move tole to acr module

ahitacat · Nov 13, 2024 · 2dba4a7 · 2dba4a7
1 parent bcba7ed
commit 2dba4a7
Show file tree

Hide file tree

Showing 2 changed files with 25 additions and 21 deletions.
diff --git a/dev-infrastructure/modules/acr-permissions.bicep b/dev-infrastructure/modules/acr-permissions.bicep
@@ -52,27 +52,8 @@ resource acrDeleteRole 'Microsoft.Authorization/roleAssignments@2022-04-01' = if
   }
 }
 
-resource tokenManagementRole 'Microsoft.Authorization/roleDefinitions@2022-04-01' = if (grantManageTokenAccess) {
-  name: guid(acrResourceGroupid, principalId, 'token-creation-role')
-  properties: {
-    assignableScopes: [
-      subscription().id
-      acrResourceGroupid
-    ]
-    description: 'This role allows the management of tokens in the ACR'
-    permissions: [
-      {
-        actions: [
-          'Microsoft.ContainerRegistry/registries/tokens/read'
-          'Microsoft.ContainerRegistry/registries/tokens/write'
-          'Microsoft.ContainerRegistry/registries/tokens/delete'
-          'Microsoft.ContainerRegistry/registries/generateCredentials/action'
-          'Microsoft.ContainerRegistry/registries/tokens/operationStatuses/read'
-        ]
-      }
-    ]
-    roleName: 'ACR Manage Tokens'
-  }
+resource tokenManagementRole 'Microsoft.Authorization/roleDefinitions@2022-04-01' existing = if (grantManageTokenAccess) {
+  name: guid(acrResourceGroupid, 'token-creation-role')
 }
 
 resource acrContributorRole 'Microsoft.Authorization/roleAssignments@2022-04-01' = if (grantManageTokenAccess) {

diff --git a/dev-infrastructure/modules/acr/acr.bicep b/dev-infrastructure/modules/acr/acr.bicep
@@ -56,3 +56,26 @@ resource roleAssignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
     roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', acrPullRoleId)
   }
 }
+
+resource tokenManagementRole 'Microsoft.Authorization/roleDefinitions@2022-04-01' = {
+  name: guid(resourceGroup().id, 'token-creation-role')
+  properties: {
+    assignableScopes: [
+      subscription().id
+      resourceGroup().id
+    ]
+    description: 'This role allows the management of tokens in the ACR'
+    permissions: [
+      {
+        actions: [
+          'Microsoft.ContainerRegistry/registries/tokens/read'
+          'Microsoft.ContainerRegistry/registries/tokens/write'
+          'Microsoft.ContainerRegistry/registries/tokens/delete'
+          'Microsoft.ContainerRegistry/registries/generateCredentials/action'
+          'Microsoft.ContainerRegistry/registries/tokens/operationStatuses/read'
+        ]
+      }
+    ]
+    roleName: 'ACR Manage Tokens'
+  }
+}