AzureFunctionPython/code/infra/roleassignments.tf at 1023a66cabda68f53eed45f4e3c595b3bb30ca0b · PerfectThymeTech/AzureFunctionPython · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
# Current role assignments
resource "azurerm_role_assignment" "current_role_assignment_key_vault" {
  scope                = azurerm_key_vault.key_vault.id
  role_definition_name = "Key Vault Administrator"
  principal_id         = data.azurerm_client_config.current.object_id
}

resource "azurerm_role_assignment" "current_role_assignment_app_configuration" {
  scope                = azurerm_app_configuration.app_configuration.id
  role_definition_name = "App Configuration Data Owner"
  principal_id         = data.azurerm_client_config.current.object_id
}

# Function role assignments
resource "azurerm_role_assignment" "function_role_assignment_storage_blob_data_owner" {
  scope                = azurerm_storage_account.storage.id
  role_definition_name = "Storage Blob Data Owner"
  principal_id         = azapi_resource.function.identity[0].principal_id
}

# resource "azurerm_role_assignment" "function_role_assignment_storage_account_contributor" { # Enable when using blob triggers
#   scope                = azurerm_storage_account.storage.id
#   role_definition_name = "Storage Account Contributor"
#   principal_id         = azapi_resource.function.identity[0].principal_id
# }

# resource "azurerm_role_assignment" "function_role_assignment_storage_queue_data_contributor" { # Enable when using blob triggers
#   scope                = azurerm_storage_account.storage.id
#   role_definition_name = "Storage Queue Data Contributor"
#   principal_id         = azapi_resource.function.identity[0].principal_id
# }

# Additional permissions may be required based on the trigger that is being used.
# For more details, refer to: https://learn.microsoft.com/en-us/azure/azure-functions/functions-reference?tabs=blob&pivots=programming-language-python#grant-permission-to-the-identity

resource "azurerm_role_assignment" "function_role_assignment_key_vault" {
  scope                = azurerm_key_vault.key_vault.id
  role_definition_name = "Key Vault Secrets Officer"
  principal_id         = azapi_resource.function.identity[0].principal_id
}

# resource "azurerm_role_assignment" "function_role_assignment_application_insights" { # Enable to rely on Entra ID-based authentication to Application Insights
#   scope                = azurerm_application_insights.application_insights.id
#   role_definition_name = "Monitoring Metrics Publisher"
#   principal_id         = azapi_resource.function.identity[0].principal_id
# }

resource "azurerm_role_assignment" "function_role_assignment_app_configuration" {
  scope                = azurerm_app_configuration.app_configuration.id
  role_definition_name = "App Configuration Data Reader"
  principal_id         = azapi_resource.function.identity[0].principal_id
}

# App Configuration role assignments
resource "azurerm_role_assignment" "app_configuration_role_assignment_key_vault" {
  scope                = azurerm_key_vault.key_vault.id
  role_definition_name = "Key Vault Secrets Reader"
  principal_id         = azurerm_app_configuration.app_configuration.identity[0].principal_id
}