ID-1282 Finalize Azure Private Resource Types #1440
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
rtitle
approved these changes
May 22, 2024
jgainerdewar
approved these changes
May 22, 2024
|
Ghost-in-a-Jar
approved these changes
May 22, 2024
| admin = { | ||
| roleActions = ["delete", "read_policies", "use", "share_policy::admin", "share_policy::user", "identify"] | ||
| owner = { | ||
| roleActions = ["delete", "read_policies", "share_policy::owner", "share_policy::reader", "share_policy::writer", "read", "write"] |
There was a problem hiding this comment.
do they need pull_image?
There was a problem hiding this comment.
I think it makes sense that an owner has all the permissions of other roles.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Ticket:
<Don't forget to include the ticket number in the PR title!>
What:
We've done a lot of technical feasibility work, and settled on what resource types need to exist for Private Azure Container Registries and Storage Accounts. This gets rid of previous resource types and actions, which will need to be manually removed from production.
Since resource types are upserted on boot, current resources should continue to work. We should migrate away from them and delete the resource types that are no longer in use.
Why:
Representing resources types as their logical Terra functional pieces gives us a lot of flexibility around access control and the evolution of features. A raw
azure_managed_identitydoesn't let Sam do what it does best: manage users' access to things. By representing anazure_private_storage_accountas it's own resource, we can use Sam to manage which users canreadand which user's canwrite. The Action Managed Identities are just an implementation detail of how the underlying cloud resource is accessed.How:
Update
reference.confPR checklist