cold-motherboard-88215
12/06/2022, 6:18 PMconst subscriptionId = 'MY_SUBSCRIPTION_ID';
// create food resource group
const resourceGroup = new resources.ResourceGroup(`${env}-test`, {
resourceGroupName: `${env}-test`, // physical name
});
// create sftp
const storageAccount = new storage.StorageAccount("sftp", {
resourceGroupName: resourceGroup.name,
sku: {
name: storage.SkuName.Standard_LRS,
},
kind: storage.Kind.StorageV2,
isHnsEnabled: true, // needed for sftp
accessTier: storage.AccessTier.Hot
});
// get
const managedIdentity = new UserAssignedIdentity("managed-identity", {
resourceGroupName: resourceGroup.name,
resourceName: `managed-identity`
})
const getId = (id: string) => {
const dict: {[key: string]: object} = {};
dict[id] = {};
return dict;
}
// native azure does not support creation of sftp enabled storage account,
// therefore this needs to be created
const azureCliEnableSftp = new resources.AzureCliScript("enable-sftp-storage-account", {
location: resourceGroup.location,
resourceGroupName: resourceGroup.name,
identity: {
type: resources.ManagedServiceIdentityType.UserAssigned,
userAssignedIdentities: managedIdentity.id.apply(id => {
<http://console.info|console.info>(getId(id));
return getId(id);
})
},
azCliVersion: "2.42.0",
kind: "AzureCLI",
retentionInterval: "P1D",
scriptContent: pulumi.interpolate `az storage account update --subscription=${subscriptionId} --resource-group=${resourceGroup.name} --name=${storageAccount.name} --enable-sftp=true --enable-local-user=true`
// scriptContent: pulumi.interpolate `pwd`
});
When execute my WebDesployment in azure returns the folloing output:
Adding certificates not required Registering and setting the cloud Cloud is already registered Registering and setting the cloud completed WARNING: Subscription 'XXX' not recognized. ERROR: Subscription 'XXX' not found. Check the spelling and casing and try again.
That said, I also created a Service Principe with role “Director” which I use for pulumi itself which is registered in my “Active Directory/App Registrations” which I prefer to use for this … only problem is that I do not know how to assign this to my AzureCliScriptmany-telephone-49025
12/06/2022, 7:09 PMaz
cli in the terminal?cold-motherboard-88215
12/06/2022, 7:09 PMmany-telephone-49025
12/06/2022, 7:10 PMaz account list -o table
gives the subscription id backcold-motherboard-88215
12/06/2022, 7:10 PMmany-telephone-49025
12/06/2022, 7:12 PMmanaged-identity
is missing some Roles / Permissionscold-motherboard-88215
12/06/2022, 7:14 PMmany-telephone-49025
12/06/2022, 7:15 PMauthorization.NewRoleAssignment(ctx, "script-image-role", &authorization.RoleAssignmentArgs{
PrincipalId: script.PrincipalId,
PrincipalType: pulumi.String("ServicePrincipal"),
Scope: resourceGroup.ID(),
RoleDefinitionId: pulumi.Sprintf("/subscriptions/%s/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c", config.Get(ctx, "subscription")),
})
cold-motherboard-88215
12/06/2022, 7:15 PMmany-telephone-49025
12/06/2022, 7:16 PMcold-motherboard-88215
12/06/2022, 7:16 PMmany-telephone-49025
12/06/2022, 7:16 PMcold-motherboard-88215
12/06/2022, 7:21 PM/subscriptions/%s/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c"
what’s the last guid in this string ?many-telephone-49025
12/06/2022, 8:06 PMcold-motherboard-88215
12/06/2022, 8:07 PMconst managedIdentity = new UserAssignedIdentity("managed-identity", {
location: resourceGroup.location,
resourceGroupName: resourceGroup.name,
resourceName: `${env}-managed-identity-food`,
tags: {
...tags,
domain: 'food'
}
})
// role assignment
const roleAssignment = new authorization.RoleAssignment("roleAssignment", {
principalId: managedIdentity.principalId,
principalType: "ServicePrincipal",
scope: resourceGroup.id,
roleDefinitionId: pulumi.interpolate `/subscriptions/${subscriptionId}/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c"`
}, {
dependsOn: [managedIdentity]
});
many-telephone-49025
12/06/2022, 8:08 PMcold-motherboard-88215
12/06/2022, 8:10 PMmany-telephone-49025
12/06/2022, 8:11 PMcold-motherboard-88215
12/06/2022, 8:12 PMmany-telephone-49025
12/06/2022, 8:13 PMcold-motherboard-88215
12/06/2022, 8:13 PMwhite-architect-1595
01/11/2023, 5:45 PMmany-telephone-49025
01/11/2023, 5:53 PMwhite-architect-1595
01/11/2023, 6:32 PMmany-telephone-49025
01/11/2023, 7:16 PMwhite-architect-1595
01/11/2023, 8:29 PMmany-telephone-49025
01/11/2023, 9:07 PMwhite-architect-1595
01/11/2023, 11:05 PMmany-telephone-49025
01/12/2023, 2:24 PMwhite-architect-1595
01/12/2023, 6:45 PMmany-telephone-49025
01/12/2023, 6:45 PM