marrobi
commented
2 days ago Switching to a feature, as not sure its a change in behaviour. The ask is to enable multiple deployment identities to exist in parallel.
I think the best way to do this would be to have an array of additional_deployment_identities in config.yaml. the includes identities that you want to have the same roles assigned a the identity doing the current deployment.
For example when we create the keyvault administrator role:
resource "azurerm_role_assignment" "keyvault_deployer_role" {
scope = azurerm_key_vault.kv.id
role_definition_name = "Key Vault Administrator"
principal_id = data.azurerm_client_config.current.object_id // deployer - either CICD service principal or local user
}
We do it for the current deployment ID and any also additional ones in config.yaml.
Summary
Deploying using GitHub Actions then switching and deploying (to the same TRE instance) using a DevContainer errors during the DevContainer deployment due to KeyVault permissions issue.
Problem occurs because the deployment methods use different user accounts (service principal vs user account) & Key Vault RBAC permissions are set up for one during the first deployment, and terraform errors when trying to read the Key Vault during the plan stage of the second deployment.
Steps to recreate
1. Deploy new TRE instance using GitHub Actions
Key Vault is set up with 'Key Vault Secrets Administrator' role applied to the CICD service principal account
2. Redeploy to same TRE instance using DevContainer, error occurs:
Terraform cannot read KV secrets during the plan stage as there is no 'Key Vault Secrets Administrator' RBAC role set up for the current user.
Workaround
Manually assign a Key Vault Administrator role to your user account at a scope higher than the Key Vault itself, such as the resource group or the subscription. If you assign to the Key Vault itself, terraform will error when trying to replace the role on the DevContainer deployment: