[CES-584] Add roles to IO AD Groups with AppBackend as scope #1387

Krusty93 · 2025-01-20T16:25:57Z

Motivation and Context

Devs will not be Contributor of the entire subscription very soon, however they will still need to operate on appbackends

Major Changes

Admins are Contributor

Dependencies

Depends on #1386

Testing

Documentation

Other Considerations

dpulls · 2025-01-21T08:55:58Z

🎉 All dependencies have been resolved !

…d-io-con-as-is-3

sonarqubecloud · 2025-01-21T09:06:21Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

github-actions · 2025-01-21T10:25:22Z

📖 Terraform Plan ('src/common/prod') - success

Terraform Plan

module.application_gateway_weu.data.azurerm_linux_web_app.appservice_continua: Still reading... [10s elapsed]
module.application_gateway_weu.data.azurerm_linux_web_app.cms_backoffice_app_itn: Still reading... [10s elapsed]
data.azurerm_linux_function_app.app_messages_xl[0]: Still reading... [10s elapsed]
data.azurerm_linux_function_app.app_messages_xl[1]: Still reading... [10s elapsed]
data.azurerm_linux_function_app.io_sign_user: Still reading... [10s elapsed]
module.application_gateway_weu.data.azurerm_linux_web_app.ipatente_licences_app_itn: Still reading... [10s elapsed]
data.azurerm_linux_function_app.services_app_backend_function_app: Still reading... [10s elapsed]
data.azurerm_linux_web_app.firmaconio_selfcare_web_app: Still reading... [10s elapsed]
data.azurerm_linux_function_app.lollipop_function: Still reading... [10s elapsed]
data.azurerm_linux_function_app.wallet_user: Still reading... [10s elapsed]
module.application_gateway_weu.data.azurerm_linux_web_app.cms_backoffice_app_itn: Still reading... [20s elapsed]
data.azurerm_linux_function_app.function_assets_cdn: Still reading... [10s elapsed]
data.azurerm_linux_function_app.eucovidcert: Still reading... [10s elapsed]
data.azurerm_linux_function_app.function_profile: Still reading... [10s elapsed]
module.application_gateway_weu.data.azurerm_linux_web_app.appservice_selfcare_be: Still reading... [10s elapsed]
data.azurerm_linux_function_app.io_fims_user: Still reading... [10s elapsed]
module.application_gateway_weu.data.azurerm_linux_web_app.ipatente_payments_app_itn: Still reading... [10s elapsed]
module.application_gateway_weu.data.azurerm_linux_web_app.session_manager_03: Still reading... [10s elapsed]
module.application_gateway_weu.data.azurerm_linux_web_app.appservice_devportal_be: Still reading... [10s elapsed]
module.application_gateway_weu.data.azurerm_linux_web_app.ipatente_practices_app_itn: Still reading... [10s elapsed]
module.application_gateway_weu.data.azurerm_linux_web_app.fims_op_app: Still reading... [10s elapsed]
module.application_gateway_weu.data.azurerm_linux_web_app.ipatente_practices_app_itn: Still reading... [20s elapsed]
module.application_gateway_weu.data.azurerm_linux_web_app.ipatente_vehicles_app_itn: Still reading... [10s elapsed]
module.application_gateway_weu.data.azurerm_linux_web_app.ipatente_vehicles_app_itn: Still reading... [20s elapsed]

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  + create
  ~ update in-place

Terraform will perform the following actions:

  # module.app_backend_li_weu.azurerm_role_assignment.appbackend_adgroup_auth_admins will be created
  + resource "azurerm_role_assignment" "appbackend_adgroup_auth_admins" {
      + id                               = (known after apply)
      + name                             = (known after apply)
      + principal_id                     = "912c0ba1-90b5-47eb-83f7-bf1e1294cd5c"
      + principal_type                   = (known after apply)
      + role_definition_id               = (known after apply)
      + role_definition_name             = "Contributor"
      + scope                            = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/resourceGroups/io-p-rg-linux/providers/Microsoft.Web/sites/io-p-app-appbackendli"
      + skip_service_principal_aad_check = (known after apply)
    }

