[DEVEX-91] - Removed wildcards in cosmosdb scope (#61)

pagopa · Jul 10, 2024 · 677467e · 677467e
1 parent 237f57a
commit 677467e
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 1 deletion.
diff --git a/infra/modules/azure_role_assignments/modules/cosmos/locals.tf b/infra/modules/azure_role_assignments/modules/cosmos/locals.tf
@@ -13,6 +13,7 @@ locals {
           role                = entry.role
           database            = entry.database
           collection          = collection
+          scope               = collection == "*" ? (entry.database == "*" ? "/" : "/dbs/${entry.database}") : "/dbs/${entry.database}/colls/${collection}"
         }
       ]
     ]) : "${assignment.account_name}|${assignment.database}|${assignment.collection}|${assignment.role}" => assignment

diff --git a/infra/modules/azure_role_assignments/modules/cosmos/main.tf b/infra/modules/azure_role_assignments/modules/cosmos/main.tf
@@ -5,5 +5,5 @@ resource "azurerm_cosmosdb_sql_role_assignment" "this" {
   account_name        = each.value.account_name
   role_definition_id  = "${data.azurerm_cosmosdb_account.cosmos["${each.value.resource_group_name}|${each.value.account_name}"].id}/sqlRoleDefinitions/${local.role_definition_id[lower(each.value.role)]}"
   principal_id        = var.principal_id
-  scope               = "${data.azurerm_cosmosdb_account.cosmos["${each.value.resource_group_name}|${each.value.account_name}"].id}/dbs/${each.value.database}/colls/${each.value.collection}"
+  scope               = "${data.azurerm_cosmosdb_account.cosmos["${each.value.resource_group_name}|${each.value.account_name}"].id}${each.value.scope}"
 }