Terraform-provider-azuredevops: Allow to grant or deny service connection access to all pipelines

[beandrad]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Description

When creating a service connection through the Azure DevOps portal, pipelines can be given or denied access to such a service connection. It would be useful to be able to do the same using the corresponding Terraform resource.

New or Affected Resource(s)

• azuredevops_serviceendpoint_aws
• azuredevops_serviceendpoint_azurerm
• azuredevops_serviceendpoint_bitbucket
• azuredevops_serviceendpoint_dockerregistry
• azuredevops_serviceendpoint_github
• azuredevops_serviceendpoint_kubernetes
• azuredevops_serviceendpoint_azurecr

Potential Terraform Configuration

# Copy-paste your Terraform configurations here - for large Terraform configs,
# please use a service like Dropbox and share a link to the ZIP file. For
# security, you can also encrypt the files using our GPG public key.
resource "azuredevops_serviceendpoint_azurecr" "azurecr" {
  project_id                = azuredevops_project.project.id
  service_endpoint_name     = "Sample AzureCR"
  resource_group            = "sample-rg"
  azurecr_spn_tenantid      = "72f987tg-95f1-87af-91bh-2d8jd091db47"
  azurecr_name              = "sampleAcr"
  azurecr_subscription_id   = "f7ooi795-c577-6210-9886-a5e898uue3gc"
  azurecr_subscription_name = "sample"
  authorize_pilelines = true
}

Blockers

terraform-provider-azuredevops uses the azure-devops-go-api SDK to access the AzDO Rest API. This SDK doesn't have any methods to patch the pipeline permissions (https://github.com/microsoft/azure-devops-go-api/blob/dev/azuredevops/pipelines/client.go). This needs to be implemented before the current issue.

PATCH /{organization}/{project}/_apis/pipelines/pipelinePermissions/endpoint/{endpointId}

Issue: https://github.com/microsoft/azure-devops-go-api/issues/82

References

• #0000

[xuzhang3]

Hi @beandrad azuredevops_resource_authorization can be used to authorize service connections to the pipelines.

[xuzhang3]

Close this issue, feel free to open another issue if you have questions.