In the quickstart it talks about creating a service principle for the current user. I want to have more of a hierarchical security structure. I would be the current user and I want to have "super-user" or admin rights to this key vault. However I have created another user that would have lower access rights. For both of these scenarios I gather I need to generate a unique service principle name. How do I generate a service principle name for an arbitrary Azure User?
You can just create another service principal name under your current account for this created user. And you just need to assign the lower access rights to the key vault for this service principal. Then the user can access to the key vault with this service principal which has lower access permission.
An Azure service principal is an identity created for use with applications, hosted services, and automated tools to access Azure resources. You can create as many as service principals as you want for different access permissions. If you want to generate a service principal under the created user account, you might have to login as this created user. Otherwise, i am afraid it cannot be done.
You can also set the access permission for this user to this key vault directory without using service principal. See here
az keyvault set-policy --name keyVaultName --object-id userObjectId --secret-permissions permissions --key-permissions permissions
You can get the user's Object id with below command: See here
az ad user show --id <email-address-of-user>
Related
how to generate token for multiple service principal with different roles ,currently I have set environment variable(using system.getenv()) for one service principal account , please suggest for multiple account
Active Directory Graph API is now fully deprecated, in favor of MS Graph API.
My company has given me my own Visual Studio Professional subscription. I also have a DevOps organization. I am the Owner role in both.
with AADG API, I could use Terraform, for example, to create Service Principals and manage roles. Service Connections in DevOps were scoped to my subscription.
Example:
## These are in my resource group
...
resource "azuread_service_principal" "example" {
application_id = azuread_application.example.application_id
app_role_assignment_required = false
owners = [data.azuread_client_config.current.object_id]
}
...
resource "azurerm_role_assignment" "kubweb_to_acr" {
scope = azurerm_container_registry.acr.id
role_definition_name = "AcrPull"
principal_id = azurerm_kubernetes_cluster.kubweb.kubelet_identity[0].object_id
}
This used to work great. Now it does not. Now I get errors like:
Error: authorization.RoleAssignmentsClient#Create: Failure responding to request: StatusCode=403 -- Original Error: autorest/azure: Service returned an error. Status=403 Code="AuthorizationFailed" Message="The client '3520c717-e1cc-4d0b-b021-2f93a1b05d80' with object id '3520c717-e1cc-4d0b-b021-2f93a1b05d80' does not have authorization to perform action 'Microsoft.Authorization/roleAssignments/write
and
ApplicationsClient.BaseClient.Post(): unexpected status 403 with OData
│ error: Authorization_RequestDenied: Insufficient privileges to complete the
│ operation.
Even though I own my subscription, there is a parent organization above me. My SPs get scoped to their AD where I can't manage them. I can't use "Grant Admin Consent" through MS Graph API. Also, in DevOps, when I create an ARM Service Connection, for example, I scope it to my Subscription. It never scopes to my subscription, but the parent's, and I can't change its permissions.
How do I alter my development or scope my resources so that I don't have to defer to parent organization?
What role do they need to give me so I don't have to involve them?
I'm already the owner of my subscription. How do I create these types of resources in a way that I have full control over managing them again?
Side-note, it's interesting. I can use Azure CLI and run the same commands via terminal, and I have no problems creating or altering resources. The same commands az ad sp create-for-rbac don't throw any errors at all, and it's using the same permissions and scope defined in the pipelines.
Both errors you show are due to the service principal that Terraform is running as has not been authorized to perform the action in question. (From the Azure role assignment error, we can know this is the service principal with object ID "3520c717-e1cc-4d0b-b021-2f93a1b05d80".)
To assign an Azure role to a user, group, or service principal (your first error), the service principal used by Terraform needs to be have been granted a role that includes the "Microsoft.Authorization/roleAssignments/write" operation, scoped to (at least) scope you're trying to grant the role at (e.g. the specific Azure resource, the resource group it's in, or the subscription it's in). Typically, if you need to create Azure role assignments, this is the "Owner" role. More details from Terraform in Allowing the Service Principal to manage the Subscription. If you're "Owner" of the Azure subscription, then you will be able to do this yourself.
To create Azure AD application and service principals (your second error): The service principal used by Terraform needs to be granted permission to do this in the Azure AD tenant in question. For example, the app roles (application permissions) Application.Read.All and Application.ReadWrite.OwnedBy would suffice in many cases. These are actions that take place in the Azure AD tenant, so an Azure AD administrator will need to grant this access—you cannot do this on your own if you're not an admin of the Azure AD tenant. More details from Terraform in Configuring a User or Service Principal for managing Azure Active Directory.
How do I alter my development or scope my resources so that I don't have to defer to parent organization?
