Support for eligible authorizations within Azure Lighthouse #15311
Description
Community Note
- Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
- Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
- If you are interested in working on this issue or have submitted a pull request, please leave a comment
Description
Microsoft introduced eligible authorizations for Azure Lighthouse, which makes the features of PIM usable within Lighthouse.
Eligible authorizations can be defined to allow users to elevate their permissions temporarily, just like with PIM in a native Azure tenant.
Right now it's not possible to define these eligible authorizations inside of the azurerm_lighthouse_definition ressource.
I'd love to have the possibility to add a block for "eligible_authorizations" in addition to the permanent "authorizations".
Eligible authorizations are currently in public preview state.
New or Affected Resource(s)
- azurerm_lighthouse_definition
Potential Terraform Configuration
Below an example how the definition could look like with supported eligible authorizations.
The Tier 1 Support group has permanent Reader permissions and is eligible to elevate to the Contributor role.
I have copied the parameters from the ARM template which i have generated with the Lighthouse GUI in the Portal.
resource "azurerm_lighthouse_definition" "example" {
name = "Sample definition"
description = "This is a lighthouse definition created via Terraform"
managing_tenant_id = "00000000-0000-0000-0000-000000000000"
scope = "/subscriptions/00000000-0000-0000-0000-000000000000"
authorization {
principal_id = "00000000-0000-0000-0000-000000000000"
role_definition_id = // For example "Reader"
principal_display_name = "Tier 1 Support - Reader"
}
eligible_authorization {
multiFactorAuthProvider = "Azure"
maximumActivationDuration = "PT4H"
managedByTenantApprovers = null
principal_id = "00000000-0000-0000-0000-000000000000"
role_definition_id = // For example "Contributor"
principal_display_name = "Tier 1 Support - Contributor"
}
}References
- #0000