☁️ Azure Synapse Role Assignment Terraform Module

module "analyst_access" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-synapse-role-assignment.git?ref=v1.0.0"

  synapse_workspace_id = module.workspace.id

  principal_id   = data.azuread_group.analysts.object_id
  principal_type = "Group"
  role_name      = "Synapse Contributor"
}

module "pipeline_identity" {
  source              = "git::https://github.com/microsoftexpert/terraform-azurerm-user-assigned-identity.git?ref=v1.0.0"
  name                = "id-synapse-pipeline"
  resource_group_name = module.rg.name
  location            = module.rg.location
}

module "pipeline_identity_access" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-synapse-role-assignment.git?ref=v1.0.0"

  synapse_workspace_id = module.workspace.id

  principal_id   = module.pipeline_identity.principal_id
  principal_type = "ServicePrincipal" # NOT "ManagedIdentity" -- no such value here
  role_name      = "Synapse Artifact User"
}

module "spark_operator_access" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-synapse-role-assignment.git?ref=v1.0.0"

  # EXACTLY ONE scope. The workspace argument is simply absent.
  synapse_spark_pool_id = module.spark_pool.id

  principal_id   = data.azuread_group.data_engineers.object_id
  principal_type = "Group"
  role_name      = "Synapse Compute Operator"
}

module "broken_access" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-synapse-role-assignment.git?ref=v1.0.0"

  synapse_workspace_id  = module.workspace.id
  synapse_spark_pool_id = module.spark_pool.id # <-- both set

  principal_id = data.azuread_group.analysts.object_id
  role_name    = "Synapse User"
}

module "app_access" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-synapse-role-assignment.git?ref=v1.0.0"

  synapse_workspace_id = module.workspace.id

  # WRONG: this is the application (client) ID. It is a UUID, so it passes
  # every validation -- and grants nothing usable.
  # principal_id = azuread_application.pipeline.client_id

  # RIGHT: the service principal's OBJECT id.
  principal_id   = azuread_service_principal.pipeline.object_id
  principal_type = "ServicePrincipal"
  role_name      = "Synapse Artifact Publisher"
}

module "admin_access" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-synapse-role-assignment.git?ref=v1.0.0"

  synapse_workspace_id = module.workspace.id
  principal_id         = data.azuread_group.platform_admins.object_id
  principal_type       = "Group"
  role_name            = "Workspace Admin" # <-- the legacy name
}

module "monitoring_identity" {
  source              = "git::https://github.com/microsoftexpert/terraform-azurerm-user-assigned-identity.git?ref=v1.0.0"
  name                = "id-synapse-monitoring"
  resource_group_name = module.rg.name
  location            = module.rg.location
}

locals {
  synapse_access = {
    platform_admins = { principal = data.azuread_group.platform_admins.object_id, type = "Group", role = "Synapse Administrator" }
    data_engineers  = { principal = data.azuread_group.data_engineers.object_id, type = "Group", role = "Synapse Contributor" }
    analysts        = { principal = data.azuread_group.analysts.object_id, type = "Group", role = "Synapse User" }
    monitoring      = { principal = module.monitoring_identity.principal_id, type = "ServicePrincipal", role = "Synapse Monitoring Operator" }
  }
}

module "synapse_access" {
  source   = "git::https://github.com/microsoftexpert/terraform-azurerm-synapse-role-assignment.git?ref=v1.0.0"
  for_each = local.synapse_access

  synapse_workspace_id = module.workspace.id

  principal_id   = each.value.principal
  principal_type = each.value.type
  role_name      = each.value.role
}

output "synapse_rbac_review" {
  value = {
    for k, m in module.synapse_access : k => {
      principal    = m.principal_id
      type         = m.principal_type
      role         = m.role_name
      scope        = m.scope
      workspace    = m.synapse_workspace_name
      pool_scoped  = m.is_scoped_to_a_spark_pool
      is_admin     = m.is_an_administrator_role
      cli_id       = m.data_plane_assignment_id
    }
  }
}

output "synapse_administrators" {
  value = [for k, m in module.synapse_access : m.principal_id if m.is_an_administrator_role]
}

locals {
  grants_by_workspace = {
    for wsid in distinct([for k, m in module.synapse_access : m.effective_workspace_id]) :
    wsid => [for k, m in module.synapse_access : k if m.effective_workspace_id == wsid]
  }
}

output "synapse_grants_per_workspace" {
  value = local.grants_by_workspace
}

# Azure RBAC: lets the group SEE the workspace resource and open Synapse Studio.
module "arm_reader" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-role-assignments.git?ref=v1.0.0"

  scope = module.workspace.id

  role_assignments = {
    analysts = {
      principal_id         = data.azuread_group.analysts.object_id
      role_definition_name = "Reader"
      principal_type       = "Group"
    }
  }
}

# Synapse RBAC: lets the same group actually DO anything inside it.
module "synapse_user" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-synapse-role-assignment.git?ref=v1.0.0"

  synapse_workspace_id = module.workspace.id

  principal_id   = data.azuread_group.analysts.object_id
  principal_type = "Group"
  role_name      = "Synapse User"
}

module "analyst_access" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-synapse-role-assignment.git?ref=v1.0.0"

  synapse_workspace_id = module.workspace.id
  principal_id         = data.azuread_group.analysts.object_id
  principal_type       = "Group"
  role_name            = "Synapse Contributor"

  timeouts = {
    create = "30m"
    read   = "5m"
    delete = "30m"
    # there is no `update` -- the resource has no update function
  }
}

# Removing the module block is the revoke. There is no "disabled" state and no
# expiry: a Synapse role assignment exists or it does not.
#
# Note that `has_no_update_at_all` is true, so CHANGING a role is also a revoke
# and a re-grant -- Terraform destroys the old assignment and creates a new one,
# and there is a window between them.

