Azure RBAC role 'ConfigureFactoryRepo' is required to be granted over the entire subscription to Terraform Service Principal to spin up Data Factory

0
votes

I have a Terraform Enterprise service principal that has the following roles assigned to it over my Resource Group:

  1. Contributor
  2. Data Factory Contributor
  3. ConfigureFactoryRepoAction
  4. Network Joiner
  5. Network Interface to Subnet Joiner
  6. Reader (assigned over the Subscription)

However, when I try to spin up an instance of the Azure Datafactory, I get the following error

"Error: configuring Repository for Data Factory: (Factory Name "test-vc-1" / ResourceGroup "$NAME_OF_RESOURCE_GROUP"): datafactory.FactoriesClient#ConfigureFactoryRepo: Failure responding to request: StatusCode=403 -- Original Error: autorest/azure: Service returned an error. Status=403 Code="AuthorizationFailed" Message="The client 'xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx' with object id 'xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx' does not have authorization to perform action 'Microsoft.DataFactory/locations/configureFactoryRepo/action' over scope '/subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx' or the scope is invalid. If access was recently granted, please refresh your credentials.

I guess the key line here is

perform action 'Microsoft.DataFactory/locations/configureFactoryRepo/action' over scope '/subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx' or the scope is invalid

The role ConfigureFactoryActionRepo is being required at the subscription level instead of the resource group level. Is there anyway to provision the Data Factory without having to assign this role across the subscription? Why is such a wide scope needed?

P.S. I am using Terraform v0.14.7

1
azureterraformazure-data-factoryazure-rbacterraform-enterprise

1 Answers

3
votes

The Azure API and the Terraform source code. To add the git repo, Terraform uses the following rest call:

Configure the factory repository:

This request needs more than just subscription rights from readers. Only permissions on the resource group are required when using the following rest call. This is also the call that the data factory portal uses: Factories - Configure Factory Repo - REST API (Azure Data Factory) | Microsoft Docs

Factory creation or upgrade:

When you have adequate rights on the resource group, you shouldn't need contributor access on a subscription to add a git config. Factories - Create Or Update - REST API (Azure Data Factory) | Microsoft Docs

Alternative is to add Custom Role: For the action ‘ Microsoft.DataFactory/locations/configureFactoryRepo/action', a custom role had to be created and given to the service principal. The Contributor role was insufficient to build up the Azure Data Factory code repository using Terraform azurerm.

Referance: GitHub Discussion