Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Devs need write permissions to create leases on terraform blob storage #1408

Merged
merged 1 commit into from
Feb 6, 2025
Merged

Devs need write permissions to create leases on terraform blob storage #1408

merged 1 commit into from
Feb 6, 2025

Conversation

christian-calabrese
Copy link
Contributor

Motivation and Context

Developers currently have the "readers" role on the blob storage containing terraform states. This role does not allow the creation of leases.
Terraform uses leases to lock the state while performing operations.

Major Changes

Developers groups now have writer permissions on the blob storage containing terraform states

Dependencies

Testing

Documentation

Other Considerations

@christian-calabrese christian-calabrese requested a review from a team as a code owner February 6, 2025 14:22
@github-actions github-actions bot added the core label Feb 6, 2025
@github-actions GitHub Actions
Copy link

github-actions bot commented Feb 6, 2025

📖 Terraform Plan ('src/core/prod') - success

Terraform Plan 
Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  + create
  - destroy

Terraform will perform the following actions:

  # module.storage_accounts_itn.module.iam_adgroup_auth_devs.module.storage_account.azurerm_role_assignment.blob["iopitntfst001|*|reader"] will be destroyed
  # (because key ["iopitntfst001|*|reader"] is not in for_each map)
  - resource "azurerm_role_assignment" "blob" {
      - id                                     = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/resourceGroups/terraform-state-rg/providers/Microsoft.Storage/storageAccounts/iopitntfst001/providers/Microsoft.Authorization/roleAssignments/cad9cdbc-a9c2-5f4e-a2a0-94b88b64be25" -> null
      - name                                   = "cad9cdbc-a9c2-5f4e-a2a0-94b88b64be25" -> null
      - principal_id                           = "0bd8a47e-3188-45c9-9c74-23f22fca2497" -> null
      - principal_type                         = "Group" -> null
      - role_definition_id                     = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/providers/Microsoft.Authorization/roleDefinitions/2a2b9908-6ea1-4ae2-8e65-a410df84e7d1" -> null
      - scope                                  = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/resourceGroups/terraform-state-rg/providers/Microsoft.Storage/storageAccounts/iopitntfst001" -> null
        # (4 unchanged attributes hidden)
    }

  # module.storage_accounts_itn.module.iam_adgroup_auth_devs.module.storage_account.azurerm_role_assignment.blob["iopitntfst001|*|writer"] will be created
  + resource "azurerm_role_assignment" "blob" {
      + id                               = (known after apply)
      + name                             = (known after apply)
      + principal_id                     = "0bd8a47e-3188-45c9-9c74-23f22fca2497"
      + principal_type                   = (known after apply)
      + role_definition_id               = (known after apply)
      + role_definition_name             = "Storage Blob Data Contributor"
      + scope                            = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/resourceGroups/terraform-state-rg/providers/Microsoft.Storage/storageAccounts/iopitntfst001"
      + skip_service_principal_aad_check = (known after apply)
    }

  # module.storage_accounts_itn.module.iam_adgroup_bonus_devs.module.storage_account.azurerm_role_assignment.blob["iopitntfst001|*|reader"] will be destroyed
  # (because key ["iopitntfst001|*|reader"] is not in for_each map)
  - resource "azurerm_role_assignment" "blob" {
      - id                                     = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/resourceGroups/terraform-state-rg/providers/Microsoft.Storage/storageAccounts/iopitntfst001/providers/Microsoft.Authorization/roleAssignments/39a6499f-f3ee-cc17-3ab4-376187cc9912" -> null
      - name                                   = "39a6499f-f3ee-cc17-3ab4-376187cc9912" -> null
      - principal_id                           = "861e7fd4-6463-4f69-b473-1e6aaaa4520e" -> null
      - principal_type                         = "Group" -> null
      - role_definition_id                     = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/providers/Microsoft.Authorization/roleDefinitions/2a2b9908-6ea1-4ae2-8e65-a410df84e7d1" -> null
      - scope                                  = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/resourceGroups/terraform-state-rg/providers/Microsoft.Storage/storageAccounts/iopitntfst001" -> null
        # (4 unchanged attributes hidden)
    }