  # module.app_backend_li_weu.azurerm_role_assignment.appbackend_adgroup_bonus_admins will be created
  + resource "azurerm_role_assignment" "appbackend_adgroup_bonus_admins" {
      + id                               = (known after apply)
      + name                             = (known after apply)
      + principal_id                     = "831e5214-2f68-4a13-b25f-7bec962c7e1b"
      + principal_type                   = (known after apply)
      + role_definition_id               = (known after apply)
      + role_definition_name             = "Contributor"
      + scope                            = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/resourceGroups/io-p-rg-linux/providers/Microsoft.Web/sites/io-p-app-appbackendli"
      + skip_service_principal_aad_check = (known after apply)
    }

  # module.app_backend_li_weu.azurerm_role_assignment.appbackend_adgroup_com_admins will be created
  + resource "azurerm_role_assignment" "appbackend_adgroup_com_admins" {
      + id                               = (known after apply)
      + name                             = (known after apply)
      + principal_id                     = "12a48460-7d95-4d91-ab0a-1d19008aac2c"
      + principal_type                   = (known after apply)
      + role_definition_id               = (known after apply)
      + role_definition_name             = "Contributor"
      + scope                            = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/resourceGroups/io-p-rg-linux/providers/Microsoft.Web/sites/io-p-app-appbackendli"
      + skip_service_principal_aad_check = (known after apply)
    }

  # module.app_backend_li_weu.azurerm_role_assignment.appbackend_adgroup_svc_admins will be created
  + resource "azurerm_role_assignment" "appbackend_adgroup_svc_admins" {
      + id                               = (known after apply)
      + name                             = (known after apply)
      + principal_id                     = "100cb2bb-92d5-40ad-bfa9-1d3c676f13e1"
      + principal_type                   = (known after apply)
      + role_definition_id               = (known after apply)
      + role_definition_name             = "Contributor"
      + scope                            = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/resourceGroups/io-p-rg-linux/providers/Microsoft.Web/sites/io-p-app-appbackendli"
      + skip_service_principal_aad_check = (known after apply)
    }

  # module.app_backend_li_weu.azurerm_role_assignment.appbackend_adgroup_wallet_admins will be created
  + resource "azurerm_role_assignment" "appbackend_adgroup_wallet_admins" {
      + id                               = (known after apply)
      + name                             = (known after apply)
      + principal_id                     = "d38daf6e-4e65-46d2-a11a-6e016b29fcbc"
      + principal_type                   = (known after apply)
      + role_definition_id               = (known after apply)
      + role_definition_name             = "Contributor"
      + scope                            = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/resourceGroups/io-p-rg-linux/providers/Microsoft.Web/sites/io-p-app-appbackendli"
      + skip_service_principal_aad_check = (known after apply)
    }

  # module.app_backend_li_weu.azurerm_role_assignment.appbackend_staging_adgroup_auth_admins will be created
  + resource "azurerm_role_assignment" "appbackend_staging_adgroup_auth_admins" {
      + id                               = (known after apply)
      + name                             = (known after apply)
      + principal_id                     = "912c0ba1-90b5-47eb-83f7-bf1e1294cd5c"
      + principal_type                   = (known after apply)
      + role_definition_id               = (known after apply)
      + role_definition_name             = "Contributor"
      + scope                            = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/resourceGroups/io-p-rg-linux/providers/Microsoft.Web/sites/io-p-app-appbackendli/slots/staging"
      + skip_service_principal_aad_check = (known after apply)
    }

  # module.app_backend_li_weu.azurerm_role_assignment.appbackend_staging_adgroup_bonus_admins will be created
  + resource "azurerm_role_assignment" "appbackend_staging_adgroup_bonus_admins" {
      + id                               = (known after apply)
      + name                             = (known after apply)
      + principal_id                     = "831e5214-2f68-4a13-b25f-7bec962c7e1b"
      + principal_type                   = (known after apply)
      + role_definition_id               = (known after apply)
      + role_definition_name             = "Contributor"
      + scope                            = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/resourceGroups/io-p-rg-linux/providers/Microsoft.Web/sites/io-p-app-appbackendli/slots/staging"
      + skip_service_principal_aad_check = (known after apply)
    }

