Comments (2)
Found the solution. I missed I was already generating the GUID myself from outside of the module so I could simply reuse that as a template to replay in the policy assignment. All is working!
from terraform-azurerm-caf-enterprise-scale.
Ok I'm still having major issues because the actual role definition ID that is created within Azure is not the same as the GUID that I specify from terraform. This means I need to somehow fetch the role ID from state. However, I have no idea how to do that because the array containing role definitions uses the ID as resource identifiers. Please help!
template_file_variables = {
iops_vm_contributor_name = uuidv5("91d652b3-fdb0-48a6-8ace-f3be9e812fe1", var.environment)
iops_vm_write_identity = var.iam_spn_iops_vm_write_objectid
}
{
"name": "${iops_vm_contributor_name}",
"type": "Microsoft.Authorization/roleDefinitions",
"apiVersion": "2021-06-01",
"scope": null,
"properties": {
"roleName": "IOPS VM Contributor",
"type": "CustomRole",
"description": "Grants Virtual Machine Contributor access on all resources with the IOPSManaged:true tag.",
"permissions": [
{
"actions": [
"Microsoft.Authorization/*/read",
"Microsoft.Compute/availabilitySets/*",
"Microsoft.Compute/locations/*",
"Microsoft.Compute/virtualMachines/*",
When used here the iops_vm_contributor_name cannot be found in Azure. Checking the portal the definition ID is not the same as ${iops_vm_contributor_name}
. How to fetch the actual role definition ID to use in my policy?
{
"name": "Deploy-IOPSAssignRole",
"type": "Microsoft.Authorization/policyAssignments",
"apiVersion": "2021-06-01",
"properties": {
"description": "Assigns the IOPS VM Contributor role to specific resources with the IOPSManaged:true tag.",
"displayName": "Assign IOPS VM Contributor Role if Tag Exists",
"notScopes": [],
"parameters": {
"roleDefinitionId": {
"value": "${iops_vm_contributor_name}"
},
"principalId": {
"value": "${iops_vm_write_identity}"
}
},
"policyDefinitionId": "${root_scope_resource_id}/providers/Microsoft.Authorization/policyDefinitions/Deploy-IOPSAssignRole",
"scope": "${current_scope_resource_id}",
from terraform-azurerm-caf-enterprise-scale.
Related Issues (20)
- Feature Request - On/Off switch to control policy assignments HOT 6
- use existing management group as a parent HOT 5
- How to change the default virtual hub attribute HOT 3
- How do I create a NSG and associate it with my Subnets in hub VNet? HOT 5
- ESLZ Pipeline plan throwing Graph error
- Bug Report bug: turn off "Allow 'hub' to receive forwarded traffic from 'vnet'"
- Bug Report: Policy VM Monitoring fails, permission lacking for policy HOT 4
- How do we perform a VNet Gateway connection with local n/w gateway using ALZ module? HOT 2
- Ability to rename AMA management resources HOT 4
- Unable to update module due to policy definition errors HOT 1
- Errors when upgrading from v5.0.0 to v5.2.0 HOT 3
- Bug Report : vWan - Virtual network connections breaking the other network resources during peering. HOT 1
- Invalid configuration when upgrading to v6.0.0 HOT 2
- "Enable allLogs category group resource logging for supported resources to Log Analytics" creates duplicate logs for Application Insights already using a Log Analytics Workspace HOT 4
- Bug Report: Customization of new management resources not working as expected HOT 2
- v6.0.0 has ContainerInsights log analytics solution being removed, which results in tables needed by current Container Insights deployments to be deleted HOT 4
- after upgrading to 6.0.0 terraform plan continually wants to update landing zones policy assignment config for Enforce-GR-KeyVault
- Redacted
- [Feature Request]: Custom Policy Role Scopes
- Bug Report/ How to : Not able to create Custom Policy definition and assignment using Custom Landing Zones HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from terraform-azurerm-caf-enterprise-scale.