fix: Improvements to GitHub identity module at first deployment (#184)

pagopa · Nov 20, 2023 · 9d4f08e · 9d4f08e
1 parent b5836e6
commit 9d4f08e
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 5 deletions.
diff --git a/github_federated_identity/main.tf b/github_federated_identity/main.tf
@@ -24,7 +24,7 @@ data "azurerm_resource_group" "resource_group_details" {
 }
 
 locals {
-  rg_roles = toset(flatten([
+  rg_roles = tolist(flatten([
     for rg in data.azurerm_resource_group.resource_group_details : [
       for role in var.identity_role == "ci" ? var.ci_rbac_roles.resource_groups[rg.name] : var.cd_rbac_roles.resource_groups[rg.name] : {
         resource_group_id = rg.id
@@ -35,9 +35,9 @@ locals {
 }
 
 resource "azurerm_role_assignment" "identity_rg_role_assignment" {
-  for_each             = { for r in local.rg_roles : "${r.resource_group_id}.${r.role_name}" => r } # key must be unique
-  scope                = each.value.resource_group_id
-  role_definition_name = each.value.role_name
+  count                = length(local.rg_roles)
+  scope                = local.rg_roles[count.index].resource_group_id
+  role_definition_name = local.rg_roles[count.index].role_name
   principal_id         = azurerm_user_assigned_identity.identity.principal_id
 }
 

diff --git a/github_federated_identity/tests/resources.tf b/github_federated_identity/tests/resources.tf
@@ -40,7 +40,7 @@ module "identity-cd" {
   cd_rbac_roles = {         # explicit definition, so default Contributor role is not assigned to the current subscription
     subscription_roles = [] # empty array means no permission over the current subscription
     resource_groups = {     # map of resource groups with list of roles to assign
-      "${var.prefix}-${local.env_short}-identity-rg" = [
+      "terraform-state-rg" = [
         "Contributor"
       ]
     }