  # module.storage_accounts_itn.module.iam_adgroup_bonus_devs.module.storage_account.azurerm_role_assignment.blob["iopitntfst001|*|writer"] will be created
  + resource "azurerm_role_assignment" "blob" {
      + id                               = (known after apply)
      + name                             = (known after apply)
      + principal_id                     = "861e7fd4-6463-4f69-b473-1e6aaaa4520e"
      + principal_type                   = (known after apply)
      + role_definition_id               = (known after apply)
      + role_definition_name             = "Storage Blob Data Contributor"
      + scope                            = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/resourceGroups/terraform-state-rg/providers/Microsoft.Storage/storageAccounts/iopitntfst001"
      + skip_service_principal_aad_check = (known after apply)
    }

  # module.storage_accounts_itn.module.iam_adgroup_com_devs.module.storage_account.azurerm_role_assignment.blob["iopitntfst001|*|reader"] will be destroyed
  # (because key ["iopitntfst001|*|reader"] is not in for_each map)
  - resource "azurerm_role_assignment" "blob" {
      - id                                     = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/resourceGroups/terraform-state-rg/providers/Microsoft.Storage/storageAccounts/iopitntfst001/providers/Microsoft.Authorization/roleAssignments/d73c1187-444f-e82b-6d01-529dbf2fcde5" -> null
      - name                                   = "d73c1187-444f-e82b-6d01-529dbf2fcde5" -> null
      - principal_id                           = "7b78851b-c40d-497d-ae7f-596b8f92ecf2" -> null
      - principal_type                         = "Group" -> null
      - role_definition_id                     = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/providers/Microsoft.Authorization/roleDefinitions/2a2b9908-6ea1-4ae2-8e65-a410df84e7d1" -> null
      - scope                                  = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/resourceGroups/terraform-state-rg/providers/Microsoft.Storage/storageAccounts/iopitntfst001" -> null
        # (4 unchanged attributes hidden)
    }

  # module.storage_accounts_itn.module.iam_adgroup_com_devs.module.storage_account.azurerm_role_assignment.blob["iopitntfst001|*|writer"] will be created
  + resource "azurerm_role_assignment" "blob" {
      + id                               = (known after apply)
      + name                             = (known after apply)
      + principal_id                     = "7b78851b-c40d-497d-ae7f-596b8f92ecf2"
      + principal_type                   = (known after apply)
      + role_definition_id               = (known after apply)
      + role_definition_name             = "Storage Blob Data Contributor"
      + scope                            = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/resourceGroups/terraform-state-rg/providers/Microsoft.Storage/storageAccounts/iopitntfst001"
      + skip_service_principal_aad_check = (known after apply)
    }

  # module.storage_accounts_itn.module.iam_adgroup_svc_devs.module.storage_account.azurerm_role_assignment.blob["iopitntfst001|*|reader"] will be destroyed
  # (because key ["iopitntfst001|*|reader"] is not in for_each map)
  - resource "azurerm_role_assignment" "blob" {
      - id                                     = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/resourceGroups/terraform-state-rg/providers/Microsoft.Storage/storageAccounts/iopitntfst001/providers/Microsoft.Authorization/roleAssignments/89dbeef9-ef1f-f18d-3c74-b4b94f5739e8" -> null
      - name                                   = "89dbeef9-ef1f-f18d-3c74-b4b94f5739e8" -> null
      - principal_id                           = "300ea154-9984-4712-85e9-3abcb3e42960" -> null
      - principal_type                         = "Group" -> null
      - role_definition_id                     = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/providers/Microsoft.Authorization/roleDefinitions/2a2b9908-6ea1-4ae2-8e65-a410df84e7d1" -> null
      - scope                                  = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/resourceGroups/terraform-state-rg/providers/Microsoft.Storage/storageAccounts/iopitntfst001" -> null
        # (4 unchanged attributes hidden)
    }

