Skip to content
This repository has been archived by the owner on Dec 3, 2024. It is now read-only.

Switch to using a Service Principal for Terraform deployments #85

Merged
merged 1 commit into from
Jun 28, 2024

Conversation

DrizzlyOwl
Copy link
Collaborator

  • This change modifies how deployments with Terraform are made. Previously we would login to Azure CLI using our own named @edu accounts and apply terraform changes using those accounts, however this is misaligned with our DfE would prefer us to run deployments.
  • Instead, we ought to be using our subscription-specific deployment service principal. This service principal is granted the minimum role assignments that are required to deploy infrastructure.
  • A big advantage to using the service principal approach is that we are able to conditionally deploy role assignments to managed identities which we were previously not able to achieve without intervention from DfE InfraOps. This helps free up bottlenecks in deployments and ensures we can bring up an entire service from cold without any role assignment issues.
  • Another benefit to using our service principal as deployments are not tied to a specific person

@DrizzlyOwl DrizzlyOwl requested a review from Stretch96 June 20, 2024 15:32
@DrizzlyOwl DrizzlyOwl marked this pull request as ready for review June 27, 2024 16:28
@DrizzlyOwl DrizzlyOwl merged commit 7a024de into main Jun 28, 2024
1 check passed
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants