Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[CES-584] Add roles to IO AD Groups with APIM as scope #1386

Merged
merged 3 commits into from
Jan 21, 2025
Merged

[CES-584] Add roles to IO AD Groups with APIM as scope #1386

merged 3 commits into from
Jan 21, 2025

Conversation

Krusty93
Copy link
Contributor

@Krusty93 Krusty93 commented Jan 20, 2025 •
edited
Loading

Motivation and Context

Devs will not be Contributor of the entire subscription very soon, however they will still need to operate on APIM

Major Changes

Admins are Contributor

Dependencies

Testing

Documentation

Other Considerations

@Krusty93 Krusty93 requested review from a team as code owners January 20, 2025 09:34
@github-actions github-actions bot added the core label Jan 20, 2025
@github-actions GitHub Actions
Copy link

📖 Terraform Plan ('src/core/prod') - success

Terraform Plan 
No changes. Your infrastructure matches the configuration.

Terraform has compared your real infrastructure against your configuration
and found no differences, so no changes are needed.

Warning: Deprecated attribute

  on ../_modules/vpn/main.tf line 22, in module "vpn":
  22:       aad_audience          = data.azuread_application.vpn_app.application_id

The attribute "application_id" is deprecated. Refer to the provider
documentation for details.

(and one more similar warning elsewhere)

Warning: Argument is deprecated

  with module.azdoa_weu.module.azdoa_snet.azurerm_subnet.this,
  on .terraform/modules/azdoa_weu.azdoa_snet/subnet/main.tf line 23, in resource "azurerm_subnet" "this":
  23:   private_endpoint_network_policies_enabled     = var.private_endpoint_network_policies_enabled

`private_endpoint_network_policies_enabled` will be removed in favour of the
property `private_endpoint_network_policies` in version 4.0 of the AzureRM
Provider

(and 11 more similar warnings elsewhere)

@github-actions github-actions bot removed the core label Jan 20, 2025
@sonarqubecloud SonarQubeCloud
Copy link

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

@Krusty93 Krusty93 mentioned this pull request Jan 20, 2025
Merged
@github-actions GitHub Actions
Copy link

📖 Terraform Plan ('src/common/prod') - success

Terraform Plan 
module.application_gateway_weu.data.azurerm_linux_web_app.ipatente_practices_app_itn: Still reading... [10s elapsed]
module.application_gateway_weu.data.azurerm_linux_web_app.appservice_continua: Still reading... [10s elapsed]
module.application_gateway_weu.data.azurerm_linux_web_app.appservice_selfcare_be: Still reading... [10s elapsed]
data.azurerm_linux_function_app.app_messages_xl[1]: Still reading... [10s elapsed]
data.azurerm_linux_function_app.app_messages_xl[0]: Still reading... [10s elapsed]
data.azurerm_linux_function_app.function_assets_cdn: Still reading... [10s elapsed]
module.application_gateway_weu.data.azurerm_linux_web_app.cms_backoffice_app_itn: Still reading... [10s elapsed]
module.application_gateway_weu.data.azurerm_linux_web_app.ipatente_vehicles_app_itn: Still reading... [10s elapsed]
data.azurerm_linux_function_app.function_profile: Still reading... [10s elapsed]
data.azurerm_linux_function_app.eucovidcert: Still reading... [10s elapsed]
module.application_gateway_weu.data.azurerm_linux_web_app.ipatente_practices_app_itn: Still reading... [20s elapsed]
module.application_gateway_weu.data.azurerm_linux_web_app.cms_backoffice_app_itn: Still reading... [20s elapsed]
module.application_gateway_weu.data.azurerm_linux_web_app.ipatente_vehicles_app_itn: Still reading... [20s elapsed]
data.azurerm_linux_function_app.function_profile: Still reading... [20s elapsed]
data.azurerm_linux_function_app.services_app_backend_function_app: Still reading... [10s elapsed]
data.azurerm_linux_function_app.wallet_user: Still reading... [10s elapsed]
data.azurerm_linux_function_app.io_fims_user: Still reading... [10s elapsed]
module.application_gateway_weu.data.azurerm_linux_web_app.session_manager_03: Still reading... [10s elapsed]
module.application_gateway_weu.data.azurerm_linux_web_app.ipatente_licences_app_itn: Still reading... [10s elapsed]
module.application_gateway_weu.data.azurerm_linux_web_app.appservice_devportal_be: Still reading... [10s elapsed]
data.azurerm_linux_function_app.services_app_backend_function_app: Still reading... [20s elapsed]
module.application_gateway_weu.data.azurerm_linux_web_app.ipatente_payments_app_itn: Still reading... [10s elapsed]
data.azurerm_linux_function_app.lollipop_function: Still reading... [10s elapsed]
data.azurerm_linux_function_app.io_fims_user: Still reading... [20s elapsed]
data.azurerm_linux_web_app.firmaconio_selfcare_web_app: Still reading... [10s elapsed]
module.application_gateway_weu.data.azurerm_linux_web_app.ipatente_licences_app_itn: Still reading... [20s elapsed]
module.application_gateway_weu.data.azurerm_linux_web_app.fims_op_app: Still reading... [10s elapsed]
data.azurerm_linux_function_app.io_sign_user: Still reading... [10s elapsed]
module.application_gateway_weu.data.azurerm_linux_web_app.ipatente_payments_app_itn: Still reading... [20s elapsed]
data.azurerm_linux_function_app.lollipop_function: Still reading... [20s elapsed]
module.application_gateway_weu.data.azurerm_linux_web_app.fims_op_app: Still reading... [20s elapsed]