  # module.app_backend_li_weu.azurerm_role_assignment.appbackend_staging_adgroup_com_admins will be created
  + resource "azurerm_role_assignment" "appbackend_staging_adgroup_com_admins" {
      + id                               = (known after apply)
      + name                             = (known after apply)
      + principal_id                     = "12a48460-7d95-4d91-ab0a-1d19008aac2c"
      + principal_type                   = (known after apply)
      + role_definition_id               = (known after apply)
      + role_definition_name             = "Contributor"
      + scope                            = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/resourceGroups/io-p-rg-linux/providers/Microsoft.Web/sites/io-p-app-appbackendli/slots/staging"
      + skip_service_principal_aad_check = (known after apply)
    }

  # module.app_backend_li_weu.azurerm_role_assignment.appbackend_staging_adgroup_svc_admins will be created
  + resource "azurerm_role_assignment" "appbackend_staging_adgroup_svc_admins" {
      + id                               = (known after apply)
      + name                             = (known after apply)
      + principal_id                     = "100cb2bb-92d5-40ad-bfa9-1d3c676f13e1"
      + principal_type                   = (known after apply)
      + role_definition_id               = (known after apply)
      + role_definition_name             = "Contributor"
      + scope                            = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/resourceGroups/io-p-rg-linux/providers/Microsoft.Web/sites/io-p-app-appbackendli/slots/staging"
      + skip_service_principal_aad_check = (known after apply)
    }

  # module.app_backend_li_weu.azurerm_role_assignment.appbackend_staging_adgroup_wallet_admins will be created
  + resource "azurerm_role_assignment" "appbackend_staging_adgroup_wallet_admins" {
      + id                               = (known after apply)
      + name                             = (known after apply)
      + principal_id                     = "d38daf6e-4e65-46d2-a11a-6e016b29fcbc"
      + principal_type                   = (known after apply)
      + role_definition_id               = (known after apply)
      + role_definition_name             = "Contributor"
      + scope                            = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/resourceGroups/io-p-rg-linux/providers/Microsoft.Web/sites/io-p-app-appbackendli/slots/staging"
      + skip_service_principal_aad_check = (known after apply)
    }

  # module.app_backend_weu["1"].azurerm_role_assignment.appbackend_adgroup_auth_admins will be created
  + resource "azurerm_role_assignment" "appbackend_adgroup_auth_admins" {
      + id                               = (known after apply)
      + name                             = (known after apply)
      + principal_id                     = "912c0ba1-90b5-47eb-83f7-bf1e1294cd5c"
      + principal_type                   = (known after apply)
      + role_definition_id               = (known after apply)
      + role_definition_name             = "Contributor"
      + scope                            = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/resourceGroups/io-p-rg-linux/providers/Microsoft.Web/sites/io-p-app-appbackendl1"
      + skip_service_principal_aad_check = (known after apply)
    }

  # module.app_backend_weu["1"].azurerm_role_assignment.appbackend_adgroup_bonus_admins will be created
  + resource "azurerm_role_assignment" "appbackend_adgroup_bonus_admins" {
      + id                               = (known after apply)
      + name                             = (known after apply)
      + principal_id                     = "831e5214-2f68-4a13-b25f-7bec962c7e1b"
      + principal_type                   = (known after apply)
      + role_definition_id               = (known after apply)
      + role_definition_name             = "Contributor"
      + scope                            = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/resourceGroups/io-p-rg-linux/providers/Microsoft.Web/sites/io-p-app-appbackendl1"
      + skip_service_principal_aad_check = (known after apply)
    }

  # module.app_backend_weu["1"].azurerm_role_assignment.appbackend_adgroup_com_admins will be created
  + resource "azurerm_role_assignment" "appbackend_adgroup_com_admins" {
      + id                               = (known after apply)
      + name                             = (known after apply)
      + principal_id                     = "12a48460-7d95-4d91-ab0a-1d19008aac2c"
      + principal_type                   = (known after apply)
      + role_definition_id               = (known after apply)
      + role_definition_name             = "Contributor"
      + scope                            = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/resourceGroups/io-p-rg-linux/providers/Microsoft.Web/sites/io-p-app-appbackendl1"
      + skip_service_principal_aad_check = (known after apply)
    }

