Added webpapi to ps1

Author: alrios-ms

Scripts/PostDeployment/Set-KeyVaultAccessRoles.ps1

@@ -56,6 +56,7 @@ function Set-KeyVaultAccessRoles {
 	$dataKeyVault = Get-AzKeyVault -ResourceGroupName $DataResourceGroupName -Name "$SolutionAbbreviation-data-$EnvironmentAbbreviation"
 	$functionApps = Get-AzFunctionApp -ResourceGroupName $ComputeResourceGroupName
 
+	# Grant the Function Apps access to the keyvaults
 	foreach ($functionApp in $functionApps) {
 		$ProductionFunctionAppName = $functionApp.Name
 		$StagingFunctionAppName = "$($functionApp.Name)/slots/staging"
@@ -67,43 +68,68 @@ function Set-KeyVaultAccessRoles {
 			# Grant the app service access to the keyvaults
 			if ($functionServicePrincipal) {
 				# prereqs keyvault
-				if ($null -eq (Get-AzRoleAssignment -ObjectId $functionServicePrincipal.Id -Scope $prereqsKeyVault.ResourceId -RoleDefinitionName "Key Vault Secrets User")) {
-					New-AzRoleAssignment -ObjectId $functionServicePrincipal.Id -Scope $prereqsKeyVault.ResourceId -RoleDefinitionName "Key Vault Secrets User";
-					Write-Host "Added role 'Key Vault Secrets User' to $fa on the $($prereqsKeyVault.VaultName) keyvault.";
-				}
-				else {
-					Write-Host "$fa already has 'Key Vault Secrets User' role on $($prereqsKeyVault.VaultName).";
-				}
+				Set-KVRoleAssignment `
+				-ObjectId $functionServicePrincipal.Id `
+				-DisplayName $fa `
+				-Scope $prereqsKeyVault.ResourceId `
+				-RoleDefinitionName "Key Vault Secrets User" `
+				-KeyVaultName $prereqsKeyVault.VaultName
 
 				# data keyvault
-				if ($null -eq (Get-AzRoleAssignment -ObjectId $functionServicePrincipal.Id -Scope $dataKeyVault.ResourceId -RoleDefinitionName "Key Vault Secrets User")) {
-					New-AzRoleAssignment -ObjectId $functionServicePrincipal.Id -Scope $dataKeyVault.ResourceId -RoleDefinitionName "Key Vault Secrets User";
-					Write-Host "Added role 'Key Vault Secrets User' to $fa on the $($dataKeyVault.VaultName) keyvault.";
-				}
-				else {
-					Write-Host "$fa already has 'Key Vault Secrets User' role on $($dataKeyVault.VaultName).";
-				}
+				Set-KVRoleAssignment `
+				-ObjectId $functionServicePrincipal.Id `
+				-DisplayName $fa `
+				-Scope $dataKeyVault.ResourceId `
+				-RoleDefinitionName "Key Vault Secrets User" `
+				-KeyVaultName $dataKeyVault.VaultName
 			}
 			elseif ($null -eq $functionServicePrincipal) {
 				Write-Host "Function $fa was not found!"
 			}
 		}
 	}
 
+	# Grant the Web API access to the keyvaults
+	$webApi = Get-AzWebApp -ResourceGroupName $ComputeResourceGroupName -Name "$ComputeResourceGroupName-webapi"
+	if ($webApi) {
+		$webApiServicePrincipal = Get-AzADServicePrincipal -DisplayName $webApi.Name
+
+		if ($webApiServicePrincipal) {
+			# prereqs keyvault
+			Set-KVRoleAssignment `
+			-ObjectId $webApiServicePrincipal.Id `
+			-DisplayName $webApi.Name `
+			-Scope $prereqsKeyVault.ResourceId `
+			-RoleDefinitionName "Key Vault Secrets User" `
+			-KeyVaultName $prereqsKeyVault.VaultName
+
+			# data keyvault
+			Set-KVRoleAssignment `
+			-ObjectId $webApiServicePrincipal.Id `
+			-DisplayName $webApi.Name `
+			-Scope $dataKeyVault.ResourceId `
+			-RoleDefinitionName "Key Vault Secrets User" `
+			-KeyVaultName $dataKeyVault.VaultName
+		}
+		elseif ($null -eq $webApiServicePrincipal) {
+			Write-Host "Web API $($webApi.Name) was not found!"
+		}
+	}
+
+	# Grant the Data Factories access to the keyvaults
 	$dataFactories = Get-AzResource -ResourceGroupName $DataResourceGroupName -ResourceType "Microsoft.DataFactory/factories"
 	foreach ($dataFactory in $dataFactories) {
 		$dataFactoryName = $dataFactory.Name
 		$dataFactoryServicePrincipal = Get-AzADServicePrincipal -DisplayName $dataFactoryName
 
 		if ($dataFactoryServicePrincipal) {
 			# data keyvault
-			if ($null -eq (Get-AzRoleAssignment -ObjectId $dataFactoryServicePrincipal.Id -Scope $dataKeyVault.ResourceId -RoleDefinitionName "Key Vault Secrets User")) {
-				New-AzRoleAssignment -ObjectId $dataFactoryServicePrincipal.Id -Scope $dataKeyVault.ResourceId -RoleDefinitionName "Key Vault Secrets User";
-				Write-Host "Added role 'Key Vault Secrets User' to $($dataFactoryName) on the $($dataKeyVault.VaultName) keyvault.";
-			}
-			else {
-				Write-Host "$($dataFactoryName) already has 'Key Vault Secrets User' role on $($dataKeyVault.VaultName).";
-			}
+			Set-KVRoleAssignment `
+			-ObjectId $dataFactoryServicePrincipal.Id `
+			-DisplayName $dataFactoryName `
+			-Scope $dataKeyVault.ResourceId `
+			-RoleDefinitionName "Key Vault Secrets User" `
+			-KeyVaultName $dataKeyVault.VaultName
 		}
 		elseif ($null -eq $dataFactoryServicePrincipal) {
 			Write-Host "Data Factory $dataFactoryName was not found!"
@@ -112,4 +138,28 @@ function Set-KeyVaultAccessRoles {
 	}
 
 	Write-Host "Done attempting to add keyvault role assignments.";
+}
+
+function Set-KVRoleAssignment {
+	[CmdletBinding()]
+	param(
+		[Parameter(Mandatory = $True)]
+		[string] $ObjectId,
+		[Parameter(Mandatory = $True)]
+		[string] $DisplayName,
+		[Parameter(Mandatory = $True)]
+		[string] $Scope,
+		[Parameter(Mandatory = $True)]
+		[string] $RoleDefinitionName,
+		[Parameter(Mandatory = $True)]
+		[string] $KeyVaultName
+	)
+
+	if ($null -eq (Get-AzRoleAssignment -ObjectId $ObjectId -Scope $Scope -RoleDefinitionName $RoleDefinitionName)) {
+		New-AzRoleAssignment -ObjectId $ObjectId -Scope $Scope -RoleDefinitionName $RoleDefinitionName;
+		Write-Host "Added role $RoleDefinitionName to $DisplayName on the $KeyVaultName keyvault.";
+	}
+	else {
+		Write-Host "$DisplayName already has  $RoleDefinitionName role on $KeyVaultName.";
+	}
 }