Create groups for AAD app reg roles

CHANGELOG.md

@@ -18,6 +18,7 @@ ENHANCEMENTS:
 * Gitea shared service support app-service standard SKUs ([#2523](https://github.com/microsoft/AzureTRE/pull/2523))
 * Keyvault diagnostic settings in base workspace ([#2521](https://github.com/microsoft/AzureTRE/pull/2521))
 * Airlock requests contain a field with information about the files that were submitted ([#2504](https://github.com/microsoft/AzureTRE/pull/2504))
+* Add ability to automatically create Azure AD groups for each application role. Requires API version 0.4.30 or later
 
 BUG FIXES:
 

api_app/_version.py

@@ -1 +1 @@
-__version__ = "0.4.24"
+__version__ = "0.4.30"

api_app/schemas/azuread.json

@@ -1,23 +1,29 @@
 {
-    "$schema": "http://json-schema.org/draft-07/schema",
-    "$id": "https://github.com/microsoft/AzureTRE/schema/azuread.json",
-    "type": "object",
-    "title": "Azure AD Authorisation Schema",
-    "default": {},
-    "required": [
-        "client_id"
-    ],
-    "properties": {
-        "client_id": {
-            "type": "string",
-            "title": "Application (Client) ID",
-            "description": "The AAD Application Registration ID for the workspace. Use 'auto_create' if you wish TRE to create this."
-        },
-        "client_secret": {
-          "type": "string",
-          "title": "Application (Client) Secret",
-          "description": "The AAD Application Registration secret for the workspace. Leave blank if using `auto_create` above. This value will be stored in the Workspace Key Vault.",
-          "sensitive": true
-      }
+  "$schema": "http://json-schema.org/draft-07/schema",
+  "$id": "https://github.com/microsoft/AzureTRE/schema/azuread.json",
+  "type": "object",
+  "title": "Azure AD Authorisation Schema",
+  "default": {},
+  "required": [
+    "client_id"
+  ],
+  "properties": {
+    "client_id": {
+      "type": "string",
+      "title": "Application (Client) ID",
+      "description": "The AAD Application Registration ID for the workspace. Use 'auto_create' if you wish TRE to create this."
+    },
+    "client_secret": {
+      "type": "string",
+      "title": "Application (Client) Secret",
+      "description": "The AAD Application Registration secret for the workspace. Leave blank if using `auto_create` above. This value will be stored in the Workspace Key Vault.",
+      "sensitive": true
+    },
+    "create_aad_groups": {
+      "type": "boolean",
+      "title": "Create AAD Groups for each worksapce role",
+      "description": "Create AAD Groups for the workspace roles, requires `auto_create`. If this is set to true, the workspace will create new AAD Groups.",
+      "default": false
     }
+  }
 }

templates/workspaces/base/porter.yaml

@@ -59,6 +59,10 @@ parameters:
     type: boolean
     default: false
     description: "Whether this bundle should register the workspace in AAD"
+  - name: create_aad_groups
+    type: boolean
+    default: false
+    description: "Whether this bundle should create AAD groups for the workspace app roles"
   - name: workspace_owner_object_id
     type: string
     description: "The object id of the user that will be granted WorkspaceOwner after it is created."
@@ -148,6 +152,7 @@ install:
         shared_storage_quota: "{{ bundle.parameters.shared_storage_quota }}"
         enable_local_debugging: "{{ bundle.parameters.enable_local_debugging }}"
         register_aad_application: "{{ bundle.parameters.register_aad_application }}"
+        create_aad_groups: "{{ bundle.parameters.create_aad_groups }}"
         auth_client_id: "{{ bundle.credentials.auth_client_id }}"
         auth_client_secret: "{{ bundle.credentials.auth_client_secret }}"
         auth_tenant_id: "{{ bundle.credentials.auth_tenant_id }}"
@@ -241,6 +246,7 @@ uninstall:
         shared_storage_quota: "{{ bundle.parameters.shared_storage_quota }}"
         enable_local_debugging: "{{ bundle.parameters.enable_local_debugging }}"
         register_aad_application: "{{ bundle.parameters.register_aad_application }}"
+        create_aad_groups: "{{ bundle.parameters.create_aad_groups }}"
         auth_client_id: "{{ bundle.credentials.auth_client_id }}"
         auth_client_secret: "{{ bundle.credentials.auth_client_secret }}"
         auth_tenant_id: "{{ bundle.credentials.auth_tenant_id }}"

templates/workspaces/base/terraform/aad/aad.tf

@@ -124,3 +124,25 @@ resource "azuread_app_role_assignment" "workspace_owner" {
   principal_object_id = var.workspace_owner_object_id
   resource_object_id  = azuread_service_principal.workspace.object_id
 }
+
+resource "azuread_group" "workspace_owners" {
+  count        = var.create_aad_groups ? 1 : 0
+  display_name = "${var.workspace_resource_name_suffix} Workspace Owners"
+  owners       = [var.workspace_owner_object_id]
+}
+
+resource "azuread_group" "workspace_researchers" {
+  count        = var.create_aad_groups ? 1 : 0
+  display_name = "${var.workspace_resource_name_suffix} Workspace Researchers"
+  owners       = [var.workspace_owner_object_id]
+}
+resource "azuread_group" "workspace_researchers" {
+  count        = var.create_aad_groups ? 1 : 0
+  display_name = "${var.workspace_resource_name_suffix} Airlock Managers"
+  owners       = [var.workspace_owner_object_id]
+}
+resource "azuread_group_member" "workspace_owner" {
+  count            = var.create_aad_groups ? 1 : 0
+  group_object_id  = azuread_group.workspace_owners.id
+  member_object_id = var.workspace_owner_object_id
+}

templates/workspaces/base/terraform/aad/variables.tf

@@ -5,3 +5,4 @@ variable "tre_workspace_tags" {}
 variable "aad_redirect_uris_b64" {
   type = string # list of objects like [{"name": "my uri 1", "value": "https://..."}, {}]
 }
+variable "create_aad_groups" {}

templates/workspaces/base/terraform/variables.tf

@@ -47,6 +47,12 @@ variable "register_aad_application" {
   description = "Create an AAD application automatically for the Workspace."
 }
 
+variable "create_aad_groups" {
+  type        = bool
+  default     = false
+  description = "Create AAD groups automatically for the Workspace Application Roles."
+}
+
 variable "enable_airlock" {
   type        = bool
   description = "Controls the deployment of Airlock resources in the workspace."

templates/workspaces/base/terraform/workspace.tf

@@ -34,6 +34,8 @@ module "aad" {
   workspace_resource_name_suffix = local.workspace_resource_name_suffix
   workspace_owner_object_id      = var.workspace_owner_object_id
   aad_redirect_uris_b64          = var.aad_redirect_uris_b64
+  create_aad_groups              = var.create_aad_groups
+
   depends_on = [
     azurerm_key_vault_access_policy.deployer,
     azurerm_key_vault_access_policy.resource_processor,