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  + create
  ~ update in-place

Terraform will perform the following actions:

  # module.application_gateway_weu.azurerm_web_application_firewall_policy.api_app will be updated in-place
  ~ resource "azurerm_web_application_firewall_policy" "api_app" {
        id                  = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/resourceGroups/io-p-rg-external/providers/Microsoft.Network/applicationGatewayWebApplicationFirewallPolicies/io-p-waf-appgateway-api-app-policy"
        name                = "io-p-waf-appgateway-api-app-policy"
        tags                = {
            "BusinessUnit"   = "App IO"
            "CostCenter"     = "TS000 - Tecnologia e Servizi"
            "CreatedBy"      = "Terraform"
            "Environment"    = "Prod"
            "ManagementTeam" = "IO Platform"
            "Source"         = "https://github.com/pagopa/io-infra/blob/main/src/common/prod"
        }
        # (4 unchanged attributes hidden)

      ~ policy_settings {
          ~ request_body_inspect_limit_in_kb          = 0 -> 128
            # (6 unchanged attributes hidden)
        }

        # (1 unchanged block hidden)
    }

  # module.apim_itn.module.iam_adgroup_auth_admins.module.apim.azurerm_role_assignment.this["io-p-itn-common-rg-01|io-p-itn-apim-01|owner"] will be created
  + resource "azurerm_role_assignment" "this" {
      + id                               = (known after apply)
      + name                             = (known after apply)
      + principal_id                     = "912c0ba1-90b5-47eb-83f7-bf1e1294cd5c"
      + principal_type                   = (known after apply)
      + role_definition_id               = (known after apply)
      + role_definition_name             = "API Management Service Contributor"
      + scope                            = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/resourceGroups/io-p-itn-common-rg-01/providers/Microsoft.ApiManagement/service/io-p-itn-apim-01"
      + skip_service_principal_aad_check = (known after apply)
    }

  # module.apim_itn.module.iam_adgroup_bonus_admins.module.apim.azurerm_role_assignment.this["io-p-itn-common-rg-01|io-p-itn-apim-01|owner"] will be created
  + resource "azurerm_role_assignment" "this" {
      + id                               = (known after apply)
      + name                             = (known after apply)
      + principal_id                     = "831e5214-2f68-4a13-b25f-7bec962c7e1b"
      + principal_type                   = (known after apply)
      + role_definition_id               = (known after apply)
      + role_definition_name             = "API Management Service Contributor"
      + scope                            = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/resourceGroups/io-p-itn-common-rg-01/providers/Microsoft.ApiManagement/service/io-p-itn-apim-01"
      + skip_service_principal_aad_check = (known after apply)
    }

