Hi all, is it possible somehow to create temporary resources in another resource's lifecycle hooks? Background: https://github.com/pulumi/pulumi/discussions/20702

I've been looking into it. Not currently possible

Too bad. But at least I've got an answer now, thanks so much! 🙂

possibly dumb question, why can't your deployment (local and pipeline) use a shared, known role that is passed to the roleassignment?

I'm not sure I understand your question. The issue is that the role assignment will depend on whatever security principal the deployment uses to access Azure. That principal will obviously not be the same in the pipeline vs. locally.

I come from an AWS background & am not familiar with Azure, so I may be misapplying my understanding of how roles/principals work here. Is it a requirement that you must create a role assignment specifically for the created vault resource only after creating it? Or is it possible to create a more general "this principal can create vaults and also write secrets into those vaults" role and assign it to all the principals that are allowed to run the pipeline?

@chilly-sunset-85353 That might be possible but: • One might not want to grant the principal the relevant permissions (role "Key Vault Administrator") on all key vaults in the given Azure subscription or resource group. • It doesn't change the fact that you still have to authorize all relevant principals. I can do that right now, too, at the level of the individual key vault I'm deploying. Either way, those role assignments will be permanent, and this is really what I'm trying to avoid. In other words, what I want is for the principal who executes the pipeline (and who already has the Owner role for the entire subscription for the purposes of deployment) to temporarily take on the Key Vault Administrator role to add secrets to the key vault and then drop that role again. So I'm trying to work around a flaw in Azure's RBAC system which is that, for some arcane reason, the Owner role doesn't automatically imply the Key Vault Administrator role. Now as for why I don't want to assign the Key Vault Administrator role permanently: We use Azure's Privileged Identity Management (PIM) to only temporarily assign privileged roles (i.e. Owner/Contributor) to our principals, after approval by the relevant authority. Assigning Key Vault Administrator to certain principals permanently would circumvent the entire system.

> We use Azure's Privileged Identity Management (PIM) to only temporarily assign privileged roles (i.e. Owner/Contributor) to our principals, after approval by the relevant authority. and I take it it's not possible to also temporarily assign the relevant Key Vault role because of: > for some arcane reason, the Owner role doesn't automatically imply the Key Vault Administrator role well that's a pickle! depending on what language you're using, you may be able to hack this together using a dynamic provider 🤔

> well that's a pickle! Yup 🫠 > or possibly the Command resource I remember looking at Command resource a while ago. It seems to be very close to what I want, except that, ideally, I would like to execute not a script (involing curl, the Azure API, manual auth, …) but a Python function which invokes the Azure provider to create (or remove¹) the relevant role assignment resource. (¹ Not sure if the Azure provider even offers a way to do that.)

I haven't worked with dynamic providers myself because I'm using C# which doesn't support them, but here's the documentation: https://www.pulumi.com/docs/iac/concepts/resources/dynamic-providers/