output "changing_a_role_is_not_atomic" {
  value = {
    no_update   = module.analyst_access.has_no_update_at_all
    force_new   = module.analyst_access.force_new_fields
    implication = "a role change is a destroy and create, with a brief gap"
  }
}

provider "azurerm" {
  features {}
}

data "azuread_group" "platform_admins" {
  display_name = "Analytics Platform Admins"
}

data "azuread_group" "data_engineers" {
  display_name = "Analytics Data Engineers"
}

data "azuread_group" "analysts" {
  display_name = "Analytics Consumers"
}

module "rg" {
  source   = "git::https://github.com/microsoftexpert/terraform-azurerm-resource-group.git?ref=v1.0.0"
  name     = "rg-analytics-prod"
  location = "eastus2"
}

module "lake" {
  source                   = "git::https://github.com/microsoftexpert/terraform-azurerm-storage-account.git?ref=v1.0.0"
  name                     = "stanalyticsprod01"
  resource_group_name      = module.rg.name
  location                 = module.rg.location
  account_tier             = "Standard"
  account_replication_type = "ZRS"
  is_hns_enabled           = true
}

resource "azurerm_storage_data_lake_gen2_filesystem" "root" {
  name               = "synapse-root"
  storage_account_id = module.lake.id
}

module "workspace" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-synapse-workspace.git?ref=v1.0.0"

  name                                 = "synw-analytics-prod"
  resource_group_name                  = module.rg.name
  location                             = module.rg.location
  storage_data_lake_gen2_filesystem_id = azurerm_storage_data_lake_gen2_filesystem.root.id

  azuread_authentication_only = true
  identity                    = { type = "SystemAssigned" }

  tags = {
    environment = "prod"
    workload    = "analytics"
  }
}

module "spark_pool" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-synapse-spark-pool.git?ref=v1.0.0"

  name                 = "sparkprod"
  synapse_workspace_id = module.workspace.id
  node_size_family     = "MemoryOptimized"
  node_size            = "Small"
  node_count           = 3
  spark_version        = "3.5"
}

# Azure RBAC -- so the groups can see the workspace at all.
module "arm_access" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-role-assignments.git?ref=v1.0.0"

  scope = module.workspace.id

  role_assignments = {
    analysts = {
      principal_id         = data.azuread_group.analysts.object_id
      role_definition_name = "Reader"
      principal_type       = "Group"
    }
  }
}

# Synapse RBAC at the WORKSPACE scope.
locals {
  workspace_grants = {
    platform_admins = { principal = data.azuread_group.platform_admins.object_id, role = "Synapse Administrator" }
    data_engineers  = { principal = data.azuread_group.data_engineers.object_id, role = "Synapse Contributor" }
    analysts        = { principal = data.azuread_group.analysts.object_id, role = "Synapse User" }
  }
}

module "workspace_access" {
  source   = "git::https://github.com/microsoftexpert/terraform-azurerm-synapse-role-assignment.git?ref=v1.0.0"
  for_each = local.workspace_grants

  synapse_workspace_id = module.workspace.id

  principal_id   = each.value.principal
  principal_type = "Group"
  role_name      = each.value.role
}

# Synapse RBAC at the narrower SPARK POOL scope.
module "spark_pool_access" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-synapse-role-assignment.git?ref=v1.0.0"

  synapse_spark_pool_id = module.spark_pool.id

  principal_id   = data.azuread_group.data_engineers.object_id
  principal_type = "Group"
  role_name      = "Synapse Compute Operator"
}

output "synapse_rbac_review" {
  value = {
    workspace_scoped = {
      for k, m in module.workspace_access : k => {
        principal = m.principal_id
        role      = m.role_name
        is_admin  = m.is_an_administrator_role
        scope     = m.scope
      }
    }
    pool_scoped = {
      principal = module.spark_pool_access.principal_id
      role      = module.spark_pool_access.role_name
      pool      = module.spark_pool_access.synapse_spark_pool_name
      workspace = module.spark_pool_access.effective_workspace_id
    }
    administrators = [
      for k, m in module.workspace_access : m.principal_id if m.is_an_administrator_role
    ]
  }
}

variable "synapse_workspace_id" {
  type    = string
  default = null
  # Anchored at both ends. Rejects a Spark pool ID (which belongs in the other
  # argument) and a dedicated SQL pool ID (which is not a Synapse RBAC scope at
  # all), each with its own message.
}

variable "synapse_spark_pool_id" {
  type    = string
  default = null
  # Anchored at both ends on /bigDataPools/. Carries the exactly-one-of check,
  # because a Terraform validation may only reference its own variable.
}

variable "principal_id" {
  type = string
  # The Entra OBJECT ID, as a UUID -- mirrors the provider's check. Also
  # rejects a user principal name and the all-zero placeholder GUID. An
  # application ID cannot be rejected: it is a valid UUID.
}

variable "principal_type" {
  type    = string
  default = null
  # Exactly "User", "Group" or "ServicePrincipal", case-sensitively. A
  # managed-identity value is rejected with its own message: there is no
  # "ManagedIdentity" here.
}

variable "role_name" {
  type = string
  # One of eleven names, case-sensitively -- mirrors the provider's list. The
  # three LEGACY names are rejected with a message naming each replacement, and
  # surrounding whitespace is rejected separately because the role names
  # themselves contain spaces.
}

variable "timeouts" {
  type = object({
    create = optional(string)
    read   = optional(string)
    delete = optional(string)
  })
  default = null
  # NO `update` member: the resource has no update function. Provider
  # defaults: create 30m, read 5m, delete 30m.
}