Merge pull request #1 from XPRTZ/setup-acr-with-identities

Add roleassignments
XPRTZ · Jan 7, 2024 · a9c4e00 · a9c4e00
2 parents 5e615b0 + bfbc829
commit a9c4e00
Show file tree

Hide file tree

Showing 3 changed files with 140 additions and 0 deletions.
diff --git a/main.bicep b/main.bicep
@@ -16,3 +16,8 @@ module acr 'modules/acr.bicep' = {
     location: location
   }
 }
+
+module roleAssignments 'modules/roleassignments.bicep' = {
+  scope: acrResourceGroup
+  name: 'Deploy-Role-Assignments'
+}
diff --git a/main.json b/main.json
@@ -0,0 +1,122 @@
+{
+  "$schema": "https://schema.management.azure.com/schemas/2018-05-01/subscriptionDeploymentTemplate.json#",
+  "contentVersion": "1.0.0.0",
+  "metadata": {
+    "_generator": {
+      "name": "bicep",
+      "version": "0.24.24.22086",
+      "templateHash": "17396162557349523173"
+    }
+  },
+  "parameters": {
+    "location": {
+      "type": "string",
+      "defaultValue": "westeurope"
+    }
+  },
+  "variables": {
+    "acrResourceGroupName": "rg-xprtzbv-acr"
+  },
+  "resources": [
+    {
+      "type": "Microsoft.Resources/resourceGroups",
+      "apiVersion": "2021-04-01",
+      "name": "[variables('acrResourceGroupName')]",
+      "location": "[parameters('location')]"
+    },
+    {
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2022-09-01",
+      "name": "Deploy-Acr",
+      "resourceGroup": "[variables('acrResourceGroupName')]",
+      "properties": {
+        "expressionEvaluationOptions": {
+          "scope": "inner"
+        },
+        "mode": "Incremental",
+        "parameters": {
+          "location": {
+            "value": "[parameters('location')]"
+          }
+        },
+        "template": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "1.0.0.0",
+          "metadata": {
+            "_generator": {
+              "name": "bicep",
+              "version": "0.24.24.22086",
+              "templateHash": "11385648063582337338"
+            }
+          },
+          "parameters": {
+            "location": {
+              "type": "string"
+            }
+          },
+          "variables": {
+            "acrName": "xprtzbv"
+          },
+          "resources": [
+            {
+              "type": "Microsoft.ContainerRegistry/registries",
+              "apiVersion": "2021-06-01-preview",
+              "name": "[variables('acrName')]",
+              "location": "[parameters('location')]",
+              "sku": {
+                "name": "Basic"
+              },
+              "properties": {
+                "adminUserEnabled": false
+              }
+            }
+          ]
+        }
+      },
+      "dependsOn": [
+        "[subscriptionResourceId('Microsoft.Resources/resourceGroups', variables('acrResourceGroupName'))]"
+      ]
+    },
+    {
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2022-09-01",
+      "name": "Deploy-Role-Assignments",
+      "resourceGroup": "[variables('acrResourceGroupName')]",
+      "properties": {
+        "expressionEvaluationOptions": {
+          "scope": "inner"
+        },
+        "mode": "Incremental",
+        "template": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "1.0.0.0",
+          "metadata": {
+            "_generator": {
+              "name": "bicep",
+              "version": "0.24.24.22086",
+              "templateHash": "3303368658129101915"
+            }
+          },
+          "variables": {
+            "rbacAdminRoleDefinitionId": "f58310d9-a9f6-439a-9e8d-f62e7b41a168",
+            "developersServicePrincipleId": "c798c25c-c035-4266-b595-aae421c01887"
+          },
+          "resources": [
+            {
+              "type": "Microsoft.Authorization/roleAssignments",
+              "apiVersion": "2022-04-01",
+              "name": "[guid(variables('developersServicePrincipleId'), variables('rbacAdminRoleDefinitionId'), resourceGroup().id)]",
+              "properties": {
+                "principalId": "[variables('developersServicePrincipleId')]",
+                "roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('rbacAdminRoleDefinitionId'))]"
+              }
+            }
+          ]
+        }
+      },
+      "dependsOn": [
+        "[subscriptionResourceId('Microsoft.Resources/resourceGroups', variables('acrResourceGroupName'))]"
+      ]
+    }
+  ]
+}
diff --git a/modules/roleassignments.bicep b/modules/roleassignments.bicep
@@ -0,0 +1,13 @@
+var rbacAdminRoleDefinitionId = 'f58310d9-a9f6-439a-9e8d-f62e7b41a168'
+var developersServicePrincipleId = '1f0f1bf8-45c6-451c-b6b5-f3ed8c38ef69'
+
+// Role Based Access Control Administrator for xprtz-mgmt-developers-sp
+resource rbacAdminAssignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
+  scope: resourceGroup()
+  name: guid(developersServicePrincipleId, rbacAdminRoleDefinitionId, resourceGroup().id)
+  properties: {
+    principalId: developersServicePrincipleId
+    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', rbacAdminRoleDefinitionId)
+    principalType: 'ServicePrincipal'
+  }
+}