Skip to content

Commit 02d167b

Browse files
josielsouzanordcloudjosielsouzanordcloud
authored
Merge pull request #1384 from NHSDigital/DTOSS-12822-managed-identity-azure-relay
[DTOSS-12822] - Add managed identity for Azure Relay send access
2 parents 31bc616 + f645d8c commit 02d167b

7 files changed

Lines changed: 38 additions & 4 deletions

File tree

‎infrastructure/modules/container-apps/data.tf‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,3 +26,4 @@ data "azurerm_private_dns_zone" "storage-account-queue" {
2626
name = "privatelink.queue.core.windows.net"
2727
resource_group_name = "rg-hub-${var.hub}-uks-private-dns-zones"
2828
}
29+

‎infrastructure/modules/container-apps/main.tf‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -34,13 +34,17 @@ module "webapp" {
3434
enable_entra_id_authentication = var.enable_entra_id_authentication
3535
app_key_vault_id = var.app_key_vault_id
3636
docker_image = var.docker_image
37-
user_assigned_identity_ids = var.deploy_database_as_container ? [] : [module.db_connect_identity[0].id]
37+
user_assigned_identity_ids = flatten([
38+
var.deploy_database_as_container ? [] : [module.db_connect_identity[0].id],
39+
var.relay_namespace_name != null ? [module.relay_send_identity[0].id] : []
40+
])
3841
environment_variables = merge(
3942
local.common_env,
4043
{
4144
ALLOWED_HOSTS = "${var.app_short_name}-web-${var.environment}.${var.default_domain},localhost,127.0.0.1"
4245
},
43-
var.deploy_database_as_container ? local.container_db_env : local.azure_db_env
46+
var.deploy_database_as_container ? local.container_db_env : local.azure_db_env,
47+
var.relay_namespace_name != null ? { AZURE_RELAY_CLIENT_ID = module.relay_send_identity[0].client_id } : {}
4448
)
4549
secret_variables = merge(
4650
{ APPLICATIONINSIGHTS_CONNECTION_STRING = var.app_insights_connection_string },

‎infrastructure/modules/container-apps/relay.tf‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,3 +13,20 @@ module "relay_hybrid_connection" {
1313
}
1414
}
1515
}
16+
17+
module "relay_send_identity" {
18+
count = var.relay_namespace_name != null ? 1 : 0
19+
source = "../dtos-devops-templates/infrastructure/modules/managed-identity"
20+
resource_group_name = azurerm_resource_group.main.name
21+
location = var.region
22+
uai_name = "mi-${var.app_short_name}-${var.environment}-relay-send"
23+
}
24+
25+
module "relay_send_role_assignment" {
26+
count = var.relay_namespace_name != null ? 1 : 0
27+
source = "../dtos-devops-templates/infrastructure/modules/rbac-assignment"
28+
principal_id = module.relay_send_identity[0].principal_id
29+
role_definition_name = "Azure Relay Sender"
30+
scope = var.relay_namespace_id
31+
depends_on = [module.relay_send_identity]
32+
}

‎infrastructure/modules/container-apps/variables.tf‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -206,6 +206,12 @@ variable "relay_namespace_name" {
206206
default = null
207207
}
208208

209+
variable "relay_namespace_id" {
210+
description = "The ID of the Azure Relay namespace. Used for RBAC scope."
211+
type = string
212+
default = null
213+
}
214+
209215
locals {
210216
resource_group_name = "rg-${var.app_short_name}-${var.environment}-container-app-uks"
211217

‎infrastructure/modules/infra/output.tf‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,10 @@ output "relay_namespace_name" {
4242
value = var.enable_relay ? module.relay_namespace[0].name : null
4343
}
4444

45+
output "relay_namespace_id" {
46+
value = var.enable_relay ? module.relay_namespace[0].id : null
47+
}
48+
4549
output "servicebus_namespace_name" {
4650
value = var.enable_service_bus ? module.servicebus_namespace[0].namespace_name : null
4751
}

