AzRbacFramework/Create-RbacFrameworkRoleAssignmentMap.ps1 at main · trindels/AzRbacFramework · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
Param(
    [Parameter(Mandatory=$True)]
    [Microsoft.Azure.Commands.Resources.Models.Authorization.PSRoleAssignment[]]$RoleAssignments,

    [Parameter(Mandatory=$True)]
    [ValidateNotNullOrEmpty()]
    [string]$TargetSubscriptionId,

    [Parameter(Mandatory=$False)]
    [Object[]]$ResourceGroupMap,

    [Parameter(Mandatory=$True)]
    [hashtable]$ResourceRoleDefinitionMap,

    [Parameter(Mandatory=$True)]
    [hashtable]$CustomResourceRoleDefinitionMap
)

# Convert ResourceGroupMap to Hashtable
$rgMap = @{}
foreach ( $rg in $ResourceGroupMap ) {
    $rgMap += @{
        $rg.SourceResourceGroup = $rg.TargetResourceGroup
    }
}

# Build Role Assignment Map
$raMap = @()
$ras = $RoleAssignments | Where-Object { $_.Scope -like "/subscriptions/*" -and $_.ObjectType -eq "User" }
foreach ( $ra in $ras ) {
    # Get Source Information
    $sScopeSplit = $ra.Scope.Split('/')
    $sRg = if( $sScopeSplit.Count -gt 4 ) { $sScopeSplit[4] } else { "" }
    $sRole = $ra.RoleDefinitionName

    # Get Target Information
    $tSub = $TargetSubscriptionId
    $tRg = $sRg.ToLower()
    if ( $tRg -in $rgMap.Keys ) { $tRg = $rgMap[$tRg] }
    $tRole = $sRole
    if ( $sScopeSplit.Count -ge 9 -and $sRole -in @("Owner","Contributor","Reader") ) {
        $tRole = "$($sScopeSplit[6..7] -join "/") $($sRole)"
        if ( $tRole -in $CustomResourceRoleDefinitionMap.Keys ) {
            $tRole = $CustomResourceRoleDefinitionMap[$tRole]
        } elseif ( $tRole -in $ResourceRoleDefinitionMap.Keys ) {
            $tRole = $ResourceRoleDefinitionMap[$tRole]
        }
    }
    $tScope = "/subscriptions/$($tSub)"
    if ( $tRg -ne "" ) { $tScope = "$($tScope)/resourceGroups/$($tRg)" }

    # Create Role Assignment Object
    $newRa = $ra
    $newRa | Add-Member -MemberType NoteProperty -Name TargetScope -Value $tScope
    $newRa | Add-Member -MemberType NoteProperty -Name TargetSubscriptionId -Value $tSub
    $newRa | Add-Member -MemberType NoteProperty -Name TargetResourceGroupName -Value $tRg
    $newRa | Add-Member -MemberType NoteProperty -Name TargetRoleDefinitionName -Value $tRole

    # Add Role Assignment to Map
    $raMap += $newRa
}

return $raMap