  # module.app_backend_weu["1"].azurerm_role_assignment.appbackend_adgroup_svc_admins will be created
  + resource "azurerm_role_assignment" "appbackend_adgroup_svc_admins" {
      + id                               = (known after apply)
      + name                             = (known after apply)
      + principal_id                     = "100cb2bb-92d5-40ad-bfa9-1d3c676f13e1"
      + principal_type                   = (known after apply)
      + role_definition_id               = (known after apply)
      + role_definition_name             = "Contributor"
      + scope                            = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/resourceGroups/io-p-rg-linux/providers/Microsoft.Web/sites/io-p-app-appbackendl1"
      + skip_service_principal_aad_check = (known after apply)
    }

  # module.app_backend_weu["1"].azurerm_role_assignment.appbackend_adgroup_wallet_admins will be created
  + resource "azurerm_role_assignment" "appbackend_adgroup_wallet_admins" {
      + id                               = (known after apply)
      + name                             = (known after apply)
      + principal_id                     = "d38daf6e-4e65-46d2-a11a-6e016b29fcbc"
      + principal_type                   = (known after apply)
      + role_definition_id               = (known after apply)
      + role_definition_name             = "Contributor"
      + scope                            = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/resourceGroups/io-p-rg-linux/providers/Microsoft.Web/sites/io-p-app-appbackendl1"
      + skip_service_principal_aad_check = (known after apply)
    }

  # module.app_backend_weu["1"].azurerm_role_assignment.appbackend_staging_adgroup_auth_admins will be created
  + resource "azurerm_role_assignment" "appbackend_staging_adgroup_auth_admins" {
      + id                               = (known after apply)
      + name                             = (known after apply)
      + principal_id                     = "912c0ba1-90b5-47eb-83f7-bf1e1294cd5c"
      + principal_type                   = (known after apply)
      + role_definition_id               = (known after apply)
      + role_definition_name             = "Contributor"
      + scope                            = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/resourceGroups/io-p-rg-linux/providers/Microsoft.Web/sites/io-p-app-appbackendl1/slots/staging"
      + skip_service_principal_aad_check = (known after apply)
    }

  # module.app_backend_weu["1"].azurerm_role_assignment.appbackend_staging_adgroup_bonus_admins will be created
  + resource "azurerm_role_assignment" "appbackend_staging_adgroup_bonus_admins" {
      + id                               = (known after apply)
      + name                             = (known after apply)
      + principal_id                     = "831e5214-2f68-4a13-b25f-7bec962c7e1b"
      + principal_type                   = (known after apply)
      + role_definition_id               = (known after apply)
      + role_definition_name             = "Contributor"
      + scope                            = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/resourceGroups/io-p-rg-linux/providers/Microsoft.Web/sites/io-p-app-appbackendl1/slots/staging"
      + skip_service_principal_aad_check = (known after apply)
    }

  # module.app_backend_weu["1"].azurerm_role_assignment.appbackend_staging_adgroup_com_admins will be created
  + resource "azurerm_role_assignment" "appbackend_staging_adgroup_com_admins" {
      + id                               = (known after apply)
      + name                             = (known after apply)
      + principal_id                     = "12a48460-7d95-4d91-ab0a-1d19008aac2c"
      + principal_type                   = (known after apply)
      + role_definition_id               = (known after apply)
      + role_definition_name             = "Contributor"
      + scope                            = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/resourceGroups/io-p-rg-linux/providers/Microsoft.Web/sites/io-p-app-appbackendl1/slots/staging"
      + skip_service_principal_aad_check = (known after apply)
    }

  # module.app_backend_weu["1"].azurerm_role_assignment.appbackend_staging_adgroup_svc_admins will be created
  + resource "azurerm_role_assignment" "appbackend_staging_adgroup_svc_admins" {
      + id                               = (known after apply)
      + name                             = (known after apply)
      + principal_id                     = "100cb2bb-92d5-40ad-bfa9-1d3c676f13e1"
      + principal_type                   = (known after apply)
      + role_definition_id               = (known after apply)
      + role_definition_name             = "Contributor"
      + scope                            = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/resourceGroups/io-p-rg-linux/providers/Microsoft.Web/sites/io-p-app-appbackendl1/slots/staging"
      + skip_service_principal_aad_check = (known after apply)
    }

