Add Managed Identity Contributor permission to gitrunner (#1587)

Co-authored-by: Automatic Update <[email protected]>
equinor · Jan 27, 2025 · 98780b9 · 98780b9
1 parent 198d101
commit 98780b9
Show file tree

Hide file tree

Showing 4 changed files with 48 additions and 0 deletions.
diff --git a/terraform/subscriptions/s940/c2/common/main.tf b/terraform/subscriptions/s940/c2/common/main.tf
@@ -211,6 +211,18 @@ module "radix_id_gitrunner" {
       role     = "Contributor"
       scope_id = "/subscriptions/${module.config.subscription}/resourceGroups/common/providers/Microsoft.ContainerRegistry/registries/radix${module.config.environment}app"
     }
+    vulnerability_scan_contributor = {
+      role     = "Managed Identity Contributor"
+      scope_id = "/subscriptions/${module.config.subscription}/resourceGroups/vulnerability-scan-${module.config.environment}"
+    }
+    cost_allocation_contributor = {
+      role     = "Managed Identity Contributor"
+      scope_id = "/subscriptions/${module.config.subscription}/resourceGroups/cost-allocation-${module.config.environment}"
+    }
+    grafana_contributor = {
+      role     = "Managed Identity Contributor"
+      scope_id = "/subscriptions/${module.config.subscription}/resourceGroups/monitoring"
+    }
   }
   federated_credentials = {
     radix-id-gitrunner = {

diff --git a/terraform/subscriptions/s940/prod/common/main.tf b/terraform/subscriptions/s940/prod/common/main.tf
@@ -208,6 +208,18 @@ module "radix_id_gitrunner" {
       role     = "Contributor"
       scope_id = "/subscriptions/${module.config.subscription}/resourceGroups/common/providers/Microsoft.ContainerRegistry/registries/radixprodapp" # TODO: Replace resource name when fixed
     }
+    vulnerability_scan_contributor = {
+      role     = "Managed Identity Contributor"
+      scope_id = "/subscriptions/${module.config.subscription}/resourceGroups/vulnerability-scan-${module.config.environment}"
+    }
+    cost_allocation_contributor = {
+      role     = "Managed Identity Contributor"
+      scope_id = "/subscriptions/${module.config.subscription}/resourceGroups/cost-allocation-${module.config.environment}"
+    }
+    grafana_contributor = {
+      role     = "Managed Identity Contributor"
+      scope_id = "/subscriptions/${module.config.subscription}/resourceGroups/monitoring"
+    }
   }
   federated_credentials = {
     radix-id-gitrunner = {

diff --git a/terraform/subscriptions/s941/dev/common/main.tf b/terraform/subscriptions/s941/dev/common/main.tf
@@ -208,6 +208,18 @@ module "radix_id_gitrunner" {
       role     = "Contributor"
       scope_id = "/subscriptions/${module.config.subscription}/resourceGroups/common/providers/Microsoft.ContainerRegistry/registries/radix${module.config.environment}app"
     }
+    vulnerability_scan_contributor = {
+      role     = "Managed Identity Contributor"
+      scope_id = "/subscriptions/${module.config.subscription}/resourceGroups/vulnerability-scan-${module.config.environment}"
+    }
+    cost_allocation_contributor = {
+      role     = "Managed Identity Contributor"
+      scope_id = "/subscriptions/${module.config.subscription}/resourceGroups/cost-allocation-${module.config.environment}"
+    }
+    grafana_contributor = {
+      role     = "Managed Identity Contributor"
+      scope_id = "/subscriptions/${module.config.subscription}/resourceGroups/monitoring"
+    }
   }
   federated_credentials = {
     radix-id-gitrunner = {

diff --git a/terraform/subscriptions/s941/playground/common/main.tf b/terraform/subscriptions/s941/playground/common/main.tf
@@ -199,6 +199,18 @@ module "radix_id_gitrunner" {
       role     = "Contributor"
       scope_id = "/subscriptions/${module.config.subscription}/resourceGroups/common/providers/Microsoft.ContainerRegistry/registries/radix${module.config.environment}app"
     }
+    vulnerability_scan_contributor = {
+      role     = "Managed Identity Contributor"
+      scope_id = "/subscriptions/${module.config.subscription}/resourceGroups/vulnerability-scan-${module.config.environment}"
+    }
+    cost_allocation_contributor = {
+      role     = "Managed Identity Contributor"
+      scope_id = "/subscriptions/${module.config.subscription}/resourceGroups/cost-allocation-${module.config.environment}"
+    }
+    grafana_contributor = {
+      role     = "Managed Identity Contributor"
+      scope_id = "/subscriptions/${module.config.subscription}/resourceGroups/monitoring"
+    }
   }
   federated_credentials = {
     radix-id-gitrunner = {