[BREAKING CHANGE] Updated New-AzAksCluster behavior to create an SP with Contributor access scoped to the MC RG when acsServicePrincipal is null

[jovieir]

Description

During the creation of a new cluster, if the user does not specify a service principal to be used, we'll attempt to load them from the acsServicePrincipal file. If this file is empty or does not exist, we'll create a new service principal to use as the cluster identity.

However, while creating this SP (under the BuildServicePrincipal() function), we're also assigning this SP with subscription-wide Contributor access, which is not needed.

This change is an effort to adhere to least-privilege principle and ensure Contributor access is only granted for the cluster managedCluster RG (and MC node RG).

Mandatory Checklist

• Please choose the target release of Azure PowerShell

  • [X] General release
  • [ ] Public preview
  • [ ] Private preview
  • [ ] Engineering build
  • [ ] N/A

• [X] Check this box to confirm: I have read the Submitting Changes section of CONTRIBUTING.md and reviewed the following information:

• SHOULD update ChangeLog.md file(s) appropriately
  • For SDK-based development mode, update src/{{SERVICE}}/{{SERVICE}}/ChangeLog.md.
    • A snippet outlining the change(s) made in the PR should be written under the ## Upcoming Release header in the past tense.
  • For autorest-based development mode, include the changelog in the PR description.
  • Should not change ChangeLog.md if no new release is required, such as fixing test case only.
• SHOULD regenerate markdown help files if there is cmdlet API change. Instruction
• SHOULD have proper test coverage for changes in pull request.
• SHOULD NOT adjust version of module manually in pull request

[azure-client-tools-bot-prd[bot]]

️✔️Az.Accounts

️✔️Build

️✔️PowerShell Core - Windows

️✔️Windows PowerShell - Windows

️✔️Az.Aks

️✔️Build

️✔️PowerShell Core - Windows

️✔️Windows PowerShell - Windows

️✔️Breaking Change Check

️✔️PowerShell Core - Windows

️✔️Windows PowerShell - Windows

️✔️Signature Check

️✔️PowerShell Core - Windows

️✔️Windows PowerShell - Windows

️✔️Help File Existence Check

️✔️PowerShell Core - Windows

️✔️Windows PowerShell - Windows

️✔️File Change Check

️✔️PowerShell Core - Windows

️✔️Windows PowerShell - Windows

️✔️UX Metadata Check

️✔️PowerShell Core - Windows

️✔️Windows PowerShell - Windows

️✔️Test

️✔️PowerShell Core - Linux

️✔️PowerShell Core - MacOS

️✔️PowerShell Core - Windows

️✔️Windows PowerShell - Windows

[jovieir]

/azp run security-tools

[azure-pipelines[bot]]

Commenter does not have sufficient privileges for PR 23889 in repo Azure/azure-powershell

[github-actions[bot]]

This PR was labeled "needs-revision" because it has unresolved review comments or CI failures. Please resolve all open review comments and make sure all CI checks are green. Refer to our guide to troubleshoot common CI failures.

[msJinLei]

/azp run azure-powershell - security-tools

[azure-pipelines[bot]]

Pull request contains merge conflicts.