From cb80d2805b1cb2914994fc288f076bd8859eb724 Mon Sep 17 00:00:00 2001 From: florianow <64468897+florianow@users.noreply.github.com> Date: Thu, 6 Jun 2024 10:39:49 +0200 Subject: [PATCH] chore: remove avaitrix becasue not finished --- kit/azure/aviatrix/README.md | 64 --------- kit/azure/aviatrix/aviatrix.spn.tf | 127 ------------------ kit/azure/aviatrix/documentation.tf | 6 - kit/azure/aviatrix/outputs.tf | 16 --- .../template/platform-module/terragrunt.hcl | 40 ------ kit/azure/aviatrix/variables.tf | 23 ---- kit/azure/aviatrix/versions.tf | 15 --- 7 files changed, 291 deletions(-) delete mode 100644 kit/azure/aviatrix/README.md delete mode 100644 kit/azure/aviatrix/aviatrix.spn.tf delete mode 100644 kit/azure/aviatrix/documentation.tf delete mode 100644 kit/azure/aviatrix/outputs.tf delete mode 100644 kit/azure/aviatrix/template/platform-module/terragrunt.hcl delete mode 100644 kit/azure/aviatrix/variables.tf delete mode 100644 kit/azure/aviatrix/versions.tf diff --git a/kit/azure/aviatrix/README.md b/kit/azure/aviatrix/README.md deleted file mode 100644 index 6defe786..00000000 --- a/kit/azure/aviatrix/README.md +++ /dev/null @@ -1,64 +0,0 @@ ---- -name: Azure Aviatrix -summary: | - Set -compliance: - - control: cfmm/cost-management/monthly-cloud-tenant-billing-report - statement: | - Enables - - control: cfmm/cost-management/billing-alerts - statement: | - Sets ---- - -# Azure Aviatrix - -Aviatrix - - -## Requirements - -| Name | Version | -|------|---------| -| [terraform](#requirement\_terraform) | >= 1.0 | -| [azuread](#requirement\_azuread) | ~> 2.46.0 | -| [azurerm](#requirement\_azurerm) | ~> 3.81.0 | - -## Modules - -No modules. - -## Resources - -| Name | Type | -|------|------| -| [azuread_app_role_assignment.aviatrix_deploy-approle](https://registry.terraform.io/providers/hashicorp/azuread/latest/docs/resources/app_role_assignment) | resource | -| [azuread_app_role_assignment.aviatrix_deploy-directory](https://registry.terraform.io/providers/hashicorp/azuread/latest/docs/resources/app_role_assignment) | resource | -| [azuread_application.aviatrix_deploy](https://registry.terraform.io/providers/hashicorp/azuread/latest/docs/resources/application) | resource | -| [azuread_application_password.aviatrix_deploy](https://registry.terraform.io/providers/hashicorp/azuread/latest/docs/resources/application_password) | resource | -| [azuread_service_principal.aviatrix_deploy](https://registry.terraform.io/providers/hashicorp/azuread/latest/docs/resources/service_principal) | resource | -| [azurerm_role_assignment.aviatrix_deploy](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/role_assignment) | resource | -| [azurerm_role_definition.aviatrix_deploy](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/role_definition) | resource | -| [time_rotating.key_rotation](https://registry.terraform.io/providers/hashicorp/time/latest/docs/resources/rotating) | resource | -| [azuread_application_published_app_ids.well_known](https://registry.terraform.io/providers/hashicorp/azuread/latest/docs/data-sources/application_published_app_ids) | data source | -| [azuread_service_principal.msgraph](https://registry.terraform.io/providers/hashicorp/azuread/latest/docs/data-sources/service_principal) | data source | - -## Inputs - -| Name | Description | Type | Default | Required | -|------|-------------|------|---------|:--------:| -| [allowed\_user\_group\_id](#input\_allowed\_user\_group\_id) | id of the authorized id which can do changes | `list(string)` | n/a | yes | -| [location](#input\_location) | The Azure location used for creating policy assignments establishing this landing zone's guardrails. | `string` | n/a | yes | -| [parent\_management\_group](#input\_parent\_management\_group) | id of the tenant management group | `string` | n/a | yes | -| [service\_principal\_name](#input\_service\_principal\_name) | id of the tenant management group | `string` | `"avaitrix_deploy_spn"` | no | - -## Outputs - -| Name | Description | -|------|-------------| -| [aviatrix\_service\_principal](#output\_aviatrix\_service\_principal) | n/a | -| [client\_id](#output\_client\_id) | n/a | -| [client\_principal\_id](#output\_client\_principal\_id) | n/a | -| [client\_secret](#output\_client\_secret) | n/a | -| [documentation\_md](#output\_documentation\_md) | n/a | - diff --git a/kit/azure/aviatrix/aviatrix.spn.tf b/kit/azure/aviatrix/aviatrix.spn.tf deleted file mode 100644 index edb25394..00000000 --- a/kit/azure/aviatrix/aviatrix.spn.tf +++ /dev/null @@ -1,127 +0,0 @@ -resource "azurerm_role_definition" "aviatrix_deploy" { - name = var.service_principal_name - scope = var.parent_management_group - description = "Permissions required to deploy the avaitrix" - - permissions { - actions = [ - #https://docs.aviatrix.com/documentation/latest/accounts-and-users/custom-role-azure.html?expand=true - "Microsoft.MarketplaceOrdering/offerTypes/publishers/offers/plans/agreements/*", - "Microsoft.Compute/*/read", - "Microsoft.Compute/availabilitySets/*", - "Microsoft.Compute/virtualMachines/*", - "Microsoft.Network/*/read", - "Microsoft.Network/publicIPAddresses/*", - "Microsoft.Network/networkInterfaces/*", - "Microsoft.Network/networkSecurityGroups/*", - "Microsoft.Network/loadBalancers/*", - "Microsoft.Network/routeTables/*", - "Microsoft.Network/virtualNetworks/*", - "Microsoft.Storage/storageAccounts/*", - "Microsoft.Resources/*/read", - "Microsoft.Resourcehealth/healthevent/*", - "Microsoft.Resources/deployments/*", - "Microsoft.Resources/tags/*", - "Microsoft.Resources/marketplace/purchase/action", - "Microsoft.Resources/subscriptions/resourceGroups/*" - ] - } - - assignable_scopes = [ - var.parent_management_group - ] -} - -data "azuread_application_published_app_ids" "well_known" {} - -data "azuread_service_principal" "msgraph" { - client_id = data.azuread_application_published_app_ids.well_known.result.MicrosoftGraph -} - -resource "azuread_application" "aviatrix_deploy" { - display_name = var.service_principal_name - - web { - implicit_grant { - access_token_issuance_enabled = false - } - } - required_resource_access { - resource_app_id = data.azuread_application_published_app_ids.well_known.result.MicrosoftGraph - - resource_access { - id = data.azuread_service_principal.msgraph.app_role_ids["Directory.Read.All"] - type = "Role" - } - resource_access { - id = data.azuread_service_principal.msgraph.app_role_ids["Group.ReadWrite.All"] - type = "Role" - } - resource_access { - id = data.azuread_service_principal.msgraph.app_role_ids["AppRoleAssignment.ReadWrite.All"] - type = "Role" - } - - resource_access { - id = data.azuread_service_principal.msgraph.app_role_ids["Application.ReadWrite.All"] - type = "Role" - } - } - - # NOTE: currently it is not possible to automate the "Grant admin consent button" - # https://github.com/terraform-providers/terraform-provider-azuread/issues/33 - # As a result we have to ignore this value in terraform for now - # In addition please keep in mind you have to grant admin consent manually - lifecycle { - ignore_changes = [ - app_role - ] - } -} - -resource "azuread_service_principal" "aviatrix_deploy" { - client_id = azuread_application.aviatrix_deploy.client_id - # The following tags are needed to create an Enterprise Application - # See https://github.com/hashicorp/terraform-provider-azuread/issues/7#issuecomment-529597534 - tags = [ - "WindowsAzureActiveDirectoryIntegratedApp", - ] -} - -resource "azurerm_role_assignment" "aviatrix_deploy" { - scope = var.parent_management_group - role_definition_id = azurerm_role_definition.aviatrix_deploy.role_definition_resource_id - principal_id = azuread_service_principal.aviatrix_deploy.id -} - -resource "azuread_app_role_assignment" "aviatrix_deploy-directory" { - app_role_id = data.azuread_service_principal.msgraph.app_role_ids["Directory.Read.All"] - principal_object_id = azuread_service_principal.aviatrix_deploy.object_id - resource_object_id = data.azuread_service_principal.msgraph.object_id -} -# This azuread_app_role_assignment is necessary if you want to manage groups through Terraform. -# Productive use in a cloud foundation should probably manage groups not via Terraform but -# via existing IAM processes, but this is a good lean start. -# resource "azuread_app_role_assignment" "aviatrix_deploy-group" { -# app_role_id = data.azuread_service_principal.msgraph.app_role_ids["Group.ReadWrite.All"] -# principal_object_id = azuread_service_principal.aviatrix_deploy.object_id -# resource_object_id = data.azuread_service_principal.msgraph.object_id -# } - -resource "azuread_app_role_assignment" "aviatrix_deploy-approle" { - app_role_id = data.azuread_service_principal.msgraph.app_role_ids["AppRoleAssignment.ReadWrite.All"] - principal_object_id = azuread_service_principal.aviatrix_deploy.object_id - resource_object_id = data.azuread_service_principal.msgraph.object_id -} - -# note this requires the terraform to be run regularly -resource "time_rotating" "key_rotation" { - rotation_days = 365 -} - -resource "azuread_application_password" "aviatrix_deploy" { - application_id = azuread_application.aviatrix_deploy.id - rotate_when_changed = { - rotation = time_rotating.key_rotation.id - } -} diff --git a/kit/azure/aviatrix/documentation.tf b/kit/azure/aviatrix/documentation.tf deleted file mode 100644 index a50f3e64..00000000 --- a/kit/azure/aviatrix/documentation.tf +++ /dev/null @@ -1,6 +0,0 @@ -output "documentation_md" { - value = <