7

How can I give a service principal access to assign a role to a resource it created?

Here's the scenario.

I...

  • Created an Azure DevOps pipeline
  • Created a Service Connection (which creates a service principal and grants it Contributor access to the entire subscription).
  • Created a pipeline task AzureCLI@1 using the service connection
  • Executed az group create … - SUCCESS - made a resource group!
  • Executed az group deployment create … - SUCCESS - deployed some stuff!
    • ^-- (Unless I do any role assignments as part of my ARM template)
  • Executed az role assignment create … - FAILURE

ERROR: Insufficient privileges to complete the operation.

I tried making the service principal Owner instead of Contributor. No difference.

This made me understand (kinda) why: Azure Service principal insufficient permissions to manage other service principals

Which lead me here: https://learn.microsoft.com/en-ca/azure/devops/pipelines/release/azure-rm-endpoint?view=azure-devops#failed-to-assign-contributor-role

But I'm a little stuck. I think I'm supposed to grant my service principal some sort of role within active directory so that it's allowed to manage role assignments.

I found this: https://learn.microsoft.com/en-us/azure/active-directory/users-groups-roles/roles-delegate-by-task#roles-and-administrators

Based on that, it seems I should give my service principal Privileged role administrator access. scary.

Then I found this: https://learn.microsoft.com/en-us/azure/role-based-access-control/custom-roles

Because I wanted to limit this service principal to only be able to flex the active directory powers within a single subscription, which seems to be possible in the AssignableScopes property.

But two things are giving me pause, which brings me here.

1) I'm relatively unfamiliar with what I'm doing, and I'm tossing around big scary terms like Administrator shudder. Time to consult some experts!

2) This seems complex. The task I'm performing seems like it should not be complex. I'm just trying to deploy AKS and a Container Registry in an Azure Pipeline and give AKS access to the registry. Which is what all the docs say to do (albeit at the commandline, not in a pipeline).

So, should I really be creating a custom role just for the subscription which gives Privileged role administrator type privileges assignable only to the subscription, then granting my service principal that role?

Or... How do I do this?

EDIT:

I did try creating a custom role with action Microsoft.Authorization/write. It failed with this error: 'Microsoft.Authorization/write' does not match any of the actions supported by the providers.

But I succeeded in creating one with action Microsoft.Authorization/*/write as well as Microsoft.Authorization/*

My .json definition looks like: 

{
  "Name": "...", "Description": "...", "IsCustom": true,
  "Actions": [ "Microsoft.Authorization/*" ],
  "AssignableScopes": [
    "/subscriptions/[subscriptionid]"
  ]
}

After assigning the role to the service principal, it still failed with insufficient access. I logged in locally via az login --service-principal, tried to use my new powers, and got this message:

The client '...' with object id '...' does not have authorization to perform action 'Microsoft.Resources/subscriptions/resourceGroups/.../Microsoft.Authorization/read' over scope '/subscriptions/.../resourceGroups/.../.../providers/Microsoft.Authorization/roleDefinitions' or the scope is invalid. If access was recently granted, please refresh your credentials.

EDIT: SOLUTION 

{
  "Name": "...", "Description": "...", "IsCustom": true,
  "Actions": [ 
    "Microsoft.Authorization/roleAssignments/read",
    "Microsoft.Authorization/roleAssignments/write"
  ],
  "AssignableScopes": [
    "/subscriptions/[subscriptionid]"
  ]
}

This works with az role definition create.

The service principal also needs to be a Directory Reader, unless you specify the role assignment by object-id. Azure Active Directory: Add Service Principal to Directory Readers Role with PowerShell

It can be assigned to the service principal, and when executing az commands as that service principal, it succeeds in creating role assignments.

Josh
  • 2,958
  • 3
  • 16
  • 27

1 Answers1

1

you need to grant it Microsoft.Authorization/roleAssignments/write custom permission or the built-in role of owner. scope would be subscription if you want to be able to do that for every resource group\resource in the subscription or you can be more granular (say specific resource groups or even resources).

your custom role link is the right way to create custom roles.

edit: OP needed to add Microsoft.Authorization/roleAssignments/read as well, for me it works without it.

4c74356b41
  • 69,186
  • 6
  • 100
  • 141
  • The built-in "Owner" role does not work. It only works for users, not service principals. I've edited my answer to show the results of trying to grant it Microsoft.Authorization/write permissions (failed) – Josh Sep 16 '19 at 16:30
  • 1
    right, because it failed to read permissions. you need to assign that permission as well if you want to actually read those. and it doesnt matter if its a user or a service principal from the RBAC standpoint – 4c74356b41 Sep 16 '19 at 16:33
  • I assigned Microsoft.Authorization/* and it didn't work. I assigned Microsoft.Authorization/*/read and Microsoft.Authorization/*/write and it didn't work. I created it with az ad sp create-for-rbac --role Owner and it didn't work. – Josh Sep 16 '19 at 17:09
  • I create it using az ad sp create-for-rbac and assign it using az role assignments create --assignee [appId from prev command] and login using az login --service-principal [appId from prev command] – Josh Sep 16 '19 at 17:13
  • just try `az ad sp create-for-rbac -n "MyApp" --role owner` and it would work fine and [here](https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#contributor) you can check difference between owner and contributor. I dont know what you are doing wrong exactly, but for me it works with just `Microsoft.Authorization/roleAssignments/write` – 4c74356b41 Sep 16 '19 at 17:29
  • Fixed. Using your recently edited 'Microsoft.Authorization/roleAssignments/write', plus 'Microsoft.Authorization/roleAssignments/read' permissions (and a fixed scope). If you update your answer to mention /read, I'll mark it as accepted – Josh Sep 16 '19 at 17:56