You could have an entirely separate Azure AD tenant (where you'd be administrator), and point the Azure subscription to trust that tenant. This may or may not be compatible with your organization's policies and practices.
I'm already the owner of my subscription. How do I create these types of resources in a way that I have full control over managing them again?
Azure AD applications and service principals are not a part of your Azure subscription, they're in the "parent" Azure AD tenant. You (the user) probably do have permission over these objects (e.g. you're owner of them in Azure AD), but Terraform isn't running as you—it's running as a separate service principal.
Side-note, it's interesting. I can use Azure CLI and run the same commands via terminal, and I have no problems creating or altering resources. The same commands az ad sp create-for-rbac don't throw any errors at all, and it's using the same permissions and scope defined in the pipelines.
You're probably connecting to Azure CLI as yourself (i.e. your user account), instead of the service principal Terraform is using. If you connect to Azure CLI using the same service principal (e.g. az login --service-principal ...), you'd likely experience the same errors, because that service principal hasn't been granted privileges over the Azure AD tenant and the Azure subscription yet.
I cannot assign a capacity Id to a workspace via Powershell commands, logged in with a service principal.
$workspace = Get-PowerBIWorkspace -name 'XXX-XX-XXXX-XXX'
$workspaceId = $workspace.Id
echo $workspaceId
Set-PowerBIWorkspace -Id $workspaceId -Scope "Organization" -CapacityId "XXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXX"
error message:
Set-PowerBIWorkspace: Operation returned an invalid status code 'Unauthorized'
I have taken the following steps:
I have created a service principal and assigned it to a security group in Azure AD.
I Manually added this security group in the admin Portal in PowerBi service to allow service principals to interact with service (under developer settings).
I have been able to (using PowerShell) login with the service principal and create a workspace.I can get all workspaces etc...
However, when I try to set a workspace capacity Id (assign it to a premium capacity) I get an unauthorized error.
I suspect I cannot do this because to perform this action, I have to go under Admin Portal Settings > Workspaces (I need Admin Rights to PowerBi service), hence I'm trying to find a way to grant these admin permissions to the service principal.
Besides this, I have:
Assigned that same service principal in the security group to be
workspace admin
Assign PowerBi administrator role in AAD to that service principal
But nothing worked.
Is there a way to perform these actions? Or is it a limitation of Service Principals?
Thank you,
Joao
The admin APIs in general cannot be used when authenticating with service principal. Recently, they made it possible to use some of them, but not all. For example take a look at Announcing new Admin APIs and Service Principal authentication to make for better tenant metadata scanning and Enable service principal authentication for read-only admin APIs, where you can see the list of supported APIs.
To assign a capacity to a workspace, UpdateGroupsAsAdmin API is used, which is currently not listed as a supported API, and is documented only for "normal" authentication:
Permissions
The user must have administrator rights (such as Office 365 Global Administrator or Power BI Service Administrator).
while for other APIs (GetGroupsAsAdmin, PostWorkspaceInfo) is explicitly documented that they can be used with a service principal:
Permissions
The user must have administrator rights (such as Microsoft 365 Global Administrator or Power BI Service Administrator) or authenticate using a service principal.
So either you have to wait for Microsoft to implement authentication with service principal (and there is no guarantee they will do that), or you will have to change the authentication (to use AAD account).
There are 2 commands I am confused for some time:
gcloud iam service-accounts get-iam-policy
gcloud iam service-accounts set-iam-policy
from the --help command, these 2 commands treat service account as a resource, most often I use service account as an identity, for example, in a project, set policy by binding role with service account so this service account can operate on something in that project.
Can someone please point out what is the usage to attach the policy to service account? how does service account act as a resource rather than an identity?
As explained in this below part of the official documentation Managing service accounts
:
When thinking of a service account as a resource, you can grant roles to other users to access or manage that service account.
So, use it as a resource has to goal for you to manage who can use and control the service account. To provide some additional details, as in this example here, with the policies attached to them, you can configure the level of access that different users can have within service accounts - as mentioned there, you can configure that some users have viewer access, while others have editor level.
To summarize, the functinality of attaching policies to a service account is for you to set different levels of access and permissions to users who can access the service account.
I need to retrieve the following current count and capacity(limit) for AWS account:
users
groups
roles
instance profiles
server certificates per AWS account.
I have tried next commands:
Get-EC2AccountAttributes,
Describe methods of Ec2Client class
Thank you in advance
As outlined in Limitations on IAM Entities, the AWS Identity and Access Management (IAM) service limits can be retrieved by means of the GetAccountSummary API.
The respective AWS Tools for Windows PowerShell cmdlet is Get-IAMAccountSummary:
Retrieves account level information about account entity usage and IAM quotas. [...]