  # module.app_backend_weu["1"].azurerm_role_assignment.appbackend_staging_adgroup_wallet_admins will be created
  + resource "azurerm_role_assignment" "appbackend_staging_adgroup_wallet_admins" {
      + id                               = (known after apply)
      + name                             = (known after apply)
      + principal_id                     = "d38daf6e-4e65-46d2-a11a-6e016b29fcbc"
      + principal_type                   = (known after apply)
      + role_definition_id               = (known after apply)
      + role_definition_name             = "Contributor"
      + scope                            = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/resourceGroups/io-p-rg-linux/providers/Microsoft.Web/sites/io-p-app-appbackendl1/slots/staging"
      + skip_service_principal_aad_check = (known after apply)
    }

  # module.app_backend_weu["2"].azurerm_role_assignment.appbackend_adgroup_auth_admins will be created
  + resource "azurerm_role_assignment" "appbackend_adgroup_auth_admins" {
      + id                               = (known after apply)
      + name                             = (known after apply)
      + principal_id                     = "912c0ba1-90b5-47eb-83f7-bf1e1294cd5c"
      + principal_type                   = (known after apply)
      + role_definition_id               = (known after apply)
      + role_definition_name             = "Contributor"
      + scope                            = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/resourceGroups/io-p-rg-linux/providers/Microsoft.Web/sites/io-p-app-appbackendl2"
      + skip_service_principal_aad_check = (known after apply)
    }

  # module.app_backend_weu["2"].azurerm_role_assignment.appbackend_adgroup_bonus_admins will be created
  + resource "azurerm_role_assignment" "appbackend_adgroup_bonus_admins" {
      + id                               = (known after apply)
      + name                             = (known after apply)
      + principal_id                     = "831e5214-2f68-4a13-b25f-7bec962c7e1b"
      + principal_type                   = (known after apply)
      + role_definition_id               = (known after apply)
      + role_definition_name             = "Contributor"
      + scope                            = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/resourceGroups/io-p-rg-linux/providers/Microsoft.Web/sites/io-p-app-appbackendl2"
      + skip_service_principal_aad_check = (known after apply)
    }

  # module.app_backend_weu["2"].azurerm_role_assignment.appbackend_adgroup_com_admins will be created
  + resource "azurerm_role_assignment" "appbackend_adgroup_com_admins" {
      + id                               = (known after apply)
      + name                             = (known after apply)
      + principal_id                     = "12a48460-7d95-4d91-ab0a-1d19008aac2c"
      + principal_type                   = (known after apply)
      + role_definition_id               = (known after apply)
      + role_definition_name             = "Contributor"
      + scope                            = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/resourceGroups/io-p-rg-linux/providers/Microsoft.Web/sites/io-p-app-appbackendl2"
      + skip_service_principal_aad_check = (known after apply)
    }

  # module.app_backend_weu["2"].azurerm_role_assignment.appbackend_adgroup_svc_admins will be created
  + resource "azurerm_role_assignment" "appbackend_adgroup_svc_admins" {
      + id                               = (known after apply)
      + name                             = (known after apply)
      + principal_id                     = "100cb2bb-92d5-40ad-bfa9-1d3c676f13e1"
      + principal_type                   = (known after apply)
      + role_definition_id               = (known after apply)
      + role_definition_name             = "Contributor"
      + scope                            = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/resourceGroups/io-p-rg-linux/providers/Microsoft.Web/sites/io-p-app-appbackendl2"
      + skip_service_principal_aad_check = (known after apply)
    }

  # module.app_backend_weu["2"].azurerm_role_assignment.appbackend_adgroup_wallet_admins will be created
  + resource "azurerm_role_assignment" "appbackend_adgroup_wallet_admins" {
      + id                               = (known after apply)
      + name                             = (known after apply)
      + principal_id                     = "d38daf6e-4e65-46d2-a11a-6e016b29fcbc"
      + principal_type                   = (known after apply)
      + role_definition_id               = (known after apply)
      + role_definition_name             = "Contributor"
      + scope                            = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/resourceGroups/io-p-rg-linux/providers/Microsoft.Web/sites/io-p-app-appbackendl2"
      + skip_service_principal_aad_check = (known after apply)
    }

