Move Entra ID admin provisioning from Bicep to Azure CLI for zero-secret PostgreSQL setup

Author: tjementum

.github/workflows/_deploy-infrastructure.yml

@@ -161,6 +161,9 @@ jobs:
       - name: Install PostgreSQL Client
         run: sudo apt-get update && sudo apt-get install -y postgresql-client
 
+      - name: Add PostgreSQL Admin
+        run: bash ./cloud-infrastructure/cluster/add-postgres-admin.sh ${{ inputs.unique_prefix }} ${{ inputs.azure_environment }} ${{ inputs.cluster_location_acronym }} ${{ inputs.db_admin_object_id }}
+
       - name: Grant Database Permissions
         run: |
           bash ./cloud-infrastructure/cluster/grant-database-permissions.sh ${{ inputs.unique_prefix }} ${{ inputs.azure_environment }} ${{ inputs.cluster_location_acronym }} 'account' ${{ steps.deploy_cluster.outputs.ACCOUNT_IDENTITY_CLIENT_ID }}

cloud-infrastructure/cluster/add-postgres-admin.sh

@@ -0,0 +1,16 @@
+UNIQUE_PREFIX=$1
+ENVIRONMENT=$2
+CLUSTER_LOCATION_ACRONYM=$3
+DB_ADMIN_OBJECT_ID=$4
+
+CLUSTER_RESOURCE_GROUP_NAME=$UNIQUE_PREFIX-$ENVIRONMENT-$CLUSTER_LOCATION_ACRONYM
+POSTGRES_SERVER_NAME=$CLUSTER_RESOURCE_GROUP_NAME
+
+echo "$(date +"%Y-%m-%dT%H:%M:%S") Adding Entra ID group $DB_ADMIN_OBJECT_ID as admin on PostgreSQL server $POSTGRES_SERVER_NAME"
+
+az postgres flexible-server microsoft-entra-admin create \
+  --resource-group $CLUSTER_RESOURCE_GROUP_NAME \
+  --server-name $POSTGRES_SERVER_NAME \
+  --display-name "Database Admins" \
+  --object-id $DB_ADMIN_OBJECT_ID \
+  --type Group

cloud-infrastructure/cluster/deploy-cluster.sh

@@ -29,7 +29,6 @@ export UNIQUE_PREFIX
 export ENVIRONMENT
 export LOCATION=$CLUSTER_LOCATION
 export DOMAIN_NAME
-export DB_ADMIN_OBJECT_ID
 export GOOGLE_OAUTH_CLIENT_ID
 export GOOGLE_OAUTH_CLIENT_SECRET
 export STRIPE_PUBLISHABLE_KEY
@@ -106,6 +105,7 @@ then
     echo "BACK_OFFICE_IDENTITY_CLIENT_ID=$BACK_OFFICE_IDENTITY_CLIENT_ID" >> $GITHUB_OUTPUT
     echo "MAIN_IDENTITY_CLIENT_ID=$MAIN_IDENTITY_CLIENT_ID" >> $GITHUB_OUTPUT
   else
+    . ./add-postgres-admin.sh $UNIQUE_PREFIX $ENVIRONMENT $CLUSTER_LOCATION_ACRONYM $DB_ADMIN_OBJECT_ID
     . ./grant-database-permissions.sh $UNIQUE_PREFIX $ENVIRONMENT $CLUSTER_LOCATION_ACRONYM 'account' $ACCOUNT_IDENTITY_CLIENT_ID
     . ./grant-database-permissions.sh $UNIQUE_PREFIX $ENVIRONMENT $CLUSTER_LOCATION_ACRONYM 'back-office' $BACK_OFFICE_IDENTITY_CLIENT_ID
     . ./grant-database-permissions.sh $UNIQUE_PREFIX $ENVIRONMENT $CLUSTER_LOCATION_ACRONYM 'main' $MAIN_IDENTITY_CLIENT_ID

cloud-infrastructure/cluster/main-cluster.bicep

@@ -6,7 +6,6 @@ param globalResourceGroupName string
 param environment string
 param containerRegistryName string
 param domainName string
-param dbAdminObjectId string
 param appGatewayVersion string
 param accountVersion string
 param backOfficeVersion string
@@ -151,7 +150,6 @@ module postgresServer '../modules/postgresql-flexible-server.bicep' = {
     name: clusterResourceGroupName
     tags: tags
     tenantId: subscription().tenantId
-    dbAdminObjectId: dbAdminObjectId
   }
 }
 

cloud-infrastructure/cluster/main-cluster.bicepparam

@@ -7,7 +7,6 @@ param globalResourceGroupName = readEnvironmentVariable('GLOBAL_RESOURCE_GROUP_N
 param environment = readEnvironmentVariable('ENVIRONMENT')
 param containerRegistryName = readEnvironmentVariable('CONTAINER_REGISTRY_NAME')
 param domainName = readEnvironmentVariable('DOMAIN_NAME', '')
-param dbAdminObjectId = readEnvironmentVariable('DB_ADMIN_OBJECT_ID')
 param appGatewayVersion = readEnvironmentVariable('APP_GATEWAY_VERSION')
 param accountVersion = readEnvironmentVariable('ACCOUNT_VERSION')
 param backOfficeVersion = readEnvironmentVariable('BACK_OFFICE_VERSION')

cloud-infrastructure/modules/postgresql-flexible-server.bicep

@@ -2,15 +2,11 @@ param name string
 param location string
 param tags object
 param tenantId string
-param dbAdminObjectId string
 
 resource postgresServer 'Microsoft.DBforPostgreSQL/flexibleServers@2025-08-01' = {
   name: name
   location: location
   tags: tags
-  identity: {
-    type: 'SystemAssigned'
-  }
   sku: {
     name: 'Standard_B1ms'
     tier: 'Burstable'
@@ -39,16 +35,6 @@ resource postgresServer 'Microsoft.DBforPostgreSQL/flexibleServers@2025-08-01' =
   }
 }
 
-resource postgresServerAdministrator 'Microsoft.DBforPostgreSQL/flexibleServers/administrators@2025-08-01' = {
-  parent: postgresServer
-  name: dbAdminObjectId
-  properties: {
-    principalName: 'Database Admins'
-    principalType: 'Group'
-    tenantId: tenantId
-  }
-}
-
 resource postgresVirtualNetworkRule 'Microsoft.DBforPostgreSQL/flexibleServers/firewallRules@2025-08-01' = {
   parent: postgresServer
   name: 'allow-azure-services'