Building Blocks Automation Infrastructure

Source code & Installation

The source code of this kit module can be found hereopen in new window

Run the following command to install the kit module:

collie kit import azure/buildingblocks/automation
1

This documentation is intended as a reference documentation for cloud foundation or platform engineers using this module.

The biggest problem is resource group deletion. We need to be able to CRUD exclusively owned RGs in customer subscriptions. That means we need delete RG permission. But that allows deleting every resource.

Approaches that don't work to limit them

  • restrict deletion with denyAction unfortunately a dead end since Policy Definitions can't filter on principal ids, so the policy would deny deletion of all RGs
  • assigning only create RG permission on MG, then assign Owner role on created RG to allow deletion. Problem is that terraform destroy will first destroy the role assignment, then attempt to delete the RG (which is now missing permission). terraform prevent_destroy on the role assignment does not work because this fails terraform plans invoked with terraform destroy.

The only alternatives I see

  • customers must supply the RGs, so that the SPN does not have to own their lifecycle and does not need the delete RG permission
  • Azure Policy/ABAC becomes powerful enough one day to restrict this (especially: denyAction)

Requirements

No requirements.

Modules

No modules.

Resources

NameType
azuread_app_role_assignment.buildingblock-directoryopen in new windowresource
azuread_application.buildingblockopen in new windowresource
azuread_service_principal.buildingblockopen in new windowresource
azuread_service_principal_password.buildingblockopen in new windowresource
azurerm_management_group_policy_assignment.buildingblock_accessopen in new windowresource
azurerm_policy_definition.buildingblock_accessopen in new windowresource
azurerm_resource_group.tfstatesopen in new windowresource
azurerm_role_assignment.buildingblock_deployopen in new windowresource
azurerm_role_assignment.keyvault_administratoropen in new windowresource
azurerm_role_assignment.tfstates_engineersopen in new windowresource
azurerm_role_definition.buildingblock_planopen in new windowresource
azurerm_storage_account.tfstatesopen in new windowresource
azurerm_storage_container.tfstatesopen in new windowresource
random_string.resource_codeopen in new windowresource
time_rotating.key_rotationopen in new windowresource
azuread_application_published_app_ids.well_knownopen in new windowdata source
azuread_service_principal.msgraphopen in new windowdata source
azurerm_key_vault.cf_key_vaultopen in new windowdata source
azurerm_role_definition.keyvault_administratoropen in new windowdata source
azurerm_subscription.currentopen in new windowdata source

Inputs

NameDescriptionTypeDefaultRequired
key_vaultKey Vault configuration
object({
name = string
resource_group_name = string
})
n/ayes
locationAzure location for deploying the storage accountstringn/ayes
scopen/astringn/ayes
service_principal_namen/astringn/ayes

Outputs

NameDescription
client_idn/a
client_secretn/a
container_namen/a
documentation_mdn/a
principal_idn/a
resource_group_namen/a
storage_account_namen/a
subscription_idn/a
tenant_idn/a