Azure Question posted in
The official documentation to get you started can be found here.

Restricting Azure Service Principal Access to Resources with Specific Naming Conventions

I have created a Service Principal to perform CI/CD using Terraform and GitHub Workflows. I am initially provisioning the infrastructure with Terraform, and I’m also using Terraform to make changes to my deployment.

My challenge is that I want to grant this Service Principal Contributor access only to resources (such as Container Apps and Container Registries) with names starting with "TEST." I do not want it to have access to other resources. How can I achieve that?

Tags:

2

Answers


  1. 0

    Although Azure Policy can be applied to enforce naming conventions, there aren’t any mechanisms to enforce policy for specific users. Your best bet is to limit permissions (specifically Container and website permissions) to the resources as this is what role-based security is intended for.

    It sounds like by limiting your scope to resources that start with "Test", you want to grant some flexibility for team members to manage their own experimental resources.

    If so, here are a few possible options:

    • Create a resource group for experimental resources and then grant your service-principal the granular permissions; or
    • Use separate service-principals for the initial provisioning and subsequent deployments.
      • Limit access to the initial provisioning service-principal to authorized team members.
      • When initially provisioning the Container App or Container Registry, use Terraform to apply the appropriate role assignments for the second service-principal if it starts with "Test"
      • Grant deployment pipelines for these experimental resources access to the service-principal
    Login or Signup to reply.
  2. 0

    You added the azure-devops tag to your post, but based on your description, you didn’t seem to use Azure Pipelines in your Azure DevOps organization for CI/CD.

    If we create an Azure Resource Manager service connection in an Azure DevOps organization in an automatic way as those steps in the image below, it will automatically create an app registration in the Microsoft Entra Id (formerly Azure Active Directory) as the underlying service principal to authenticate access to a resource group/Azure Subscription/management group.

    Image

    As of now, the automatic naming pattern for the service principal is <AzureDevOpsOrgName>-<ProjectName>-<SubId>. We can change its name after the service connection creation.

    Image

    Login or Signup to reply.
Please signup or login to give your own answer.

Back To Top
Search