Skip to content

Commit 6b72d16

Browse files
Prachig-MicrosoftCopilot
Prachig-Microsoft
and
Copilot
committed
infra: add Storage Queue Data Contributor role for backend and processor
Both backend and processor use Azure Queue Storage for processing pipeline. Added storageQueueDataContributor role definition and assignments for both app identities in avm and bicep flavors. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
1 parent 5905349 commit 6b72d16

5 files changed

Lines changed: 159 additions & 13 deletions

File tree

‎infra/avm/main.json‎

Lines changed: 28 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
"_generator": {
77
"name": "bicep",
88
"version": "0.43.8.12551",
9-
"templateHash": "12508925618781201963"
9+
"templateHash": "7007616429319982719"
1010
}
1111
},
1212
"parameters": {
@@ -37802,7 +37802,7 @@
3780237802
"_generator": {
3780337803
"name": "bicep",
3780437804
"version": "0.43.8.12551",
37805-
"templateHash": "2474904975964647902"
37805+
"templateHash": "16400927783398310193"
3780637806
}
3780737807
},
3780837808
"parameters": {
@@ -37895,7 +37895,8 @@
3789537895
"searchIndexDataReader": "1407120a-92aa-4202-b7e9-c0e197c71c8f",
3789637896
"searchServiceContributor": "7ca78c08-252a-4471-8644-bb5ff32d4ba0",
3789737897
"storageBlobDataContributor": "ba92f5b4-2d11-453d-a403-e96b0029c9fe",
37898-
"storageBlobDataReader": "2a2b9908-6ea1-4ae2-8e65-a410df84e7d1"
37898+
"storageBlobDataReader": "2a2b9908-6ea1-4ae2-8e65-a410df84e7d1",
37899+
"storageQueueDataContributor": "974c5e8b-45b9-4653-ba55-5f855dd0fb88"
3789937900
}
3790037901
},
3790137902
"resources": [
@@ -38019,6 +38020,30 @@
3801938020
"principalType": "ServicePrincipal"
3802038021
}
3802138022
},
38023+
{
38024+
"condition": "[and(not(empty(parameters('storageAccountResourceId'))), not(empty(parameters('backendAppServicePrincipalId'))))]",
38025+
"type": "Microsoft.Authorization/roleAssignments",
38026+
"apiVersion": "2022-04-01",
38027+
"scope": "[resourceId('Microsoft.Storage/storageAccounts', last(split(parameters('storageAccountResourceId'), '/')))]",
38028+
"name": "[guid(parameters('solutionName'), resourceId('Microsoft.Storage/storageAccounts', last(split(parameters('storageAccountResourceId'), '/'))), parameters('backendAppServicePrincipalId'), variables('roleDefinitions').storageQueueDataContributor)]",
38029+
"properties": {
38030+
"principalId": "[parameters('backendAppServicePrincipalId')]",
38031+
"roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('roleDefinitions').storageQueueDataContributor)]",
38032+
"principalType": "ServicePrincipal"
38033+
}
38034+
},
38035+
{
38036+
"condition": "[and(not(empty(parameters('storageAccountResourceId'))), not(empty(parameters('processorAppServicePrincipalId'))))]",
38037+
"type": "Microsoft.Authorization/roleAssignments",
38038+
"apiVersion": "2022-04-01",
38039+
"scope": "[resourceId('Microsoft.Storage/storageAccounts', last(split(parameters('storageAccountResourceId'), '/')))]",
38040+
"name": "[guid(parameters('solutionName'), resourceId('Microsoft.Storage/storageAccounts', last(split(parameters('storageAccountResourceId'), '/'))), parameters('processorAppServicePrincipalId'), variables('roleDefinitions').storageQueueDataContributor)]",
38041+
"properties": {
38042+
"principalId": "[parameters('processorAppServicePrincipalId')]",
38043+
"roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('roleDefinitions').storageQueueDataContributor)]",
38044+
"principalType": "ServicePrincipal"
38045+
}
38046+
},
3802238047
{
3802338048
"condition": "[and(not(empty(parameters('cosmosDbAccountName'))), not(empty(parameters('backendAppServicePrincipalId'))))]",
3802438049
"type": "Microsoft.DocumentDB/databaseAccounts/sqlRoleAssignments",

