Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix: storage account 403 error when creating new tre env #4406

Open
wants to merge 6 commits into
base: main
Choose a base branch
from
Open

Fix: storage account 403 error when creating new tre env #4406

Show file tree
Hide file tree
Changes from 4 commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
3c407d7
Refactor role assignment check to validate both "Storage Blob Data Co…
ShakutaiGit Feb 26, 2025
bdb0886
Remove unused script source from bootstrap.sh
ShakutaiGit Feb 26, 2025
c421afb
Refactor role assignment check to use local variables for clarity
ShakutaiGit Feb 26, 2025
52598a6
Update CHANGELOG and add role assignment for Storage Account Contribu…
ShakutaiGit Feb 26, 2025
1094118
Refactor role assignment check to use counts for validation and strea…
ShakutaiGit Feb 26, 2025
4c26cde
Refactor role assignment check to use non-empty value validation and …
ShakutaiGit Feb 26, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@ ENHANCEMENTS:
* Deny public access to TRE management storage account, and add private endpoint for TRE core [#4353](https://github.com/microsoft/AzureTRE/issues/4353)

BUG FIXES:

* Resolved a 403 storage account error when creating a new TRE environment ([#4405](https://github.com/microsoft/AzureTRE/issues/4405)) in PR [#4406](https://github.com/microsoft/AzureTRE/pull/4406)

## 0.21.0

Expand Down
34 changes: 28 additions & 6 deletions devops/terraform/bootstrap.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,33 +28,55 @@ else
az storage account show --resource-group "$TF_VAR_mgmt_resource_group_name" --name "$TF_VAR_mgmt_storage_account_name" --output table
fi

# shellcheck disable=SC1091
source ../scripts/mgmtstorage_enable_public_access.sh

# Grant user blob data contributor permissions
echo -e "\n\e[34m»»» 🔑 \e[96mGranting Storage Blob Data Contributor role to the current user\e[0m..."
if [ -n "${ARM_CLIENT_ID:-}" ]; then
USER_OBJECT_ID=$(az ad sp show --id "$ARM_CLIENT_ID" --query id --output tsv)
else
USER_OBJECT_ID=$(az ad signed-in-user show --query id --output tsv)
fi

az role assignment create --assignee "$USER_OBJECT_ID" \
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Did you work out why this is required? I thought the object ID that creates the storage account should have sufficient permissions?

--role "Storage Account Contributor" \
--scope "/subscriptions/$ARM_SUBSCRIPTION_ID/resourceGroups/$TF_VAR_mgmt_resource_group_name/providers/Microsoft.Storage/storageAccounts/$TF_VAR_mgmt_storage_account_name"

az role assignment create --assignee "$USER_OBJECT_ID" \
--role "Storage Blob Data Contributor" \
--scope "/subscriptions/$ARM_SUBSCRIPTION_ID/resourceGroups/$TF_VAR_mgmt_resource_group_name/providers/Microsoft.Storage/storageAccounts/$TF_VAR_mgmt_storage_account_name"

# Function to check if the role assignment exists
check_role_assignment() {
az role assignment list --assignee "$USER_OBJECT_ID" --role "Storage Blob Data Contributor" --scope "/subscriptions/$ARM_SUBSCRIPTION_ID/resourceGroups/$TF_VAR_mgmt_resource_group_name/providers/Microsoft.Storage/storageAccounts/$TF_VAR_mgmt_storage_account_name" --query "[].id" --output tsv
check_role_assignments() {
local sbdc
sbdc=$(az role assignment list \
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggestion from copilot, not tested, but makes sense to have a timeout of some sort...

# Function to check if the role assignments exist
check_role_assignments() {
  local roles
  roles=$(az role assignment list \
    --assignee "$USER_OBJECT_ID" \
    --scope "/subscriptions/$ARM_SUBSCRIPTION_ID/resourceGroups/$TF_VAR_mgmt_resource_group_name/providers/Microsoft.Storage/storageAccounts/$TF_VAR_mgmt_storage_account_name" \
    --query "[?roleDefinitionName=='Storage Blob Data Contributor' || roleDefinitionName=='Storage Account Contributor'].roleDefinitionName" --output tsv)
  
  if [[ $roles == *"Storage Blob Data Contributor"* && $roles == *"Storage Account Contributor"* ]]; then
    echo "both"
  fi
}

# Wait for the role assignment to be applied with a timeout
echo -e "\n\e[34m»»» ⏳ \e[96mWaiting for role assignment to be applied\e[0m..."
timeout=300  # 5 minutes timeout
start_time=$(date +%s)

while [ -z "$(check_role_assignments)" ]; do
  echo "Waiting for role assignment..."
  sleep 10
  current_time=$(date +%s)
  elapsed_time=$((current_time - start_time))
  if [ $elapsed_time -ge $timeout ]; then
    echo "ERROR: Timeout waiting for role assignments."
    exit 1
  fi
done
echo "Role assignment applied."

--assignee "$USER_OBJECT_ID" \
--role "Storage Blob Data Contributor" \
--scope "/subscriptions/$ARM_SUBSCRIPTION_ID/resourceGroups/$TF_VAR_mgmt_resource_group_name/providers/Microsoft.Storage/storageAccounts/$TF_VAR_mgmt_storage_account_name" \
--query "[].id" --output tsv)

local sac
sac=$(az role assignment list \
--assignee "$USER_OBJECT_ID" \
--role "Storage Account Contributor" \
--scope "/subscriptions/$ARM_SUBSCRIPTION_ID/resourceGroups/$TF_VAR_mgmt_resource_group_name/providers/Microsoft.Storage/storageAccounts/$TF_VAR_mgmt_storage_account_name" \
--query "[].id" --output tsv)

# Return a non-empty value only if both roles are assigned
if [[ -n "$sbdc" && -n "$sac" ]]; then
echo "both"
fi
}

# Wait for the role assignment to be applied
echo -e "\n\e[34m»»» ⏳ \e[96mWaiting for role assignment to be applied\e[0m..."
while [ -z "$(check_role_assignment)" ]; do
while [ -z "$(check_role_assignments)" ]; do
echo "Waiting for role assignment..."
sleep 10
done
echo "Role assignment applied."

# shellcheck disable=SC1091
source ../scripts/mgmtstorage_enable_public_access.sh

# Blob container
# shellcheck disable=SC2154
az storage container create --account-name "$TF_VAR_mgmt_storage_account_name" --name "$TF_VAR_terraform_state_container_name" --auth-mode login -o table
Expand Down
Loading