Add Read Condition to Azure Role Assignments

conductor/src/azure/uami_builder.rs

@@ -12,6 +12,7 @@ use azure_mgmt_msi::models::{
 };
 use futures::StreamExt;
 use log::info;
+use std::fmt::format;
 use std::sync::Arc;
 
 // Get credentials from workload identity
@@ -149,6 +150,7 @@ pub async fn create_role_assignment(
     subscription_id: &str,
     resource_group_prefix: &str,
     storage_account_name: &str,
+    azure_backup_container: &str,
     namespace: &str,
     uami_principal_id: &str,
     credentials: Arc<dyn TokenCredential>,
@@ -165,8 +167,25 @@ pub async fn create_role_assignment(
     )
     .await?;
 
-    // TODO(ianstanton) Set conditions for Role Assignment. These should allow for read / write
+    // Set conditions for Role Assignment. These should allow for read / write
     //  to the instance's directory in the blob
+    let blob_conditions = Some(format!(
+        "\
+(
+    (
+        !(ActionMatches{{'Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read'}})
+    )
+    OR 
+    (
+        @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:name] StringEquals '{}'
+        AND
+        @Resource[Microsoft.Storage/storageAccounts/blobServices/containers/blobs:path] StringLike '{}/*'
+    )
+)
+    ",
+        azure_backup_container,
+        namespace
+    ));
 
     let storage_account_id = get_storage_account_id(
         subscription_id,
@@ -199,8 +218,8 @@ pub async fn create_role_assignment(
             principal_id: uami_principal_id.to_string(),
             principal_type: Some(PrincipalType::ServicePrincipal),
             description: None,
-            condition: None,
-            condition_version: None,
+            condition: blob_conditions,
+            condition_version: Some("2.0".to_string()),
             created_on: None,
             updated_on: None,
             created_by: None,

conductor/src/lib.rs

@@ -597,6 +597,7 @@ pub async fn create_azure_storage_workload_identity_binding(
     azure_resource_group_prefix: &str,
     azure_region: &str,
     azure_storage_account: &str,
+    azure_backup_container: &str,
     namespace: &str,
 ) -> Result<String, ConductorError> {
     let credentials = get_credentials().await?;
@@ -620,6 +621,7 @@ pub async fn create_azure_storage_workload_identity_binding(
         azure_subscription_id,
         azure_resource_group_prefix,
         azure_storage_account,
+        azure_backup_container,
         namespace,
         &uami_principal_id,
         credentials.clone(),

conductor/src/main.rs

@@ -1023,6 +1023,7 @@ async fn init_azure_storage_workload_identity(
         &azure_resource_group,
         &azure_region,
         &azure_storage_account,
+        &backup_archive_bucket,
         &read_msg.message.namespace,
     )
     .await?;