github/azure-sdk-for-cpp
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

Ensure ownership grant (#3173)

Browse Source 
The focus of these changes is to ensure that the service principal is
explicitly granted the "Owner" role on the active resource group, whether
the principal was newly created or a cached instance was used.

Co-authored-by: Jesse Squire <jesse.squire@gmail.com>
This commit is contained in:
Azure SDK Bot 2021-12-09 12:43:15 -08:00 committed by GitHub
parent 8e66a46e71
commit e5e637afa3
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 12 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
eng/common/TestResources/New-TestResources.ps1
View File

@ -580,14 +580,18 @@ try {
$PSBoundParameters['TestApplicationOid'] = $TestApplicationOid
$PSBoundParameters['TestApplicationSecret'] = $TestApplicationSecret
# Grant the test service principal ownership over the resource group. This may fail if the provisioner is a
# service principal without permissions to grant RBAC roles to other service principals. That should not be
# considered a critical failure, as the test application may have subscription-level permissions and not require
# the explicit grant.
#
# Ignore this check if $AzureTestPrincipal is specified as role assignment will already have been attempted on a
# previous run, and these error messages can be misleading for local runs.
if (!$resourceGroupRoleAssigned -and !$AzureTestPrincipal) {
# If the role hasn't been explicitly assigned to the resource group and a cached service principal is in use,
# query to see if the grant is needed.
if (!$resourceGroupRoleAssigned -and $AzureTestPrincipal) {
$roleAssignment = Get-AzRoleAssignment -ObjectId $AzureTestPrincipal.Id -RoleDefinitionName 'Owner' -ResourceGroupName "$ResourceGroupName" -ErrorAction SilentlyContinue
$resourceGroupRoleAssigned = ($roleAssignment.RoleDefinitionName -eq 'Owner')
}
# If needed, grant the test service principal ownership over the resource group. This may fail if the provisioner
# is a service principal without permissions to grant RBAC roles to other service principals. That should not be
# considered a critical failure, as the test application may have subscription-level permissions and not require
# the explicit grant.
if (!$resourceGroupRoleAssigned) {
Log "Attempting to assigning the 'Owner' role for '$ResourceGroupName' to the Test Application '$TestApplicationId'"
$principalOwnerAssignment = New-AzRoleAssignment -RoleDefinitionName "Owner" -ApplicationId "$TestApplicationId" -ResourceGroupName "$ResourceGroupName" -ErrorAction SilentlyContinue