  # module.apim_itn.module.iam_adgroup_com_admins.module.apim.azurerm_role_assignment.this["io-p-itn-common-rg-01|io-p-itn-apim-01|owner"] will be created
  + resource "azurerm_role_assignment" "this" {
      + id                               = (known after apply)
      + name                             = (known after apply)
      + principal_id                     = "12a48460-7d95-4d91-ab0a-1d19008aac2c"
      + principal_type                   = (known after apply)
      + role_definition_id               = (known after apply)
      + role_definition_name             = "API Management Service Contributor"
      + scope                            = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/resourceGroups/io-p-itn-common-rg-01/providers/Microsoft.ApiManagement/service/io-p-itn-apim-01"
      + skip_service_principal_aad_check = (known after apply)
    }

  # module.apim_itn.module.iam_adgroup_svc_admins.module.apim.azurerm_role_assignment.this["io-p-itn-common-rg-01|io-p-itn-apim-01|owner"] will be created
  + resource "azurerm_role_assignment" "this" {
      + id                               = (known after apply)
      + name                             = (known after apply)
      + principal_id                     = "100cb2bb-92d5-40ad-bfa9-1d3c676f13e1"
      + principal_type                   = (known after apply)
      + role_definition_id               = (known after apply)
      + role_definition_name             = "API Management Service Contributor"
      + scope                            = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/resourceGroups/io-p-itn-common-rg-01/providers/Microsoft.ApiManagement/service/io-p-itn-apim-01"
      + skip_service_principal_aad_check = (known after apply)
    }

  # module.apim_itn.module.iam_adgroup_wallet_admins.module.apim.azurerm_role_assignment.this["io-p-itn-common-rg-01|io-p-itn-apim-01|owner"] will be created
  + resource "azurerm_role_assignment" "this" {
      + id                               = (known after apply)
      + name                             = (known after apply)
      + principal_id                     = "d38daf6e-4e65-46d2-a11a-6e016b29fcbc"
      + principal_type                   = (known after apply)
      + role_definition_id               = (known after apply)
      + role_definition_name             = "API Management Service Contributor"
      + scope                            = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/resourceGroups/io-p-itn-common-rg-01/providers/Microsoft.ApiManagement/service/io-p-itn-apim-01"
      + skip_service_principal_aad_check = (known after apply)
    }

  # module.apim_weu.module.iam_adgroup_auth_admins.module.apim.azurerm_role_assignment.this["io-p-rg-internal|io-p-apim-v2-api|owner"] will be created
  + resource "azurerm_role_assignment" "this" {
      + id                               = (known after apply)
      + name                             = (known after apply)
      + principal_id                     = "912c0ba1-90b5-47eb-83f7-bf1e1294cd5c"
      + principal_type                   = (known after apply)
      + role_definition_id               = (known after apply)
      + role_definition_name             = "API Management Service Contributor"
      + scope                            = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/resourceGroups/io-p-rg-internal/providers/Microsoft.ApiManagement/service/io-p-apim-v2-api"
      + skip_service_principal_aad_check = (known after apply)
    }

  # module.apim_weu.module.iam_adgroup_bonus_admins.module.apim.azurerm_role_assignment.this["io-p-rg-internal|io-p-apim-v2-api|owner"] will be created
  + resource "azurerm_role_assignment" "this" {
      + id                               = (known after apply)
      + name                             = (known after apply)
      + principal_id                     = "831e5214-2f68-4a13-b25f-7bec962c7e1b"
      + principal_type                   = (known after apply)
      + role_definition_id               = (known after apply)
      + role_definition_name             = "API Management Service Contributor"
      + scope                            = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/resourceGroups/io-p-rg-internal/providers/Microsoft.ApiManagement/service/io-p-apim-v2-api"
      + skip_service_principal_aad_check = (known after apply)
    }