  # module.app_backend_weu["2"].azurerm_role_assignment.appbackend_staging_adgroup_auth_admins will be created
  + resource "azurerm_role_assignment" "appbackend_staging_adgroup_auth_admins" {
      + id                               = (known after apply)
      + name                             = (known after apply)
      + principal_id                     = "912c0ba1-90b5-47eb-83f7-bf1e1294cd5c"
      + principal_type                   = (known after apply)
      + role_definition_id               = (known after apply)
      + role_definition_name             = "Contributor"
      + scope                            = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/resourceGroups/io-p-rg-linux/providers/Microsoft.Web/sites/io-p-app-appbackendl2/slots/staging"
      + skip_service_principal_aad_check = (known after apply)
    }

  # module.app_backend_weu["2"].azurerm_role_assignment.appbackend_staging_adgroup_bonus_admins will be created
  + resource "azurerm_role_assignment" "appbackend_staging_adgroup_bonus_admins" {
      + id                               = (known after apply)
      + name                             = (known after apply)
      + principal_id                     = "831e5214-2f68-4a13-b25f-7bec962c7e1b"
      + principal_type                   = (known after apply)
      + role_definition_id               = (known after apply)
      + role_definition_name             = "Contributor"
      + scope                            = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/resourceGroups/io-p-rg-linux/providers/Microsoft.Web/sites/io-p-app-appbackendl2/slots/staging"
      + skip_service_principal_aad_check = (known after apply)
    }

  # module.app_backend_weu["2"].azurerm_role_assignment.appbackend_staging_adgroup_com_admins will be created
  + resource "azurerm_role_assignment" "appbackend_staging_adgroup_com_admins" {
      + id                               = (known after apply)
      + name                             = (known after apply)
      + principal_id                     = "12a48460-7d95-4d91-ab0a-1d19008aac2c"
      + principal_type                   = (known after apply)
      + role_definition_id               = (known after apply)
      + role_definition_name             = "Contributor"
      + scope                            = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/resourceGroups/io-p-rg-linux/providers/Microsoft.Web/sites/io-p-app-appbackendl2/slots/staging"
      + skip_service_principal_aad_check = (known after apply)
    }

  # module.app_backend_weu["2"].azurerm_role_assignment.appbackend_staging_adgroup_svc_admins will be created
  + resource "azurerm_role_assignment" "appbackend_staging_adgroup_svc_admins" {
      + id                               = (known after apply)
      + name                             = (known after apply)
      + principal_id                     = "100cb2bb-92d5-40ad-bfa9-1d3c676f13e1"
      + principal_type                   = (known after apply)
      + role_definition_id               = (known after apply)
      + role_definition_name             = "Contributor"
      + scope                            = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/resourceGroups/io-p-rg-linux/providers/Microsoft.Web/sites/io-p-app-appbackendl2/slots/staging"
      + skip_service_principal_aad_check = (known after apply)
    }

  # module.app_backend_weu["2"].azurerm_role_assignment.appbackend_staging_adgroup_wallet_admins will be created
  + resource "azurerm_role_assignment" "appbackend_staging_adgroup_wallet_admins" {
      + id                               = (known after apply)
      + name                             = (known after apply)
      + principal_id                     = "d38daf6e-4e65-46d2-a11a-6e016b29fcbc"
      + principal_type                   = (known after apply)
      + role_definition_id               = (known after apply)
      + role_definition_name             = "Contributor"
      + scope                            = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/resourceGroups/io-p-rg-linux/providers/Microsoft.Web/sites/io-p-app-appbackendl2/slots/staging"
      + skip_service_principal_aad_check = (known after apply)
    }

