AzOps
AzOps copied to clipboard
Ability to configure which subscriptions to track
Describe the solution you'd like
In our Azure tenant, we have different application landing zone subscriptions for production, staging, and testing of our primary product. In accordance with #747, we wish to use separate AzOps repositories to track deployments to each of these environments. At the same time, we make extensive use of Bicep modules from a private container registry, which is placed in a separate platform subscription:
- root (mg)
-
(mg) - platform (mg)
- management (mg)
- management (sub)
- container registry
- management (sub)
- management (mg)
- landing zones (mg)
- online (mg)
- prod (sub)
- stage (sub)
- test (sub)
- online (mg)
- platform (mg)
-
The service principal we use for deploying resources to prod (sub)
has the following permissions:
-
Owner
onprod (sub)
-
AcrPull
on the container registry inmanagement (sub)
As a result, when running the pull pipeline, AzOps tracks both the subscriptions prod
and management
. It isn't actually able to list role assignments, policies, resource groups, or anything else inside management (sub)
, but it does generate a directory along with a microsoft.subscription_subscriptions-<sub-id>.json
file.
We would really like to be able to configure which subscription(s) to track via AzOps - something like Core.SubscriptionsToInclude
or similar.