Azure permissions¶

The deploying identity is the Azure identity that runs terraform apply for qumulo_filesystem_azure. This page lists what that identity, and the managed identities the cluster runs as, must be allowed to do.

Deploying identity¶

Built-in roles	Covers
Owner	Every action on this page, when granted on the subscription
Contributor plus User Access Administrator	Every action on this page, when granted on the subscription

Contributor alone cannot write role assignments or management locks, so it is not enough to deploy a cluster. A grant on a resource group covers only the actions the table below scopes to that resource group.

Specific actions¶

Action	Scope	When it is needed
`Microsoft.Authorization/roleAssignments/write`	The deployment resource group	Every cluster, to grant roles to the provisioner VM and the cluster nodes. Not needed when both `cluster_node_identity_id` and `provisioner_identity_id` are set.
`Microsoft.AppConfiguration/configurationStores/write`	The deployment resource group	Every cluster, to create the App Configuration store that carries provisioning status
`Microsoft.KeyVault/vaults/write`	The deployment resource group	Every cluster, to create the Key Vault for cluster secrets. The permission check also asks for it when `key_vault_id` is set.
`Microsoft.Authorization/locks/write`, `Microsoft.Authorization/locks/delete`	The deployment resource group	When `deletion_protection = true`
`Microsoft.Network/virtualNetworks/checkIpAddressAvailability/read`	The virtual network, or any parent scope	When `floating_ip_count` is greater than 0, including clusters that set their own identities. Reader, Network Contributor, and Contributor carry it. A grant of only `subnets/read` plus `subnets/join/action` does not.
`Microsoft.Authorization/roleDefinitions/write`	The subscription	When the provider creates the node identity, to define the per-deployment `Qumulo Join Subnet` role that attaches floating IPs. Without it, the provider logs a warning and floating IP attachment can fail.

At the start of create, the provider checks the first five rows and names any action that is missing. It skips that check when cluster_node_identity_id or provisioner_identity_id is set.

Cluster node identity¶

These roles apply to a user-assigned identity supplied through cluster_node_identity_id. The provider grants nothing to it.

Role	Scope
Key Vault Secrets User	The deployment resource group
Storage Blob Data Contributor	The deployment resource group, or `persistent_storage_resource_group` when it is set
Reader	The deployment resource group

Provisioner identity¶

These roles apply to a user-assigned identity supplied through provisioner_identity_id. The provider grants nothing to it.

Role	Scope
Key Vault Secrets User	The deployment resource group
App Configuration Data Owner	The deployment resource group
Virtual Machine Contributor	The deployment resource group

One identity can serve both attributes when it holds every role from both tables. An identity in another subscription works too, since the provider reads the subscription from the identity's resource ID.

Customer-managed Key Vault¶

A vault supplied through key_vault_id must accept network traffic from the cluster subnet for the life of the cluster. Bring your own Key Vault lists the ways to allow it.