Skip to content

Commit 927fb79

Browse files
josielsouzanordcloudjosielsouzanordcloud
committed
DTOSS-12822: add managed identity for Azure Relay send access
 - Add azurerm_relay_namespace data source to resolve namespace ID for RBAC scope - Create relay-send managed identity and assign Azure Relay Sender role at namespace level - Assign managed identity to webapp and expose AZURE_RELAY_CLIENT_ID env var - Update core.bicep RBAC condition to permit assignment of Azure Relay Sender role
1 parent 0f5bf55 commit 927fb79

4 files changed

Lines changed: 32 additions & 4 deletions

File tree

‎infrastructure/modules/container-apps/data.tf‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,3 +26,9 @@ data "azurerm_private_dns_zone" "storage-account-queue" {
2626
name = "privatelink.queue.core.windows.net"
2727
resource_group_name = "rg-hub-${var.hub}-uks-private-dns-zones"
2828
}
29+
30+
data "azurerm_relay_namespace" "relay" {
31+
count = var.relay_namespace_name != null ? 1 : 0
32+
name = var.relay_namespace_name
33+
resource_group_name = var.resource_group_name_infra
34+
}

‎infrastructure/modules/container-apps/main.tf‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -34,13 +34,17 @@ module "webapp" {
3434
enable_entra_id_authentication = var.enable_entra_id_authentication
3535
app_key_vault_id = var.app_key_vault_id
3636
docker_image = var.docker_image
37-
user_assigned_identity_ids = var.deploy_database_as_container ? [] : [module.db_connect_identity[0].id]
37+
user_assigned_identity_ids = flatten([
38+
var.deploy_database_as_container ? [] : [module.db_connect_identity[0].id],
39+
var.relay_namespace_name != null ? [module.relay_send_identity[0].id] : []
40+
])
3841
environment_variables = merge(
3942
local.common_env,
4043
{
4144
ALLOWED_HOSTS = "${var.app_short_name}-web-${var.environment}.${var.default_domain},localhost,127.0.0.1"
4245
},
43-
var.deploy_database_as_container ? local.container_db_env : local.azure_db_env
46+
var.deploy_database_as_container ? local.container_db_env : local.azure_db_env,
47+
var.relay_namespace_name != null ? { AZURE_RELAY_CLIENT_ID = module.relay_send_identity[0].client_id } : {}
4448
)
4549
secret_variables = merge(
4650
{ APPLICATIONINSIGHTS_CONNECTION_STRING = var.app_insights_connection_string },

‎infrastructure/modules/container-apps/relay.tf‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,3 +13,20 @@ module "relay_hybrid_connection" {
1313
}
1414
}
1515
}
16+
17+
module "relay_send_identity" {
18+
count = var.relay_namespace_name != null ? 1 : 0
19+
source = "../dtos-devops-templates/infrastructure/modules/managed-identity"
20+
resource_group_name = azurerm_resource_group.main.name
21+
location = var.region
22+
uai_name = "mi-${var.app_short_name}-${var.environment}-relay-send"
23+
}
24+
25+
module "relay_send_role_assignment" {
26+
count = var.relay_namespace_name != null ? 1 : 0
27+
source = "../dtos-devops-templates/infrastructure/modules/rbac-assignment"
28+
principal_id = module.relay_send_identity[0].principal_id
29+
role_definition_name = "Azure Relay Sender"
30+
scope = data.azurerm_relay_namespace.relay[0].id
31+
depends_on = [module.relay_send_identity]
32+
}

‎infrastructure/terraform/resource_group_init/core.bicep‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@ var roleID = {
1717
rbacAdmin: 'f58310d9-a9f6-439a-9e8d-f62e7b41a168'
1818
storageBlobDataContributor: 'ba92f5b4-2d11-453d-a403-e96b0029c9fe'
1919
storageQueueDataContributor: '974c5e8b-45b9-4653-ba55-5f855dd0fb88'
20+
azureRelaySender: '26baccc8-eea7-41f1-98f4-1762cc7f685d'
2021
}
2122

2223
// Define role assignments for managed identity
@@ -36,7 +37,7 @@ var miRoleAssignments = [
3637
roleId: roleID.rbacAdmin
3738
description: 'Role Based Access Control Administrator access to subscription. Can assign Key Vault Secrets User, Storage Blob Data Contributor, and Storage Queue Data Contributor roles.'
3839
// Optional properties - only rbacAdmin has a condition
39-
condition: '((!(ActionMatches{\'Microsoft.Authorization/roleAssignments/write\'})) OR (@Request[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals {${roleID.kvSecretsOfficer}, ${roleID.storageBlobDataContributor}, ${roleID.storageQueueDataContributor}})) AND ((!(ActionMatches{\'Microsoft.Authorization/roleAssignments/delete\'})) OR (@Resource[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals {${roleID.kvSecretsOfficer}, ${roleID.storageBlobDataContributor}, ${roleID.storageQueueDataContributor}}))'
40+
condition: '((!(ActionMatches{\'Microsoft.Authorization/roleAssignments/write\'})) OR (@Request[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals {${roleID.kvSecretsOfficer}, ${roleID.storageBlobDataContributor}, ${roleID.storageQueueDataContributor}, ${roleID.azureRelaySender}})) AND ((!(ActionMatches{\'Microsoft.Authorization/roleAssignments/delete\'})) OR (@Resource[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals {${roleID.kvSecretsOfficer}, ${roleID.storageBlobDataContributor}, ${roleID.storageQueueDataContributor}, ${roleID.azureRelaySender}}))'
4041
conditionVersion: '2.0'
4142
}
4243
]
@@ -58,7 +59,7 @@ var groupRoleAssignments = [
5859
roleId: roleID.rbacAdmin
5960
description: 'Role Based Access Control Administrator access to subscription. Can assign Key Vault Secrets Officer, Storage Blob Data Contributor, and Storage Queue Data Contributor roles.'
6061
// Optional properties - only rbacAdmin has a condition
61-
condition: '((!(ActionMatches{\'Microsoft.Authorization/roleAssignments/write\'})) OR (@Request[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals {${roleID.kvSecretsOfficer}, ${roleID.storageBlobDataContributor}, ${roleID.storageQueueDataContributor}})) AND ((!(ActionMatches{\'Microsoft.Authorization/roleAssignments/delete\'})) OR (@Resource[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals {${roleID.kvSecretsOfficer}, ${roleID.storageBlobDataContributor}, ${roleID.storageQueueDataContributor}}))'
62+
condition: '((!(ActionMatches{\'Microsoft.Authorization/roleAssignments/write\'})) OR (@Request[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals {${roleID.kvSecretsOfficer}, ${roleID.storageBlobDataContributor}, ${roleID.storageQueueDataContributor}, ${roleID.azureRelaySender}})) AND ((!(ActionMatches{\'Microsoft.Authorization/roleAssignments/delete\'})) OR (@Resource[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals {${roleID.kvSecretsOfficer}, ${roleID.storageBlobDataContributor}, ${roleID.storageQueueDataContributor}, ${roleID.azureRelaySender}}))'
6263
conditionVersion: '2.0'
6364
}
6465
]

0 commit comments

Comments
 (0)