‎infra/avm/modules/identity/role-assignments.bicep‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -65,6 +65,7 @@ var roleDefinitions = {
6565
searchServiceContributor: '7ca78c08-252a-4471-8644-bb5ff32d4ba0'
6666
storageBlobDataContributor: 'ba92f5b4-2d11-453d-a403-e96b0029c9fe'
6767
storageBlobDataReader: '2a2b9908-6ea1-4ae2-8e65-a410df84e7d1'
68+
storageQueueDataContributor: '974c5e8b-45b9-4653-ba55-5f855dd0fb88'
6869
}
6970

7071
// ============================================================================
@@ -241,6 +242,28 @@ resource processorAppStorageContributor 'Microsoft.Authorization/roleAssignments
241242
}
242243
}
243244

245+
// Backend App → Storage Queue Data Contributor
246+
resource backendAppQueueContributor 'Microsoft.Authorization/roleAssignments@2022-04-01' = if (!empty(storageAccountResourceId) && !empty(backendAppServicePrincipalId)) {
247+
name: guid(solutionName, storageAccount.id, backendAppServicePrincipalId, roleDefinitions.storageQueueDataContributor)
248+
scope: storageAccount
249+
properties: {
250+
principalId: backendAppServicePrincipalId
251+
roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', roleDefinitions.storageQueueDataContributor)
252+
principalType: 'ServicePrincipal'
253+
}
254+
}
255+
256+
// Processor App → Storage Queue Data Contributor
257+
resource processorAppQueueContributor 'Microsoft.Authorization/roleAssignments@2022-04-01' = if (!empty(storageAccountResourceId) && !empty(processorAppServicePrincipalId)) {
258+
name: guid(solutionName, storageAccount.id, processorAppServicePrincipalId, roleDefinitions.storageQueueDataContributor)
259+
scope: storageAccount
260+
properties: {
261+
principalId: processorAppServicePrincipalId
262+
roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', roleDefinitions.storageQueueDataContributor)
263+
principalType: 'ServicePrincipal'
264+
}
265+
}
266+
244267
// ============================================================================
245268
// 4. COSMOS DB ROLE ASSIGNMENTS
246269
// Backend and Processor App Service → Cosmos DB (data-plane, uses sqlRoleAssignments)

