}})"
563-
description = "This is a custom role created by the Azure Landing Zones Accelerator for running Bicep What If for the Management Group Structure."
537+
description = "This is a custom role created by the Azure Landing Zones Accelerator for running Bicep What If for the Management Group hierarchy and its associated governance resources such as policy, RBAC etc... You must use the `--validation-level providerNoRbac` (Az CLI 2.75.0 or later) or `-ValidationLevel providerNoRbac` (Az PowerShell 13.4.0 or later (Az.Resources 7.10.0 or later)) flag when running Bicep What If with this role."
564538
permissions = {
565539
actions = [
566-
"Microsoft.Management/managementGroups/read",
567-
"Microsoft.Management/managementGroups/subscriptions/read",
568-
"Microsoft.Management/managementGroups/settings/read",
569-
"Microsoft.Authorization/*/read",
570-
"Microsoft.Authorization/policyDefinitions/write",
571-
"Microsoft.Authorization/policySetDefinitions/write",
572-
"Microsoft.Authorization/roleDefinitions/write",
573-
"Microsoft.Authorization/policyAssignments/write",
574-
"Microsoft.Insights/diagnosticSettings/write",
575-
"Microsoft.Insights/diagnosticSettings/read",
540+
"*/read",
576541
"Microsoft.Resources/deployments/whatIf/action",
577-
"Microsoft.Resources/deployments/write",
578-
"Microsoft.Resources/deploymentStacks/read",
579-
"Microsoft.Resources/deploymentStacks/validate/action"
542+
"Microsoft.Resources/deployments/validate/action",
543+
"Microsoft.Resources/subscriptions/operationResults/read",
544+
"Microsoft.Management/operationResults/*/read"
580545
]
581546
not_actions = []
582547
}
@@ -593,23 +558,14 @@ variable "custom_role_definitions_bicep" {
593558
}
594559
alz_subscription_reader = {
595560
name = "Azure Landing Zones Subscription What If ({{service_name}}-{{environment_name}})"
596-
description = "This is a custom role created by the Azure Landing Zones Accelerator for running Bicep What If for the platform subscriptions."
561+
description = "This is a custom role created by the Azure Landing Zones Accelerator for running Bicep What If for the Management Group hierarchy and its associated governance resources such as policy, RBAC etc... You must use the `--validation-level providerNoRbac` (Az CLI 2.75.0 or later) or `-ValidationLevel providerNoRbac` (Az PowerShell 13.4.0 or later (Az.Resources 7.10.0 or later)) flag when running Bicep What If with this role."
597562
permissions = {
598563
actions = [
599564
"*/read",
600-
"Microsoft.Resources/subscriptions/resourceGroups/write",
601-
"Microsoft.ManagedIdentity/userAssignedIdentities/write",
602-
"Microsoft.Automation/automationAccounts/write",
603-
"Microsoft.OperationalInsights/workspaces/write",
604-
"Microsoft.OperationalInsights/workspaces/linkedServices/write",
605-
"Microsoft.OperationsManagement/solutions/write",
606-
"Microsoft.Insights/dataCollectionRules/write",
607-
"Microsoft.Authorization/locks/write",
608-
"Microsoft.Network/*/write",
609565
"Microsoft.Resources/deployments/whatIf/action",
610-
"Microsoft.Resources/deployments/write",
611-
"Microsoft.Resources/deploymentStacks/read",
612-
"Microsoft.SecurityInsights/onboardingStates/write"
566+
"Microsoft.Resources/deployments/validate/action",
567+
"Microsoft.Resources/subscriptions/operationResults/read",
568+
"Microsoft.Management/operationResults/*/read"
613569
]
614570
not_actions = []
615571
}
@@ -626,12 +582,12 @@ variable "role_assignments_terraform" {
626582
}))
627583
default = {
628584
plan_management_group = {
629-
custom_role_definition_key = "alz_managment_group_reader"
585+
custom_role_definition_key = "alz_management_group_reader"
630586
user_assigned_managed_identity_key = "plan"
631587
scope = "management_group"
632588
}
633589
apply_management_group = {
634-
custom_role_definition_key = "alz_managment_group_contributor"
590+
custom_role_definition_key = "alz_management_group_contributor"
635591
user_assigned_managed_identity_key = "apply"
636592
scope = "management_group"
637593
}
@@ -657,12 +613,12 @@ variable "role_assignments_bicep" {
657613
}))
658614
default = {
659615
plan_management_group = {
660-
custom_role_definition_key = "alz_managment_group_reader"
616+
custom_role_definition_key = "alz_management_group_reader"
661617
user_assigned_managed_identity_key = "plan"
662618
scope = "management_group"
663619
}
664620
apply_management_group = {
665-
custom_role_definition_key = "alz_managment_group_contributor"
621+
custom_role_definition_key = "alz_management_group_contributor"
666622
user_assigned_managed_identity_key = "apply"
667623
scope = "management_group"
668624
}

0 commit comments

Comments
 (0)