  # module.application_gateway_weu.azurerm_web_application_firewall_policy.api_app will be updated in-place
  ~ resource "azurerm_web_application_firewall_policy" "api_app" {
        id                  = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/resourceGroups/io-p-rg-external/providers/Microsoft.Network/applicationGatewayWebApplicationFirewallPolicies/io-p-waf-appgateway-api-app-policy"
        name                = "io-p-waf-appgateway-api-app-policy"
        tags                = {
            "BusinessUnit"   = "App IO"
            "CostCenter"     = "TS000 - Tecnologia e Servizi"
            "CreatedBy"      = "Terraform"
            "Environment"    = "Prod"
            "ManagementTeam" = "IO Platform"
            "Source"         = "https://github.com/pagopa/io-infra/blob/main/src/common/prod"
        }
        # (4 unchanged attributes hidden)

      ~ policy_settings {
          ~ request_body_inspect_limit_in_kb          = 0 -> 128
            # (6 unchanged attributes hidden)
        }

        # (1 unchanged block hidden)
    }

Plan: 30 to add, 1 to change, 0 to destroy.

Warning: Argument is deprecated

  with module.application_gateway_weu.azurerm_web_application_firewall_policy.api_app,
  on ../_modules/application_gateway/firewall.tf line 62, in resource "azurerm_web_application_firewall_policy" "api_app":
  62:         disabled_rules = [
  63:           "942100",
  64:           "942120",
  65:           "942190",
  66:           "942200",
  67:           "942210",
  68:           "942240",
  69:           "942250",
  70:           "942260",
  71:           "942330",
  72:           "942340",
  73:           "942370",
  74:           "942380",
  75:           "942430",
  76:           "942440",
  77:           "942450",
  78:         ]

`disabled_rules` will be removed in favour of the `rule` property in version
4.0 of the AzureRM Provider.

(and 53 more similar warnings elsewhere)

─────────────────────────────────────────────────────────────────────────────

Note: You didn't use the -out option to save this plan, so Terraform can't
guarantee to take exactly these actions if you run "terraform apply" now.

add roles to appbackend

0ecefa8

Krusty93 temporarily deployed to prod-ci January 20, 2025 16:26 — with GitHub Actions Inactive

Krusty93 changed the title ~~add roles to appbackend~~ [CES-584] Add roles to IO AD Groups with AppBackend as scope Jan 20, 2025

Krusty93 temporarily deployed to prod-ci January 20, 2025 16:29 — with GitHub Actions Inactive

Merge branch 'main' into CES-584-allineamento-permessi-gruppi-entra-i…

24e4331

…d-io-con-as-is-3

Krusty93 temporarily deployed to prod-ci January 21, 2025 09:06 — with GitHub Actions Inactive

Krusty93 marked this pull request as ready for review January 21, 2025 09:06

Krusty93 requested review from a team as code owners January 21, 2025 09:06

Krusty93 had a problem deploying to prod-ci January 21, 2025 09:06 — with GitHub Actions Error

Krusty93 temporarily deployed to prod-ci January 21, 2025 10:22 — with GitHub Actions Inactive

christian-calabrese approved these changes Jan 21, 2025

View reviewed changes

Krusty93 added this pull request to the merge queue Jan 21, 2025

Merged via the queue into main with commit 3722e85 Jan 21, 2025
8 checks passed

Krusty93 deleted the CES-584-allineamento-permessi-gruppi-entra-id-io-con-as-is-3 branch January 21, 2025 11:26

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[CES-584] Add roles to IO AD Groups with AppBackend as scope #1387

[CES-584] Add roles to IO AD Groups with AppBackend as scope #1387

Krusty93 commented Jan 20, 2025

dpulls bot commented Jan 21, 2025

sonarqubecloud bot commented Jan 21, 2025

github-actions bot commented Jan 21, 2025

[CES-584] Add roles to IO AD Groups with AppBackend as scope #1387

[CES-584] Add roles to IO AD Groups with AppBackend as scope #1387

Conversation

Krusty93 commented Jan 20, 2025

Motivation and Context

Major Changes

Dependencies

Testing

Documentation

Other Considerations

dpulls bot commented Jan 21, 2025

sonarqubecloud bot commented Jan 21, 2025

Quality Gate passed

github-actions bot commented Jan 21, 2025

📖 Terraform Plan ('src/common/prod') - success