deploy token-mgmt-role to subscription

Signed-off-by: Gerd Oberlechner <[email protected]>
Azure · Nov 29, 2024 · 927c884 · 927c884
1 parent 34b95c6
commit 927c884
Show file tree

Hide file tree

Showing 2 changed files with 28 additions and 22 deletions.
diff --git a/dev-infrastructure/modules/acr/acr.bicep b/dev-infrastructure/modules/acr/acr.bicep
@@ -57,26 +57,7 @@ resource roleAssignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
   }
 }
 
-resource tokenManagementRole 'Microsoft.Authorization/roleDefinitions@2022-04-01' = {
-  name: guid(resourceGroup().id, 'token-creation-role')
-  properties: {
-    roleName: 'ACR Manage Tokens'
-    type: 'customRole'
-    assignableScopes: [
-      subscription().id
-    ]
-    description: 'This role allows the management of tokens in the ACR'
-    permissions: [
-      {
-        actions: [
-          'Microsoft.ContainerRegistry/registries/tokens/read'
-          'Microsoft.ContainerRegistry/registries/tokens/write'
-          'Microsoft.ContainerRegistry/registries/tokens/delete'
-          'Microsoft.ContainerRegistry/registries/generateCredentials/action'
-          'Microsoft.ContainerRegistry/registries/tokens/operationStatuses/read'
-          'Microsoft.ContainerRegistry/registries/scopeMaps/read'
-        ]
-      }
-    ]
-  }
+module tokenMgmtRole 'token-mgmt-role.bicep' = {
+  name: 'acr-token-mgmt-role'
+  scope: subscription()
 }
diff --git a/dev-infrastructure/modules/acr/token-mgmt-role.bicep b/dev-infrastructure/modules/acr/token-mgmt-role.bicep
@@ -0,0 +1,25 @@
+targetScope = 'subscription'
+
+resource tokenManagementRole 'Microsoft.Authorization/roleDefinitions@2022-04-01' = {
+  name: guid('token-mgmt-role')
+  properties: {
+    roleName: 'ACR Manage Tokens'
+    type: 'customRole'
+    assignableScopes: [
+      subscription().id
+    ]
+    description: 'This role allows the management of tokens in the ACR'
+    permissions: [
+      {
+        actions: [
+          'Microsoft.ContainerRegistry/registries/tokens/read'
+          'Microsoft.ContainerRegistry/registries/tokens/write'
+          'Microsoft.ContainerRegistry/registries/tokens/delete'
+          'Microsoft.ContainerRegistry/registries/generateCredentials/action'
+          'Microsoft.ContainerRegistry/registries/tokens/operationStatuses/read'
+          'Microsoft.ContainerRegistry/registries/scopeMaps/read'
+        ]
+      }
+    ]
+  }
+}