  # module.apim_weu.module.iam_adgroup_com_admins.module.apim.azurerm_role_assignment.this["io-p-rg-internal|io-p-apim-v2-api|owner"] will be created
  + resource "azurerm_role_assignment" "this" {
      + id                               = (known after apply)
      + name                             = (known after apply)
      + principal_id                     = "12a48460-7d95-4d91-ab0a-1d19008aac2c"
      + principal_type                   = (known after apply)
      + role_definition_id               = (known after apply)
      + role_definition_name             = "API Management Service Contributor"
      + scope                            = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/resourceGroups/io-p-rg-internal/providers/Microsoft.ApiManagement/service/io-p-apim-v2-api"
      + skip_service_principal_aad_check = (known after apply)
    }

  # module.apim_weu.module.iam_adgroup_svc_admins.module.apim.azurerm_role_assignment.this["io-p-rg-internal|io-p-apim-v2-api|owner"] will be created
  + resource "azurerm_role_assignment" "this" {
      + id                               = (known after apply)
      + name                             = (known after apply)
      + principal_id                     = "100cb2bb-92d5-40ad-bfa9-1d3c676f13e1"
      + principal_type                   = (known after apply)
      + role_definition_id               = (known after apply)
      + role_definition_name             = "API Management Service Contributor"
      + scope                            = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/resourceGroups/io-p-rg-internal/providers/Microsoft.ApiManagement/service/io-p-apim-v2-api"
      + skip_service_principal_aad_check = (known after apply)
    }

  # module.apim_weu.module.iam_adgroup_wallet_admins.module.apim.azurerm_role_assignment.this["io-p-rg-internal|io-p-apim-v2-api|owner"] will be created
  + resource "azurerm_role_assignment" "this" {
      + id                               = (known after apply)
      + name                             = (known after apply)
      + principal_id                     = "d38daf6e-4e65-46d2-a11a-6e016b29fcbc"
      + principal_type                   = (known after apply)
      + role_definition_id               = (known after apply)
      + role_definition_name             = "API Management Service Contributor"
      + scope                            = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/resourceGroups/io-p-rg-internal/providers/Microsoft.ApiManagement/service/io-p-apim-v2-api"
      + skip_service_principal_aad_check = (known after apply)
    }

Plan: 10 to add, 1 to change, 0 to destroy.

Warning: Argument is deprecated

  with module.application_gateway_weu.azurerm_web_application_firewall_policy.api_app,
  on ../_modules/application_gateway/firewall.tf line 62, in resource "azurerm_web_application_firewall_policy" "api_app":
  62:         disabled_rules = [
  63:           "942100",
  64:           "942120",
  65:           "942190",
  66:           "942200",
  67:           "942210",
  68:           "942240",
  69:           "942250",
  70:           "942260",
  71:           "942330",
  72:           "942340",
  73:           "942370",
  74:           "942380",
  75:           "942430",
  76:           "942440",
  77:           "942450",
  78:         ]

`disabled_rules` will be removed in favour of the `rule` property in version
4.0 of the AzureRM Provider.

(and 53 more similar warnings elsewhere)

─────────────────────────────────────────────────────────────────────────────

Note: You didn't use the -out option to save this plan, so Terraform can't
guarantee to take exactly these actions if you run "terraform apply" now.

@Krusty93 Krusty93 added this pull request to the merge queue Jan 21, 2025
Merged via the queue into main with commit 614c45b Jan 21, 2025
7 checks passed
@Krusty93 Krusty93 deleted the CES-584-allineamento-permessi-gruppi-entra-id-io-con-as-is-2 branch January 21, 2025 08:55
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@christian-calabrese christian-calabrese christian-calabrese approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@Krusty93 @christian-calabrese