possibility to disable edit template version

[azMantas]

To ensure stability we would like to disable editing feature in templateSpecs. We could provide additional parameter by creating a templaceSpec "-edit $false"

[stweb1963]

This seems more of an RBAC action by defining and assigning role(s) based on

Microsoft.Resources/templateSpecs/read|write|delete
Microsoft.Resources/templateSpecs/versions/read|write|delete

There aren't any specific roles defined yet but nothing that can't be handled with a custom role

https://docs.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations

[azMantas]

we want to allow people to create a new versions, and we don't want to stop them from doing that. But we want to be sure that new versions are created, instead of overwriting existing one. Just say so that we have a stable version 1.0 and if someone tries to update the same version will be denied instead of prompt to overwrite

Template Spec version '1' already exists and this action will overwrite existing data for this version. Are you sure you'd like to overwrite existing Template Spec version data for Template Spec 'a' version '1'?

my question is: how to disable overwriting existing version?

[alex-frankel]

There is no way to disable it today so that we can allow for hotfixes if needed. That being said, the ask makes sense. We will discuss on our side to see if we could add a property that would disable overwrites. cc @apclouds

[stweb1963]

Understand

We mitigated this risk by only allowing our pipeline to write templateSpecs Everyone else has read except if you've been granted specific RBAC rights

The version is either

• while in development
  • the name of the branch
• released via PR
  • the major.minor.0 (tagged) semantic version
  • we can redeploy by tag if we suspect the version was compromised

[azMantas]

theoretically speaking, we also have a pipeline that creates a new template versions and that just works. But in reality few people have direct access to template specs...