feat: added KeyVaultReader role to the Lacework service principal (#43)

lacework · Jan 21, 2023 · 969fe20 · 969fe20
1 parent 7238974
commit 969fe20
Show file tree

Hide file tree

Showing 2 changed files with 21 additions and 2 deletions.
diff --git a/README.md b/README.md
@@ -35,6 +35,8 @@ It adds a Service Principal as a subscription "Reader" and "Key Vault Reader", t
 
 | Name | Type |
 |------|------|
+| [azurerm_role_assignment.grant_key_vault_reader_role_to_managementgroup](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/role_assignment) | resource |
+| [azurerm_role_assignment.grant_key_vault_reader_role_to_subscriptions](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/role_assignment) | resource |
 | [azurerm_role_assignment.grant_reader_role_to_managementgroup](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/role_assignment) | resource |
 | [azurerm_role_assignment.grant_reader_role_to_subscriptions](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/role_assignment) | resource |
 | [lacework_integration_azure_cfg.lacework](https://registry.terraform.io/providers/lacework/lacework/latest/docs/resources/integration_azure_cfg) | resource |

diff --git a/main.tf b/main.tf
@@ -25,24 +25,41 @@ data "azurerm_subscriptions" "available" {}
 
 resource "azurerm_role_assignment" "grant_reader_role_to_subscriptions" {
   count = length(local.subscription_ids)
-  scope = "/subscriptions/${local.subscription_ids[count.index]}"
 
+  scope                = "/subscriptions/${local.subscription_ids[count.index]}"
   principal_id         = local.service_principal_id
   role_definition_name = "Reader"
 }
 
+resource "azurerm_role_assignment" "grant_key_vault_reader_role_to_subscriptions" {
+  count = length(local.subscription_ids)
+
+  scope                = "/subscriptions/${local.subscription_ids[count.index]}"
+  principal_id         = local.service_principal_id
+  role_definition_name = "Key Vault Reader"
+}
+
 data "azurerm_management_group" "managementgroup" {
   count = var.use_management_group ? 1 : 0
   name  = var.management_group_id
 }
 
 resource "azurerm_role_assignment" "grant_reader_role_to_managementgroup" {
-  count                = var.use_management_group ? 1 : 0
+  count = var.use_management_group ? 1 : 0
+
   scope                = data.azurerm_management_group.managementgroup[0].id
   principal_id         = local.service_principal_id
   role_definition_name = "Reader"
 }
 
+resource "azurerm_role_assignment" "grant_key_vault_reader_role_to_managementgroup" {
+  count = var.use_management_group ? 1 : 0
+
+  scope                = data.azurerm_management_group.managementgroup[0].id
+  principal_id         = local.service_principal_id
+  role_definition_name = "Key Vault Reader"
+}
+
 # wait for X seconds for the Azure permissions to propagate
 resource "time_sleep" "wait_time" {
   create_duration = var.wait_time