  # module.storage_accounts_itn.module.iam_adgroup_svc_devs.module.storage_account.azurerm_role_assignment.blob["iopitntfst001|*|writer"] will be created
  + resource "azurerm_role_assignment" "blob" {
      + id                               = (known after apply)
      + name                             = (known after apply)
      + principal_id                     = "300ea154-9984-4712-85e9-3abcb3e42960"
      + principal_type                   = (known after apply)
      + role_definition_id               = (known after apply)
      + role_definition_name             = "Storage Blob Data Contributor"
      + scope                            = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/resourceGroups/terraform-state-rg/providers/Microsoft.Storage/storageAccounts/iopitntfst001"
      + skip_service_principal_aad_check = (known after apply)
    }

  # module.storage_accounts_itn.module.iam_adgroup_wallet_devs.module.storage_account.azurerm_role_assignment.blob["iopitntfst001|*|reader"] will be destroyed
  # (because key ["iopitntfst001|*|reader"] is not in for_each map)
  - resource "azurerm_role_assignment" "blob" {
      - id                                     = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/resourceGroups/terraform-state-rg/providers/Microsoft.Storage/storageAccounts/iopitntfst001/providers/Microsoft.Authorization/roleAssignments/1e196c94-6522-7fc0-fec4-8a72055bcae8" -> null
      - name                                   = "1e196c94-6522-7fc0-fec4-8a72055bcae8" -> null
      - principal_id                           = "b2ca23d9-ace5-416d-8132-01d9b002db12" -> null
      - principal_type                         = "Group" -> null
      - role_definition_id                     = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/providers/Microsoft.Authorization/roleDefinitions/2a2b9908-6ea1-4ae2-8e65-a410df84e7d1" -> null
      - scope                                  = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/resourceGroups/terraform-state-rg/providers/Microsoft.Storage/storageAccounts/iopitntfst001" -> null
        # (4 unchanged attributes hidden)
    }

  # module.storage_accounts_itn.module.iam_adgroup_wallet_devs.module.storage_account.azurerm_role_assignment.blob["iopitntfst001|*|writer"] will be created
  + resource "azurerm_role_assignment" "blob" {
      + id                               = (known after apply)
      + name                             = (known after apply)
      + principal_id                     = "b2ca23d9-ace5-416d-8132-01d9b002db12"
      + principal_type                   = (known after apply)
      + role_definition_id               = (known after apply)
      + role_definition_name             = "Storage Blob Data Contributor"
      + scope                            = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/resourceGroups/terraform-state-rg/providers/Microsoft.Storage/storageAccounts/iopitntfst001"
      + skip_service_principal_aad_check = (known after apply)
    }

Plan: 5 to add, 0 to change, 5 to destroy.

Warning: Deprecated attribute

  on ../_modules/vpn/main.tf line 22, in module "vpn":
  22:       aad_audience          = data.azuread_application.vpn_app.application_id

The attribute "application_id" is deprecated. Refer to the provider
documentation for details.

(and one more similar warning elsewhere)

Warning: Argument is deprecated

  with module.azdoa_weu.module.azdoa_snet.azurerm_subnet.this,
  on .terraform/modules/azdoa_weu.azdoa_snet/subnet/main.tf line 23, in resource "azurerm_subnet" "this":
  23:   private_endpoint_network_policies_enabled     = var.private_endpoint_network_policies_enabled

`private_endpoint_network_policies_enabled` will be removed in favour of the
property `private_endpoint_network_policies` in version 4.0 of the AzureRM
Provider

(and 11 more similar warnings elsewhere)

─────────────────────────────────────────────────────────────────────────────

Note: You didn't use the -out option to save this plan, so Terraform can't
guarantee to take exactly these actions if you run "terraform apply" now.

@sonarqubecloud SonarQubeCloud
Copy link

sonarqubecloud bot commented Feb 6, 2025

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

@christian-calabrese christian-calabrese added this pull request to the merge queue Feb 6, 2025
Merged via the queue into main with commit fdc9a8b Feb 6, 2025
7 checks passed
github-merge-queue bot pushed a commit that referenced this pull request Feb 6, 2025
@christian-calabrese
Devs need write permissions to create leases on terraform blob storage (
fdc9a8b 
#1408)
@christian-calabrese christian-calabrese deleted the devs-need-writer-permissions-iac-storage-account branch February 6, 2025 14:35
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@Krusty93 Krusty93 Krusty93 approved these changes

Assignees
No one assigned
Labels
core
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@christian-calabrese @Krusty93