Add key vault role assignments for staging slot

SSWConsulting · Nov 21, 2023 · c9e0d06 · c9e0d06
1 parent 8c3dfd5
commit c9e0d06
Show file tree

Hide file tree

Showing 2 changed files with 22 additions and 11 deletions.
diff --git a/infra/appService.bicep b/infra/appService.bicep
@@ -1,3 +1,4 @@
+param now string
 param projectName string = 'sswwebsite'
 param location string = resourceGroup().location
 param tags object
@@ -185,5 +186,24 @@ resource appServiceAcrPullRoleAssignment 'Microsoft.Authorization/roleAssignment
   }
 }
 
+
+module kvAppRoleAssignment 'keyVaultRoleAssignment.bicep' = {
+  name: 'KVRoleAssignment-${now}'
+  params: {
+    keyVaultName: keyVaultName
+    principalId: appService.identity.principalId
+    roleName: 'Key Vault Secrets User'
+  }
+}
+
+
+module kvSlotRoleAssignment 'keyVaultRoleAssignment.bicep' = {
+  name: 'KVRoleAssignment-${now}'
+  params: {
+    keyVaultName: keyVaultName
+    principalId: stagingSlot.identity.principalId
+    roleName: 'Key Vault Secrets User'
+  }
+}
+
 output appServiceHostName string = appService.properties.defaultHostName
-output AppPrincipalId string = appService.identity.principalId
diff --git a/infra/main.bicep b/infra/main.bicep
@@ -64,6 +64,7 @@ module appInsight 'appInsight.bicep' = {
 module appService 'appService.bicep' = {
   name: 'appService-${now}'
   params: {
+    now: now
     projectName: projectName
     location: location
     tags: core
@@ -77,16 +78,6 @@ module appService 'appService.bicep' = {
   }
 }
 
-
-module kVAppRoleAssignment 'keyVaultRoleAssignment.bicep' = {
-  name: 'KVRoleAssignment-${now}'
-  params: {
-    keyVaultName: keyVault.outputs.keyVaultName
-    principalId: appService.outputs.AppPrincipalId
-    roleName: 'Key Vault Secrets User'
-  }
-}
-
 module kVServicePrincipalRoleAssignment 'keyVaultRoleAssignment.bicep' = {
   name: 'KVServicePrincipalRoleAssignment-${now}'
   params: {