Skip to content

fix: allow providing sg from vnet_rg #345

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Aug 8, 2024
Merged

fix: allow providing sg from vnet_rg #345

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
d89a5a2
fix: allow providing sg from vnet_rg
kristina-solovyova Aug 8, 2024
cd6a16c
terraform-docs: automated action
github-actions[bot] Aug 8, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions modules/iam/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,7 @@ No modules.
| [azurerm_role_assignment.function_app_key_vault_secrets_user](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/role_assignment) | resource |
| [azurerm_role_assignment.function_app_reader](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/role_assignment) | resource |
| [azurerm_role_assignment.function_app_scale_set_machine_owner](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/role_assignment) | resource |
| [azurerm_role_assignment.join_sg](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/role_assignment) | resource |
| [azurerm_role_assignment.join_subnet](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/role_assignment) | resource |
| [azurerm_role_assignment.key_vault_set_secret](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/role_assignment) | resource |
| [azurerm_role_assignment.logic_app_standard_reader](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/role_assignment) | resource |
Expand All @@ -37,6 +38,7 @@ No modules.
| [azurerm_role_assignment.storage_account_contributor](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/role_assignment) | resource |
| [azurerm_role_assignment.storage_blob_data_contributor](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/role_assignment) | resource |
| [azurerm_role_assignment.weka_tar_data_reader](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/role_assignment) | resource |
| [azurerm_role_definition.join_sg](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/role_definition) | resource |
| [azurerm_role_definition.join_subnet](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/role_definition) | resource |
| [azurerm_role_definition.key_vault_set_secret](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/role_definition) | resource |
| [azurerm_user_assigned_identity.function_app](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/user_assigned_identity) | resource |
Expand Down Expand Up @@ -66,6 +68,7 @@ No modules.
| <a name="input_obs_container_name"></a> [obs\_container\_name](#input\_obs\_container\_name) | The name of the container for the OBS. | `string` | n/a | yes |
| <a name="input_prefix"></a> [prefix](#input\_prefix) | Prefix for all resources | `string` | n/a | yes |
| <a name="input_rg_name"></a> [rg\_name](#input\_rg\_name) | A predefined resource group in the Azure subscription. | `string` | n/a | yes |
| <a name="input_sg_id"></a> [sg\_id](#input\_sg\_id) | Security group id | `string` | `""` | no |
| <a name="input_subnet_name"></a> [subnet\_name](#input\_subnet\_name) | The name of the subnet. | `string` | n/a | yes |
| <a name="input_support_logic_app"></a> [support\_logic\_app](#input\_support\_logic\_app) | Enable support for logic app. | `bool` | `true` | no |
| <a name="input_tiering_enable_obs_integration"></a> [tiering\_enable\_obs\_integration](#input\_tiering\_enable\_obs\_integration) | Enable OBS integration for tiering. | `bool` | n/a | yes |
Expand Down
23 changes: 23 additions & 0 deletions modules/iam/function_app.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -121,3 +121,26 @@ resource "azurerm_role_assignment" "join_subnet" {
role_definition_id = azurerm_role_definition.join_subnet[0].role_definition_resource_id
principal_id = azurerm_user_assigned_identity.function_app[0].principal_id
}

resource "azurerm_role_definition" "join_sg" {
count = var.function_app_identity_name == "" && var.rg_name != var.vnet_rg_name && var.sg_id != "" ? 1 : 0
name = "${var.prefix}-${var.cluster_name}-join-sg"
scope = var.sg_id
description = "Can join security group"

permissions {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

why do we need this permission ?

Copy link
Contributor Author

@kristina-solovyova kristina-solovyova Aug 8, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

if we provide sg_id from different vnet_rg, we get this error:

\"error\": {\n    \"code\": \"LinkedAuthorizationFailed\",\n    \"message\": 
\"The client 'XXX' with object id 'XXX' has permission to perform action 'Microsoft.Compute/virtualMachineScaleSets/write' on scope '/subscriptions/YYY/resourceGroups/mncal-rg/providers/Microsoft.Compute/virtualMachineScaleSets/mn-test2-vmss'; 
however, it does not have permission to perform action(s) 'Microsoft.Network/networkSecurityGroups/join/action' on the linked scope(s) '/subscriptions/YYY/resourceGroups/qacal-rg/providers/Microsoft.Network/networkSecurityGroups/qa-sg'

actions = [
"Microsoft.Network/networkSecurityGroups/join/action",
]
not_actions = []
}

assignable_scopes = [var.sg_id]
}

resource "azurerm_role_assignment" "join_sg" {
count = var.function_app_identity_name == "" && var.rg_name != var.vnet_rg_name && var.sg_id != "" ? 1 : 0
scope = var.sg_id
role_definition_id = azurerm_role_definition.join_sg[0].role_definition_resource_id
principal_id = azurerm_user_assigned_identity.function_app[0].principal_id
}
6 changes: 6 additions & 0 deletions modules/iam/variables.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,6 +18,12 @@ variable "subnet_name" {
description = "The name of the subnet."
}

variable "sg_id" {
type = string
description = "Security group id"
default = ""
}

variable "prefix" {
type = string
description = "Prefix for all resources"
Expand Down
1 change: 1 addition & 0 deletions prerequisites.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,6 +28,7 @@ module "iam" {
vnet_rg_name = local.vnet_rg_name
vnet_name = local.vnet_name
subnet_name = local.subnet_name
sg_id = var.sg_id
vmss_identity_name = var.vmss_identity_name
function_app_identity_name = var.function_app_identity_name
support_logic_app = local.create_logic_app
Expand Down