There is a way to set up Synapse Administrators with a BICEP module?

user_19136144 0
Viewed 301

I would like to set Synapse access control with a bicep module but I can't find a proper resource to use.

Please, can someone point me in the right direction?

enter image description here

UPDATE: basend on evgeny answer, I tryed in this way but it seems not working:

resource syRBAC1 'Microsoft.Synapse/workspaces/administrators@2021-06-01' = {
  name: 'activeDirectory'
  parent: synapse_workspace
  properties: {
    administratorType: 'Synapse SQL Administrator'
    login: 'mylogin@mycompany.com'
    sid: ELSCId
    tenantId: TenantId
  }
}

It does not produce any error but it does not change any change into the access control list.

Probably it sets only this: enter image description here

azure-bicep azure-synapse
3 Answers

Unfortunately the templates for Synapse workspace are not mature yet and the documentation is poorly written. This is how I managed to use the 'Microsoft.Synapse/workspaces/administrators@2021-06-01' template:

Create a managed identity for Synapse:

resource synapseMi 'Microsoft.ManagedIdentity/userAssignedIdentities@2022-01-31-preview' = {
  name: replace(resourceGroup().name, 'rg', 'mi')
  location: location
  tags: tags
}

Assign the managed identity as AAD admin for synapse workspace:

@description('Assign synapse-mi as admin of synapse workspace')
resource synapseMiAdminAssignment 'Microsoft.Synapse/workspaces/administrators@2021-06-01' = {
  name: 'activeDirectory'
  parent: synapseWorkspace
  properties: {
    administratorType: 'ActiveDirectory'
    sid: synapseMi.properties.principalId
    tenantId: subscription().tenantId
  }
}

If you go to Azure portal -> your Synapse Workspace -> Azure Active Directory you can see the admin as synapse mi you just set.

I still need to test whether it reflects in the permissions.

LE: This change is only reflected in the azure portal resource and NOT in the Synapse RBAC, so it doesn't work as intended.

For now, the only workaround, as @Cribber suggested is to grant the permissions in a separate Pipeline task via az cli or AzPs. I have also opened a feature request on github for visibility purposes -> https://github.com/Azure/ResourceModules/issues/1972

user_199310980
user_31443730

Since I came across the same problem and bicep does not offer a way to assign the role (yet) I added an AzureCLI task to my pipeline and grant the role via az synapse role assignment create after the deployment.

Output defined in the bicep file to pass the name of the newly created synapse workspace along to the AzureCLI task:

output synapse_workspace_name string = synapse_workspace.name

Tasks in the deployment pipeline's yml file :

// deployment task via "main.bicep" file
- task: AzureResourceManagerTemplateDeployment@3
  inputs:
    connectedServiceName: $(ServiceConnectionName)
    location: $(DeploymentDefaultLocation)
    resourceGroupName: $(ResourceGroupName)
    csmFile: main.bicep
    overrideParameters: >
        -aad_admin_developer_group_object_id $(AadAdminDeveloperGroupObjectId)
    deploymentOutputs: deployment_output  

// Grant "Synapse Administrator"
- task: AzureCLI@1
  displayName: 'Assign role "Synapse Administrator" on the newly created Synapse workspace to the developer AAD-Group'
  inputs:
    azureSubscription: 'my_subscription'
    scriptLocation: 'inlineScript'
    inlineScript: 'az synapse role assignment create --workspace-name $(deployment_output.synapse_workspace_name.value) --role "Synapse Administrator" --assignee $(AadAdminDeveloperGroupObjectId)'
user_39098960
Related