finops-toolkit icon indicating copy to clipboard operation
finops-toolkit copied to clipboard

Trigger queries pipeline after changes to the hubs scope

Open helderpinto opened this issue 8 months ago • 2 comments

Whenever the hubs scope is edited (see docs), this should trigger a run of the recommendations queries pipeline to reflect the scope changes into the ingested data.

helderpinto avatar Apr 14 '25 21:04 helderpinto

Won't this happen if you use the daily schedule?

flanakin avatar Apr 15 '25 06:04 flanakin

Won't this happen if you use the daily schedule?

Yes, it would happen at least 24h after the scope change, but the idea is to have recommendations results reflect the change ASAP and to align with CM managed exports, which also react to changes in the scope config.

helderpinto avatar Apr 15 '25 12:04 helderpinto

@flanakin, I studied the config_ConfigureExports ADF activity and re-read the steps to configure managed exports and realized that we have a chicken and egg problem. If we want to define ARG query scopes in config/settings.json and have ADF grant the required reader roles to itself, ADF must be... User Access Administrator at least. Therefore, unless we grant the UAA role in the Bicep deployment at the root tenant - which customers will certainly hate -, we would always need to grant permissions manually to ADF. Therefore, there is no use for implementing this. I will close this issue and simply add the manual ADF permissions grant steps to the documentation. What do you think?

helderpinto avatar May 16 '25 16:05 helderpinto

I don't think ADF should grant access. Access should be granted outside of the deployment. Or if needed, we can have a special tenant or MG deployment that only grants access.

flanakin avatar Jun 01 '25 05:06 flanakin

Closing issue as descoped. Permissions assignment to ADF will be done manually, at least in the first version of the feature. Steps will be documented when the feature is released.

helderpinto avatar Jun 01 '25 15:06 helderpinto