‎infra/bicep/main.json‎

Lines changed: 28 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@
55
"_generator": {
66
"name": "bicep",
77
"version": "0.43.8.12551",
8-
"templateHash": "8972167897125395354"
8+
"templateHash": "14953942141545849982"
99
}
1010
},
1111
"parameters": {
@@ -2585,7 +2585,7 @@
25852585
"_generator": {
25862586
"name": "bicep",
25872587
"version": "0.43.8.12551",
2588-
"templateHash": "14585030683408144049"
2588+
"templateHash": "17646752023219595785"
25892589
}
25902590
},
25912591
"parameters": {
@@ -2697,7 +2697,8 @@
26972697
"searchIndexDataContributor": "8ebe5a00-799e-43f5-93ac-243d3dce84a7",
26982698
"searchServiceContributor": "7ca78c08-252a-4471-8644-bb5ff32d4ba0",
26992699
"storageBlobDataContributor": "ba92f5b4-2d11-453d-a403-e96b0029c9fe",
2700-
"storageBlobDataReader": "2a2b9908-6ea1-4ae2-8e65-a410df84e7d1"
2700+
"storageBlobDataReader": "2a2b9908-6ea1-4ae2-8e65-a410df84e7d1",
2701+
"storageQueueDataContributor": "974c5e8b-45b9-4653-ba55-5f855dd0fb88"
27012702
}
27022703
},
27032704
"resources": [
@@ -2821,6 +2822,30 @@
28212822
"principalType": "ServicePrincipal"
28222823
}
28232824
},
2825+
{
2826+
"condition": "[and(not(empty(parameters('storageAccountResourceId'))), not(empty(parameters('backendAppServicePrincipalId'))))]",
2827+
"type": "Microsoft.Authorization/roleAssignments",
2828+
"apiVersion": "2022-04-01",
2829+
"scope": "[resourceId('Microsoft.Storage/storageAccounts', last(split(parameters('storageAccountResourceId'), '/')))]",
2830+
"name": "[guid(parameters('solutionName'), resourceId('Microsoft.Storage/storageAccounts', last(split(parameters('storageAccountResourceId'), '/'))), parameters('backendAppServicePrincipalId'), variables('roleDefinitions').storageQueueDataContributor)]",
2831+
"properties": {
2832+
"principalId": "[parameters('backendAppServicePrincipalId')]",
2833+
"roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('roleDefinitions').storageQueueDataContributor)]",
2834+
"principalType": "ServicePrincipal"
2835+
}
2836+
},
2837+
{
2838+
"condition": "[and(not(empty(parameters('storageAccountResourceId'))), not(empty(parameters('processorAppServicePrincipalId'))))]",
2839+
"type": "Microsoft.Authorization/roleAssignments",
2840+
"apiVersion": "2022-04-01",
2841+
"scope": "[resourceId('Microsoft.Storage/storageAccounts', last(split(parameters('storageAccountResourceId'), '/')))]",
2842+
"name": "[guid(parameters('solutionName'), resourceId('Microsoft.Storage/storageAccounts', last(split(parameters('storageAccountResourceId'), '/'))), parameters('processorAppServicePrincipalId'), variables('roleDefinitions').storageQueueDataContributor)]",
2843+
"properties": {
2844+
"principalId": "[parameters('processorAppServicePrincipalId')]",
2845+
"roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('roleDefinitions').storageQueueDataContributor)]",
2846+
"principalType": "ServicePrincipal"
2847+
}
2848+
},
28242849
{
28252850
"condition": "[and(not(empty(parameters('cosmosDbAccountName'))), not(empty(parameters('backendAppServicePrincipalId'))))]",
28262851
"type": "Microsoft.DocumentDB/databaseAccounts/sqlRoleAssignments",

‎infra/bicep/modules/identity/role-assignments.bicep‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -73,6 +73,7 @@ var roleDefinitions = {
7373
searchServiceContributor: '7ca78c08-252a-4471-8644-bb5ff32d4ba0'
7474
storageBlobDataContributor: 'ba92f5b4-2d11-453d-a403-e96b0029c9fe'
7575
storageBlobDataReader: '2a2b9908-6ea1-4ae2-8e65-a410df84e7d1'
76+
storageQueueDataContributor: '974c5e8b-45b9-4653-ba55-5f855dd0fb88'
7677
}
7778

7879
// ============================================================================
@@ -249,6 +250,28 @@ resource processorAppStorageContributor 'Microsoft.Authorization/roleAssignments
249250
}
250251
}
251252

253+
// Backend App → Storage Queue Data Contributor
254+
resource backendAppQueueContributor 'Microsoft.Authorization/roleAssignments@2022-04-01' = if (!empty(storageAccountResourceId) && !empty(backendAppServicePrincipalId)) {
255+
name: guid(solutionName, storageAccount.id, backendAppServicePrincipalId, roleDefinitions.storageQueueDataContributor)
256+
scope: storageAccount
257+
properties: {
258+
principalId: backendAppServicePrincipalId
259+
roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', roleDefinitions.storageQueueDataContributor)
260+
principalType: 'ServicePrincipal'
261+
}
262+
}
263+
264+
// Processor App → Storage Queue Data Contributor
265+
resource processorAppQueueContributor 'Microsoft.Authorization/roleAssignments@2022-04-01' = if (!empty(storageAccountResourceId) && !empty(processorAppServicePrincipalId)) {
266+
name: guid(solutionName, storageAccount.id, processorAppServicePrincipalId, roleDefinitions.storageQueueDataContributor)
267+
scope: storageAccount
268+
properties: {
269+
principalId: processorAppServicePrincipalId
270+
roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', roleDefinitions.storageQueueDataContributor)
271+
principalType: 'ServicePrincipal'
272+
}
273+
}
274+
252275
// ============================================================================
253276
// 4. COSMOS DB ROLE ASSIGNMENTS
254277
// Backend and Processor App Service → Cosmos DB (data-plane, uses sqlRoleAssignments)

