update to support multi sub

Author: baoduy

AzAd/EnvRoles.ts

@@ -19,7 +19,11 @@ const envRoleConfig = {
   } as RoleNameType,
 };
 
-export const getEnvRoleNames = (includeOrganization = false) => ({
+export type EnvRoleNamesType = { [k in keyof typeof envRoleConfig]: string };
+
+export const getEnvRoleNames = (
+  includeOrganization = false
+): EnvRoleNamesType => ({
   readOnly: getRoleName({ ...envRoleConfig.readOnly, includeOrganization }),
   contributor: getRoleName({
     ...envRoleConfig.contributor,

Core/ResourceGroup.ts

@@ -2,31 +2,30 @@ import {
   DefaultResourceArgs,
   ResourceGroupInfo,
   ResourceResultProps,
-} from "../types";
+} from '../types';
 import {
   ResourceGroup,
   ResourceGroupArgs,
-} from "@pulumi/azure-native/resources";
-import { BasicResourceArgs } from "./../types.d";
-import ResourceCreator from "./ResourceCreator";
-import { getResourceGroupName } from "../Common/Naming";
-import { envRoleNames } from "../AzAd/EnvRoles";
-import { assignRolesToGroup } from "../AzAd/Group";
-import { currentEnv, Environments } from "../Common/AzureEnv";
+} from '@pulumi/azure-native/resources';
+import { BasicResourceArgs } from './../types.d';
+import ResourceCreator from './ResourceCreator';
+import { getResourceGroupName } from '../Common/Naming';
+import { EnvRoleNamesType } from '../AzAd/EnvRoles';
+import { assignRolesToGroup } from '../AzAd/Group';
 
 interface Props
-  extends Omit<DefaultResourceArgs, "monitoring">,
-    Omit<BasicResourceArgs, "group"> {
+  extends Omit<DefaultResourceArgs, 'monitoring'>,
+    Omit<BasicResourceArgs, 'group'> {
   formattedName?: boolean;
 
-  /**Grant permission of this group into Environment Roles groups*/
-  enableEnvRbac?: boolean;
+  /** Grant permission of this group into Environment Roles groups*/
+  envRoleNames?: EnvRoleNamesType;
 }
 
 export default async ({
   name,
   formattedName,
-  enableEnvRbac = currentEnv !== Environments.Global,
+  envRoleNames,
   ...others
 }: Props): Promise<
   ResourceResultProps<ResourceGroup> & { toGroupInfo: () => ResourceGroupInfo }
@@ -43,20 +42,20 @@ export default async ({
 
   const g = resource as ResourceGroup;
 
-  if (enableEnvRbac) {
+  if (envRoleNames) {
     await assignRolesToGroup({
       groupName: envRoleNames.readOnly,
-      roles: ["Reader"],
+      roles: ['Reader'],
       scope: g.id,
     });
     await assignRolesToGroup({
       groupName: envRoleNames.contributor,
-      roles: ["Contributor"],
+      roles: ['Contributor'],
       scope: g.id,
     });
     await assignRolesToGroup({
       groupName: envRoleNames.admin,
-      roles: ["Owner"],
+      roles: ['Owner'],
       scope: g.id,
     });
   }

KeyVault/VaultAccess.ts

@@ -1,13 +1,13 @@
-import { PermissionProps } from "./VaultPermissions";
-import GroupRole from "../AzAd/Role";
-import { currentEnv, currentServicePrincipal } from "../Common/AzureEnv";
-import { getAdGroup } from "../AzAd/Group";
-import { envRoleNames } from "../AzAd/EnvRoles";
-import * as azuread from "@pulumi/azuread";
+import { PermissionProps } from './VaultPermissions';
+import GroupRole from '../AzAd/Role';
+import { currentEnv, currentServicePrincipal } from '../Common/AzureEnv';
+import { getAdGroup } from '../AzAd/Group';
+import { EnvRoleNamesType } from '../AzAd/EnvRoles';
+import * as azuread from '@pulumi/azuread';
 
 export type VaultAccessType = {
-  useEnvRoles?: boolean;
-  enableRbac?: boolean;
+  /** Grant permission of this group into Environment Roles groups*/
+  envRoleNames?: EnvRoleNamesType;
   permissions?: Array<PermissionProps>;
 };
 
@@ -18,35 +18,41 @@ interface Props {
 
 export default async ({ name, auth }: Props) => {
   //Permission Groups
-  const readOnlyGroup = auth.useEnvRoles
-    ? await getAdGroup(envRoleNames.readOnly)
+  const readOnlyGroup = auth.envRoleNames
+    ? await getAdGroup(auth.envRoleNames.readOnly)
     : await GroupRole({
         env: currentEnv,
         appName: `${name}-vault`,
-        roleName: "ReadOnly",
+        roleName: 'ReadOnly',
       });
-  const adminGroup = auth.useEnvRoles
-    ? await getAdGroup(envRoleNames.contributor)
+  const adminGroup = auth.envRoleNames
+    ? await getAdGroup(auth.envRoleNames.contributor)
     : await GroupRole({
         env: currentEnv,
         appName: `${name}-vault`,
-        roleName: "Admin",
+        roleName: 'Admin',
       });
 
   //Add current service principal in
-  if (auth!.permissions!.length <= 0) {
-    auth.permissions!.push({
+  if (auth.permissions == undefined) {
+    auth.permissions = [
+      {
+        objectId: currentServicePrincipal,
+        permission: 'ReadWrite',
+      },
+    ];
+  } else
+    auth.permissions.push({
       objectId: currentServicePrincipal,
-      permission: "ReadWrite",
+      permission: 'ReadWrite',
     });
-  }
 
   //Add Permission to Groups
-  auth.permissions!.forEach(
+  auth.permissions.forEach(
     ({ objectId, applicationId, permission }, index) =>
       new azuread.GroupMember(`${name}-${permission}-${index}`, {
         groupObjectId:
-          permission === "ReadOnly"
+          permission === 'ReadOnly'
             ? readOnlyGroup.objectId
             : adminGroup.objectId,
         memberObjectId: objectId ?? applicationId,