arcus-azure / arcus-azure/arcus.scripting

Provide functionality to assign a role to a resource group based on the ObjectId

Open
#150 1 comment 0 reactions 0 assignees View on GitHub
area:security feature-suggestion
Dominant language
PowerShell
Stars
10
Forks
13
PR merge metrics
No merged PRs in 30d

Description

**Is your feature request related to a problem? Please describe.**
Currently, the script `New-AzResourceGroupRoleAssignment` allows you to assign a role to a specific resource group for a resource/service.
While this is a start, one could also require the capability of assigning a specific role to a resource group in name of a user/group/...
In this case, it would be interesting to provide the capability to pass along an ObjectId instead of the resourceGroupName/resourceName-combination

**Describe the solution you'd like**
Can we extend the current function `New-AzResourceGroupRoleAssignment` to allow either passing along the `ObjectId` OR the `ResourceGroupName`/`ResourceName`-combo?
Using a ParameterSetName we should be able to force the user to either provide the ObjectId or the ResourceGroupName/ResourceName.

Meaning the script will either perform the lookup for ObjectId itself (if it's a resource/service), or use the provided ObjectId to assign a new role.

**Describe alternatives you've considered**
Alternately, this would mean having a separate script to make this possible.

**Additional context**
We might have to modify the parameter-definition to something as follows (based on a first quick test): _see below_.
However, I would've hoped it to be possible to keep the exception-throwing as part of the parameter-definition in itself. (--> to be investigated)
```powershell
[CmdletBinding(DefaultParametersetName='None')]
param (
[Parameter(Mandatory = $true)][string] $TargetResourceGroupName = $(throw "Target resource group name to which access should be granted is required"),
[Parameter(ParameterSetName='Resource',Mandatory = $true)][string] $ResourceGroupName,
[Parameter(ParameterSetName='Resource',Mandatory = $true)][string] $ResourceName,
[Parameter(Mandatory = $true)][string] $RoleDefinitionName = $(throw "Name of the role definition is required"),
[Parameter(ParameterSetName='Object',Mandatory = $true)][string] $ObjectId
)

$ParamSetName = $PsCmdLet.ParameterSetName

if($ParamSetName -eq 'Resource')
{
if(-not($ResourceGroupName))
{
throw "Resource group name where the resource is located which should be granted access is required"
}
if(-not($ResourceName))
{
throw "Name of the resource which should be granted access is required"
}
}
elseif($ParamSetName -eq 'Object')
{
if(-not($ObjectId))
{
throw "The ObjectId of the resource that needs to get a role assigned."
}
}
else
{
throw "Please provide either the ObjectId- or the ResourceGroupName/ResourceName-parameters."
}
```

Contributor guide

Open the contributing guide

Research direction

Start by inspecting the New-AzResourceGroupRoleAssignment script and its current parameter definition. Compare the existing ResourceGroupName/ResourceName lookup path with the requested ObjectId path, then verify that parameter sets enforce either input form and that both paths assign the requested role correctly.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure, powershell
Domain
authorization, cloud
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.