‎infra/main.json‎

Lines changed: 57 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
"_generator": {
77
"name": "bicep",
88
"version": "0.43.8.12551",
9-
"templateHash": "17072192055159536703"
9+
"templateHash": "7096588501981615349"
1010
}
1111
},
1212
"parameters": {
@@ -316,7 +316,7 @@
316316
"_generator": {
317317
"name": "bicep",
318318
"version": "0.43.8.12551",
319-
"templateHash": "12508925618781201963"
319+
"templateHash": "7007616429319982719"
320320
}
321321
},
322322
"parameters": {
@@ -38112,7 +38112,7 @@
3811238112
"_generator": {
3811338113
"name": "bicep",
3811438114
"version": "0.43.8.12551",
38115-
"templateHash": "2474904975964647902"
38115+
"templateHash": "16400927783398310193"
3811638116
}
3811738117
},
3811838118
"parameters": {
@@ -38205,7 +38205,8 @@
3820538205
"searchIndexDataReader": "1407120a-92aa-4202-b7e9-c0e197c71c8f",
3820638206
"searchServiceContributor": "7ca78c08-252a-4471-8644-bb5ff32d4ba0",
3820738207
"storageBlobDataContributor": "ba92f5b4-2d11-453d-a403-e96b0029c9fe",
38208-
"storageBlobDataReader": "2a2b9908-6ea1-4ae2-8e65-a410df84e7d1"
38208+
"storageBlobDataReader": "2a2b9908-6ea1-4ae2-8e65-a410df84e7d1",
38209+
"storageQueueDataContributor": "974c5e8b-45b9-4653-ba55-5f855dd0fb88"
3820938210
}
3821038211
},
3821138212
"resources": [
@@ -38329,6 +38330,30 @@
3832938330
"principalType": "ServicePrincipal"
3833038331
}
3833138332
},
38333+
{
38334+
"condition": "[and(not(empty(parameters('storageAccountResourceId'))), not(empty(parameters('backendAppServicePrincipalId'))))]",
38335+
"type": "Microsoft.Authorization/roleAssignments",
38336+
"apiVersion": "2022-04-01",
38337+
"scope": "[resourceId('Microsoft.Storage/storageAccounts', last(split(parameters('storageAccountResourceId'), '/')))]",
38338+
"name": "[guid(parameters('solutionName'), resourceId('Microsoft.Storage/storageAccounts', last(split(parameters('storageAccountResourceId'), '/'))), parameters('backendAppServicePrincipalId'), variables('roleDefinitions').storageQueueDataContributor)]",
38339+
"properties": {
38340+
"principalId": "[parameters('backendAppServicePrincipalId')]",
38341+
"roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('roleDefinitions').storageQueueDataContributor)]",
38342+
"principalType": "ServicePrincipal"
38343+
}
38344+
},
38345+
{
38346+
"condition": "[and(not(empty(parameters('storageAccountResourceId'))), not(empty(parameters('processorAppServicePrincipalId'))))]",
38347+
"type": "Microsoft.Authorization/roleAssignments",
38348+
"apiVersion": "2022-04-01",
38349+
"scope": "[resourceId('Microsoft.Storage/storageAccounts', last(split(parameters('storageAccountResourceId'), '/')))]",
38350+
"name": "[guid(parameters('solutionName'), resourceId('Microsoft.Storage/storageAccounts', last(split(parameters('storageAccountResourceId'), '/'))), parameters('processorAppServicePrincipalId'), variables('roleDefinitions').storageQueueDataContributor)]",
38351+
"properties": {
38352+
"principalId": "[parameters('processorAppServicePrincipalId')]",
38353+
"roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('roleDefinitions').storageQueueDataContributor)]",
38354+
"principalType": "ServicePrincipal"
38355+
}
38356+
},
3833238357
{
3833338358
"condition": "[and(not(empty(parameters('cosmosDbAccountName'))), not(empty(parameters('backendAppServicePrincipalId'))))]",
