Assign VM Contributor role on workspace rg (not subscription) #2398
Conversation
|
/test |
|
🤖 pr-bot 🤖 🏃 Running tests: https://github.com/microsoft/AzureTRE/actions/runs/2787271098 (with refid (in response to this comment from @tamirkamara) |
tamirkamara
changed the title
tamirkamara
force-pushed
the
tamirkamara/2389-api-vm-contributor-in-workspace
branch
from
7478b13
to
60e8166
Compare
|
/test-extended |
|
🤖 pr-bot 🤖 🏃 Running extended tests: https://github.com/microsoft/AzureTRE/actions/runs/2789069895 (with refid (in response to this comment from @tamirkamara) |
1 similar comment
|
🤖 pr-bot 🤖 🏃 Running extended tests: https://github.com/microsoft/AzureTRE/actions/runs/2789069895 (with refid (in response to this comment from @tamirkamara) |
|
/test-extended |
|
🤖 pr-bot 🤖 🏃 Running extended tests: https://github.com/microsoft/AzureTRE/actions/runs/2794621543 (with refid (in response to this comment from @tamirkamara) |
|
/test-extended |
|
🤖 pr-bot 🤖 🏃 Running extended tests: https://github.com/microsoft/AzureTRE/actions/runs/2795029597 (with refid (in response to this comment from @tamirkamara) |
|
/test-extended |
|
🤖 pr-bot 🤖 🏃 Running extended tests: https://github.com/microsoft/AzureTRE/actions/runs/2795136336 (with refid (in response to this comment from @tamirkamara) |
|
/test-extended |
|
🤖 pr-bot 🤖 🏃 Running extended tests: https://github.com/microsoft/AzureTRE/actions/runs/2796214587 (with refid (in response to this comment from @tamirkamara) |
|
/test-extended |
|
🤖 pr-bot 🤖 🏃 Running extended tests: https://github.com/microsoft/AzureTRE/actions/runs/2798019539 (with refid (in response to this comment from @tamirkamara) |
tamirkamara
deleted the
tamirkamara/2389-api-vm-contributor-in-workspace
branch
|
@tamirkamara this causes a larger issue for existing workspaces. Once the subscription level role assignment is removed users cannot list VM user resources as they rely on this role assignment to query the power state. This means as soon as try to list any resources get 500 errors. Can we make sure this is covered in breaking changes, and maybe we need a script that adds the role to workspaces, or a way to update workspaces... |
What is being addressed
We give the API identity this role on the subscription level which is too wide on the permission level and the scope level.
This is a partial solution to #2389.
How is this addressed
Migration Steps (breaking change)
You will loose the ability to stop/start VMs in existing workspaces versioned 0.3.20 or lower. To address this, assign
Virtual Machine Contributortoid-api-<TRE_ID>identity on pre-existing workspace resource groups.