[compose + CI/CD] - Introduce AZURE_PRINCIPAL_TYPE to conditionally set user-only role assignments
#5285
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
JeffreyCA
changed the title
AZURE_PRINCIPAL_TYPE to conditionally set user-only role assignmentsAZURE_PRINCIPAL_TYPE to conditionally set user-only role assignments
There was a problem hiding this comment.
Pull Request Overview
This PR introduces the new AZURE_PRINCIPAL_TYPE parameter to conditionally set user-only role assignments, ensuring that role assignments are only applied for principals of type "User". Key changes include:
- Adding a new principalType parameter to multiple Bicep templates and parameter files.
- Updating role assignment logic in Bicep modules to conditionally include user role assignments.
- Extending Go interfaces and tests to support retrieving the current principal type.
Reviewed Changes
Copilot reviewed 10 out of 10 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| cli/azd/resources/scaffold/templates/resources.bicept | Added a new principalType parameter and updated roleAssignments using a conditional concat. |
| cli/azd/resources/scaffold/templates/main.parameters.jsont | Introduced the principalType parameter with an environment variable mapping. |
| cli/azd/resources/scaffold/templates/main.bicept | Passed the new principalType through to the resources module. |
| cli/azd/resources/scaffold/templates/ai-project.bicept | Conditionally wrapped role assignment resources for user principals. |
| cli/azd/pkg/infra/provisioning/current_principal_id_provider.go | Implemented the CurrentPrincipalType method using authManager.LogInDetails. |
| cli/azd/pkg/infra/provisioning/bicep/bicep_provider.go | Updated loadParameters to include principalType. |
| cli/azd/pkg/environment/environment.go | Added PrincipalTypeEnvVarName constant. |
| Test files (.go) | Updated tests and mocks to include the principal type. |
cli/azd/pkg/infra/provisioning/current_principal_id_provider.go
Outdated
Show resolved
Hide resolved
Azure Dev CLI Install InstructionsInstall scriptsMacOS/Linux
bash: pwsh: WindowsPowerShell install MSI install Standalone Binary
MSI
Documentationlearn.microsoft.com documentationtitle: Azure Developer CLI reference
|
JeffreyCA
requested review from
wbreza,
hemarina,
weikanglim and
rajeshkamal5050
as code owners
weikanglim
approved these changes
Jun 16, 2025
This was referenced Jun 23, 2025
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Fixes #5247
This PR fixes
azd pipeline configfor compose scenarios by introducing a Bicep parameterprincipalTypethat maps to a new environment variableAZURE_PRINCIPAL_TYPE(value ofUserorServicePrincipal). The generated Bicep now conditionally sets user-only role assignments only ifprincipalType=='User'.This is so that the same generated Bicep can be used to
azd uplocally or in a pipeline environment. In a local environment, the user is given Storage Blob Data Contributor, but in a pipeline environment the pipeline user-assigned identity is not given the role assignment (but the ACA's user-assigned identity is):Testing
Validated by running
azd pipeline configon compose project with various resources and verified provisioning succeeded and appropriate role assignments were set (pipeline MSI should not be assigned same assignments):