3833438359
"type": "Microsoft.DocumentDB/databaseAccounts/sqlRoleAssignments",
@@ -38718,7 +38743,7 @@
3871838743
"_generator": {
3871938744
"name": "bicep",
3872038745
"version": "0.43.8.12551",
38721-
"templateHash": "8972167897125395354"
38746+
"templateHash": "14953942141545849982"
3872238747
}
3872338748
},
3872438749
"parameters": {
@@ -41298,7 +41323,7 @@
4129841323
"_generator": {
4129941324
"name": "bicep",
4130041325
"version": "0.43.8.12551",
41301-
"templateHash": "14585030683408144049"
41326+
"templateHash": "17646752023219595785"
4130241327
}
4130341328
},
4130441329
"parameters": {
@@ -41410,7 +41435,8 @@
4141041435
"searchIndexDataContributor": "8ebe5a00-799e-43f5-93ac-243d3dce84a7",
4141141436
"searchServiceContributor": "7ca78c08-252a-4471-8644-bb5ff32d4ba0",
4141241437
"storageBlobDataContributor": "ba92f5b4-2d11-453d-a403-e96b0029c9fe",
41413-
"storageBlobDataReader": "2a2b9908-6ea1-4ae2-8e65-a410df84e7d1"
41438+
"storageBlobDataReader": "2a2b9908-6ea1-4ae2-8e65-a410df84e7d1",
41439+
"storageQueueDataContributor": "974c5e8b-45b9-4653-ba55-5f855dd0fb88"
4141441440
}
4141541441
},
4141641442
"resources": [
@@ -41534,6 +41560,30 @@
4153441560
"principalType": "ServicePrincipal"
4153541561
}
4153641562
},
41563+
{
41564+
"condition": "[and(not(empty(parameters('storageAccountResourceId'))), not(empty(parameters('backendAppServicePrincipalId'))))]",
41565+
"type": "Microsoft.Authorization/roleAssignments",
41566+
"apiVersion": "2022-04-01",
41567+
"scope": "[resourceId('Microsoft.Storage/storageAccounts', last(split(parameters('storageAccountResourceId'), '/')))]",
41568+
"name": "[guid(parameters('solutionName'), resourceId('Microsoft.Storage/storageAccounts', last(split(parameters('storageAccountResourceId'), '/'))), parameters('backendAppServicePrincipalId'), variables('roleDefinitions').storageQueueDataContributor)]",
41569+
"properties": {
41570+
"principalId": "[parameters('backendAppServicePrincipalId')]",
41571+
"roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('roleDefinitions').storageQueueDataContributor)]",
41572+
"principalType": "ServicePrincipal"
41573+
}
41574+
},
41575+
{
41576+
"condition": "[and(not(empty(parameters('storageAccountResourceId'))), not(empty(parameters('processorAppServicePrincipalId'))))]",
41577+
"type": "Microsoft.Authorization/roleAssignments",
41578+
"apiVersion": "2022-04-01",
41579+
"scope": "[resourceId('Microsoft.Storage/storageAccounts', last(split(parameters('storageAccountResourceId'), '/')))]",
41580+
"name": "[guid(parameters('solutionName'), resourceId('Microsoft.Storage/storageAccounts', last(split(parameters('storageAccountResourceId'), '/'))), parameters('processorAppServicePrincipalId'), variables('roleDefinitions').storageQueueDataContributor)]",
41581+
"properties": {
41582+
"principalId": "[parameters('processorAppServicePrincipalId')]",
41583+
"roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('roleDefinitions').storageQueueDataContributor)]",
41584+
"principalType": "ServicePrincipal"
41585+
}
41586+
},
4153741587
{
4153841588
"condition": "[and(not(empty(parameters('cosmosDbAccountName'))), not(empty(parameters('backendAppServicePrincipalId'))))]",
4153941589
"type": "Microsoft.DocumentDB/databaseAccounts/sqlRoleAssignments",

0 commit comments

Comments
 (0)