fix(terraform): update role assignments to use demo_group for AKS, OpenAI, and Service Bus modules

Author: pauldotyu

infra/terraform/kubernetes.tf

@@ -64,8 +64,11 @@ module "aks" {
 module "aks-role" {
   source  = "Azure/avm-res-authorization-roleassignment/azurerm"
   version = "0.2.0"
-  users_by_object_id = {
-    current_user = data.azurerm_client_config.current.object_id
+  # users_by_object_id = {
+  #   current_user = data.azurerm_client_config.current.object_id
+  # }
+  groups_by_object_id = {
+    demo_group = azuread_group_without_members.example.object_id
   }
   role_definitions = {
     aks_cluster_admin_role = {
@@ -78,7 +81,7 @@ module "aks-role" {
       role_assignments = {
         role_assignment_1 = {
           role_definition = "aks_cluster_admin_role"
-          any_principals  = ["current_user"]
+          groups          = ["demo_group"]
         }
       }
     }

infra/terraform/main.tf

@@ -82,3 +82,9 @@ resource "azurerm_resource_group" "example" {
   name     = "rg-${local.name}"
   location = var.location
 }
+
+resource "azuread_group_without_members" "example" {
+  display_name     = "AKS Store Demo App"
+  owners           = [data.azuread_client_config.current.object_id]
+  security_enabled = true
+}

infra/terraform/openai.tf

@@ -44,8 +44,11 @@ module "aoai-role" {
   count   = local.deploy_azure_openai ? 1 : 0
   source  = "Azure/avm-res-authorization-roleassignment/azurerm"
   version = "0.2.0"
-  users_by_object_id = {
-    current_user = data.azurerm_client_config.current.object_id
+  # users_by_object_id = {
+  #   current_user = data.azurerm_client_config.current.object_id
+  # }
+  groups_by_object_id = {
+    "demo_group" = azuread_group_without_members.example.object_id
   }
   role_definitions = {
     cognitive_services_openai_user_role = {
@@ -58,7 +61,7 @@ module "aoai-role" {
       role_assignments = {
         role_assignment_1 = {
           role_definition = "cognitive_services_openai_user_role"
-          any_principals  = ["current_user"]
+          any_principals  = ["demo_group"]
         }
       }
     }

infra/terraform/servicebus.tf

@@ -22,8 +22,11 @@ module "avm-res-authorization-roleassignment-sb" {
   count   = local.deploy_azure_servicebus ? 1 : 0
   source  = "Azure/avm-res-authorization-roleassignment/azurerm"
   version = "0.2.0"
-  users_by_object_id = {
-    current_user = data.azurerm_client_config.current.object_id
+  # users_by_object_id = {
+  #   current_user = data.azurerm_client_config.current.object_id
+  # }
+  groups_by_object_id = {
+    demo_group = azuread_group_without_members.example.object_id
   }
   role_definitions = {
     service_bus_data_owner_role = {
@@ -36,7 +39,7 @@ module "avm-res-authorization-roleassignment-sb" {
       role_assignments = {
         role_assignment_1 = {
           role_definition = "service_bus_data_owner_role"
-          any_principals  = ["current_user"]
+          any_principals  = ["demo_group"]
         }
       }
     }