Azure / Azure/Azure-Landing-Zones

GitHub PAT requires too many permissions

Open
#412 1 comment 1 reaction 0 assignees View on GitHub
Product: Accelerator :zap: Transfer From: alz-powershell-module :arrow_right:
Dominant language
PowerShell
Stars
96
Forks
70
Avg merge
3d 1h
Merged PRs (30d)
7

Description

### Community Note

- Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request
- Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
- If you are interested in working on this issue or have submitted a pull request, please leave a comment

### Description

My customer is concerned with the amount of permissions that the GitHub PAT requires and is specifically concerned with the ```admin:org``` and ```delete_repo``` permissions. They decided to deploy manually using the ```-c local``` option

**Describe the solution you'd like**

Provide options for the customer.

- I believe that the ```delete_repo``` is only required for a ```terraform destroy``` command. We could mention that it is optional in the documentation.
- For the ```admin:org``` option, modify the accelerator to use an existing approval team if it already exists. Then provide instructions to the customer as to how to create the team manually themselves.

**Additional context**

Contributor guide

Open the contributing guide

Research direction

Start by reviewing the GitHub PAT permission requirements for the accelerator and the -c local deployment path. Verify whether delete_repo is needed only for terraform destroy, then assess reuse or manual creation of an admin:org approval team. Done means customers have clearly documented least-privilege options and the accelerator behavior matches them.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure, github, powershell, terraform
Domain
cloud, documentation, infrastructure
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.