‎infrastructure/terraform/main.tf‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -82,4 +82,5 @@ module "container-apps" {
8282
container_memory = var.container_memory
8383
min_replicas = var.min_replicas
8484
relay_namespace_name = var.deploy_infra ? module.infra[0].relay_namespace_name : null
85+
relay_namespace_id = var.deploy_infra ? module.infra[0].relay_namespace_id : null
8586
}

‎infrastructure/terraform/resource_group_init/core.bicep‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@ var roleID = {
1717
rbacAdmin: 'f58310d9-a9f6-439a-9e8d-f62e7b41a168'
1818
storageBlobDataContributor: 'ba92f5b4-2d11-453d-a403-e96b0029c9fe'
1919
storageQueueDataContributor: '974c5e8b-45b9-4653-ba55-5f855dd0fb88'
20+
azureRelaySender: '26baccc8-eea7-41f1-98f4-1762cc7f685d'
2021
}
2122

2223
// Define role assignments for managed identity
@@ -36,7 +37,7 @@ var miRoleAssignments = [
3637
roleId: roleID.rbacAdmin
3738
description: 'Role Based Access Control Administrator access to subscription. Can assign Key Vault Secrets User, Storage Blob Data Contributor, and Storage Queue Data Contributor roles.'
3839
// Optional properties - only rbacAdmin has a condition
39-
condition: '((!(ActionMatches{\'Microsoft.Authorization/roleAssignments/write\'})) OR (@Request[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals {${roleID.kvSecretsOfficer}, ${roleID.storageBlobDataContributor}, ${roleID.storageQueueDataContributor}})) AND ((!(ActionMatches{\'Microsoft.Authorization/roleAssignments/delete\'})) OR (@Resource[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals {${roleID.kvSecretsOfficer}, ${roleID.storageBlobDataContributor}, ${roleID.storageQueueDataContributor}}))'
40+
condition: '((!(ActionMatches{\'Microsoft.Authorization/roleAssignments/write\'})) OR (@Request[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals {${roleID.kvSecretsUser}, ${roleID.kvSecretsOfficer}, ${roleID.storageBlobDataContributor}, ${roleID.storageQueueDataContributor}, ${roleID.azureRelaySender}})) AND ((!(ActionMatches{\'Microsoft.Authorization/roleAssignments/delete\'})) OR (@Resource[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals {${roleID.kvSecretsUser}, ${roleID.kvSecretsOfficer}, ${roleID.storageBlobDataContributor}, ${roleID.storageQueueDataContributor}, ${roleID.azureRelaySender}}))'
4041
conditionVersion: '2.0'
4142
}
4243
]
@@ -58,7 +59,7 @@ var groupRoleAssignments = [
5859
roleId: roleID.rbacAdmin
5960
description: 'Role Based Access Control Administrator access to subscription. Can assign Key Vault Secrets Officer, Storage Blob Data Contributor, and Storage Queue Data Contributor roles.'
6061
// Optional properties - only rbacAdmin has a condition
61-
condition: '((!(ActionMatches{\'Microsoft.Authorization/roleAssignments/write\'})) OR (@Request[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals {${roleID.kvSecretsOfficer}, ${roleID.storageBlobDataContributor}, ${roleID.storageQueueDataContributor}})) AND ((!(ActionMatches{\'Microsoft.Authorization/roleAssignments/delete\'})) OR (@Resource[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals {${roleID.kvSecretsOfficer}, ${roleID.storageBlobDataContributor}, ${roleID.storageQueueDataContributor}}))'
62+
condition: '((!(ActionMatches{\'Microsoft.Authorization/roleAssignments/write\'})) OR (@Request[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals {${roleID.kvSecretsUser}, ${roleID.kvSecretsOfficer}, ${roleID.storageBlobDataContributor}, ${roleID.storageQueueDataContributor}, ${roleID.azureRelaySender}})) AND ((!(ActionMatches{\'Microsoft.Authorization/roleAssignments/delete\'})) OR (@Resource[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals {${roleID.kvSecretsUser}, ${roleID.kvSecretsOfficer}, ${roleID.storageBlobDataContributor}, ${roleID.storageQueueDataContributor}, ${roleID.azureRelaySender}}))'
6263
conditionVersion: '2.0'
6364
}
6465
]

0 commit comments

Comments
 (0)