Reduction in Privileges in Azure

[halprin]

Backlog Task

The CDC unilaterally reduced the permissions of the role assigned to our GitHub deployer and our user accounts. We need to work with the CDC to understand why this was done, push back if we can, and subsequently modify our Terraform depending on the discussions with the CDC.

Completion Criteria

• We come to a conclusion of having our permissions restored in some form or fashion or not.
• Our Terraform is updated to remove items from management that we can no longer modify.

Tasks

• Research what has been impacted by this priviledge change (other than our NSGs). - @halprin
• Respond to Bob's e-mail. - @halprin
• Update TI's Terraform and successfully deploy to Dev environment.
• Update TI's Terraform and successfully deploy to PR environment.
• Remove the same resources from the Internal environment's TF state and successfully deploy.
• Push TI's Terraform updates to Staging and Production.
• Update SFTP Ingestion's Terraform and successfully deploy to Dev environment.
• Push SFTP Ingestion's Terraform updates to Staging.

Other Notes

• Any other notes to help clarify this task for the team

[somesylvie]

CDC wants to own route tables, network security groups, and peering settings

For envs where these resources already exist, we'll need to remove them from terraform state and convert them in our TF from resources to data sources (removing them from state tells TF we're not managing those and it shouldn't delete them). By using the Azure Portal Cloud Shell, we can interact with the Terraform CLI while logged in as ourselves (this will be the easiest way to manage this stuff for the -SU accounts). Clone our repo, CD into our TF directories, terraform init, then run commands to remove the relevant resources

For envs where these resources don't yet exist (prod for ingestion service), we'll need to submit a helpdesk ticket to get the relevant resources created. The naming convention will need to match our existing resources or else we'll have to have them recreate everything, which is much riskier