azure-resources/azure-automation-account/rjAutomationAccountPermissions.json
|
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "languageVersion": "2.0", "contentVersion": "1.0.0.0", "metadata": { "_generator": { "name": "bicep", "version": "0.47.16.16243", "templateHash": "17210184920201465943" } }, "parameters": { "principalId": { "type": "string", "metadata": { "description": "The principal ID of the managed identity to assign permissions to" } }, "permissionsManifest": { "type": "string", "metadata": { "description": "JSON array of resource applications and app roles, as published by the runbooks repository. Every entry needs Name, Id and at least one AppRoleAssignments value." } } }, "variables": { "permissionsConfig": "[json(parameters('permissionsManifest'))]", "assignments": "[flatten(map(range(0, length(variables('permissionsConfig'))), lambda('i', map(variables('permissionsConfig')[lambdaVariables('i')].AppRoleAssignments, lambda('permission', createObject('appIndex', lambdaVariables('i'), 'permission', lambdaVariables('permission')))))))]" }, "imports": { "microsoftGraphV1": { "provider": "MicrosoftGraph", "version": "1.0.0" } }, "resources": { "resourceApps": { "copy": { "name": "resourceApps", "count": "[length(variables('permissionsConfig'))]" }, "existing": true, "import": "microsoftGraphV1", "type": "Microsoft.Graph/servicePrincipals@v1.0", "properties": { "appId": "[variables('permissionsConfig')[copyIndex()].Id]" } }, "appRoleAssignments": { "copy": { "name": "appRoleAssignments", "count": "[length(variables('assignments'))]" }, "import": "microsoftGraphV1", "type": "Microsoft.Graph/appRoleAssignedTo@v1.0", "properties": { "appRoleId": "[first(filter(reference(format('resourceApps[{0}]', variables('assignments')[copyIndex()].appIndex)).appRoles, lambda('role', equals(lambdaVariables('role').value, variables('assignments')[copyIndex()].permission)))).id]", "principalId": "[parameters('principalId')]", "resourceId": "[reference(format('resourceApps[{0}]', variables('assignments')[copyIndex()].appIndex)).id]" }, "dependsOn": [ "[format('resourceApps[{0}]', variables('assignments')[copyIndex()].appIndex)]", "[format('resourceApps[{0}]', variables('assignments')[copyIndex()].appIndex)]" ] } }, "outputs": { "permissionsAssigned": { "type": "array", "metadata": { "description": "One entry per resource application in the manifest: name, appId and permissionCount (number of app roles assigned)" }, "copy": { "count": "[length(variables('permissionsConfig'))]", "input": { "name": "[variables('permissionsConfig')[copyIndex()].Name]", "appId": "[variables('permissionsConfig')[copyIndex()].Id]", "permissionCount": "[length(variables('permissionsConfig')[copyIndex()].AppRoleAssignments)]" } } } } } |