Skip to content

Added an additional note to the wiki to better explain the MSI role assignment #855

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
AlexanderSehr merged 3 commits into from
Jan 6, 2022
Merged

Added an additional note to the wiki to better explain the MSI role assignment #855

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
13b57ba
Added an additional note to the wiki
AlexanderSehr Jan 4, 2022
ad95117
Update to latest
AlexanderSehr Jan 4, 2022
8830a48
Update to latest
AlexanderSehr Jan 5, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion arm/Microsoft.Compute/virtualMachines/.parameters/linux.parameters.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -137,7 +137,7 @@
"EncryptionOperation": "EnableEncryption",
"KeyVaultURL": "https://adp-sxx-az-kv-x-001.vault.azure.net/",
"KeyVaultResourceId": "/subscriptions/<<subscriptionId>>/resourceGroups/validation-rg/providers/Microsoft.KeyVault/vaults/adp-sxx-az-kv-x-001",
"KeyEncryptionKeyURL": "https://adp-sxx-az-kv-x-001.vault.azure.net/keys/keyEncryptionKey/1dcaf3e93b44433bba0232e9eec54cc7",
"KeyEncryptionKeyURL": "https://adp-sxx-az-kv-x-001.vault.azure.net/keys/keyEncryptionKey/1dcaf3e93b44433bba0232e9eec54cc7", // ID must be updated for new keys
"KekVaultResourceId": "/subscriptions/<<subscriptionId>>/resourceGroups/validation-rg/providers/Microsoft.KeyVault/vaults/adp-sxx-az-kv-x-001",
"KeyEncryptionAlgorithm": "RSA-OAEP",
"VolumeType": "All",
Expand Down
2 changes: 1 addition & 1 deletion arm/Microsoft.Compute/virtualMachines/.parameters/windows.parameters.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -154,7 +154,7 @@
"EncryptionOperation": "EnableEncryption",
"KeyVaultURL": "https://adp-sxx-az-kv-x-001.vault.azure.net/",
"KeyVaultResourceId": "/subscriptions/<<subscriptionId>>/resourceGroups/validation-rg/providers/Microsoft.KeyVault/vaults/adp-sxx-az-kv-x-001",
"KeyEncryptionKeyURL": "https://adp-sxx-az-kv-x-001.vault.azure.net/keys/keyEncryptionKey/1dcaf3e93b44433bba0232e9eec54cc7",
"KeyEncryptionKeyURL": "https://adp-sxx-az-kv-x-001.vault.azure.net/keys/keyEncryptionKey/1dcaf3e93b44433bba0232e9eec54cc7", // ID must be updated for new keys
"KekVaultResourceId": "/subscriptions/<<subscriptionId>>/resourceGroups/validation-rg/providers/Microsoft.KeyVault/vaults/adp-sxx-az-kv-x-001",
"KeyEncryptionAlgorithm": "RSA-OAEP",
"VolumeType": "All",
Expand Down
3 changes: 2 additions & 1 deletion docs/wiki/TestingDesign.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -113,7 +113,8 @@ Since also dependency resources are in turn subject to dependencies with each ot

**Second level resources**: This group of resources has a dependency only on the resource group which will host them. Resources in this group can be deployed in parallel.

1. User assigned identity: This resource is leveraged as a test identity by all resources supporting RBAC.
1. User assigned identity: This resource is leveraged by all dependency resources
> **Note**: The object ID of the [user assigned identity] must be set in several dependency parameter files. However, when you first run the pipeline, this object ID will be unknown. It is hence recommended to either manually create the MSI beforehand - or - run the pipeline without the ID once (which will cause the pipeline to fail during the ID's usage, but **after** the MSI was deployed), then update the value in the parameter files and finally re-run the pipeline.
1. Policy assignment: This resource is leveraged by the [policy exemption] resource.
1. Log analytics workspace: This resource is leveraged by all resources supporting diagnostic settings on LAW.
1. Storage account: This resource is leveraged by all resources supporting diagnostic settings on a storage account.
Expand Down
2 changes: 1 addition & 1 deletion ...pipelines/dependencies/Microsoft.Authorization/roleAssignments/parameters/parameters.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@
"value": "Contributor"
},
"principalId": {
"value": "cf33fea8-b30f-424f-ab73-c48d99e0b222"
"value": "cf33fea8-b30f-424f-ab73-c48d99e0b222" // The object ID of the deployed MSI
},
"subscriptionId": {
"value": "<<subscriptionId>>"
Expand Down
2 changes: 1 addition & 1 deletion ...ities/pipelines/dependencies/Microsoft.RecoveryServices/vaults/parameters/parameters.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -254,7 +254,7 @@
{
"roleDefinitionIdOrName": "Reader",
"principalIds": [
"cf33fea8-b30f-424f-ab73-c48d99e0b222"
"cf33fea8-b30f-424f-ab73-c48d99e0b222" // The object ID of the deployed MSI
]
}
]
Expand Down