Skip to content

Commit

Permalink
Linting PSAvoidUsingWriteHost
Browse files Browse the repository at this point in the history
  • Loading branch information
arjenhuitema committed Mar 21, 2024
1 parent 2b936ad commit 841eb8f
Showing 1 changed file with 13 additions and 14 deletions.
27 changes: 13 additions & 14 deletions src/scripts/Set-RBACAmaPolicyAssignment.ps1
Original file line number Diff line number Diff line change
Expand Up @@ -20,57 +20,56 @@ $aumIdentityList = "Enable-AUM-CheckUpdates"


If (-NOT(Get-Module -ListAvailable Az.Resources)) {
Write-Host "This script requires the Az.Resources module." -ForegroundColor DarkYellow
Write-Output "This script requires the Az.Resources module."

$response = Read-Host "Would you like to install the 'Az.Resources' module now? (y/n)"
If ($response -match '[yY]') { Install-Module Az.Resources -Scope CurrentUser }
}

Write-Host "Retrieving Platform and Landing Zones management groups ..." -ForegroundColor Cyan
Write-Output "Retrieving Platform and Landing Zones management groups ..."

# getting Platform and Landing Zones mgs
$platformMg = Get-AzManagementGroup | Where-Object { $_.Name -like "$enterpriseScaleCompanyPrefix*-platform" } -ErrorAction SilentlyContinue
$landingZonesMg = Get-AzManagementGroup | Where-Object { $_.Name -like "$enterpriseScaleCompanyPrefix*-landingzones" } -ErrorAction SilentlyContinue

if ($platformMg -and $landingZonesMg) {
# getting role assignments for both Platform and landing Zones mgs
Write-Host "`tRetrieving role assignments on Platform management group ..."
Write-Output "`tRetrieving role assignments on Platform management group ..."
$platformMgAumRoleAssignments = Get-AzRoleAssignment -Scope $($platformMg.Id) | where-object { $_.Displayname -in $aumIdentityList } | Sort-Object -Property ObjectId -Unique
Write-Host "`tRetrieving role assignments on Landing Zones management group ..."

Write-Output "`tRetrieving role assignments on Landing Zones management group ..."
$landingZonesMgAumRoleAssignments = Get-AzRoleAssignment -Scope $($landingZonesMg.Id) | where-object { $_.Displayname -in $aumIdentityList } | Sort-Object -Property ObjectId -Unique
$landingZonesMgVmiCtRoleAssignments = Get-AzRoleAssignment -Scope $($landingZonesMg.Id) | where-object { $_.Displayname -in $vmiCtIdentityList } | Sort-Object -Property ObjectId -Unique

# Performing role assignments
if ($landingZonesMgVmiCtRoleAssignments) {
# assigning Reader role for VMI and CT Managed Identities from LandingZones to Platform mg
Write-Host "`t`tAssigning 'Reader' role for 'VMInsights' and 'Change Tracking' Managed Identities from Landing Zones to Platform management group ..." -ForegroundColor Cyan
Write-Output "`t`tAssigning 'Reader' role for 'VMInsights' and 'Change Tracking' Managed Identities from Landing Zones to Platform management group ..."
$landingZonesMgVmiCtRoleAssignments | ForEach-Object { New-AzRoleAssignment -Scope $($platformMg.Id) -RoleDefinitionName 'Reader' -ObjectId $_.ObjectId -ErrorAction SilentlyContinue }
}
else {
Write-Host "`t`tNo role assignment found on the Landing Zones management group for the given 'VMInsights' and 'Change Tracking' Managed Identities." -ForegroundColor DarkYellow
Write-Output "`t`tNo role assignment found on the Landing Zones management group for the given 'VMInsights' and 'Change Tracking' Managed Identities."
}

if ($landingZonesMgAumRoleAssignments) {
# assigning Managed Identity Operator to Azure Update Manager Managed Identity on Landing Zones mg
Write-Host "`t`tAssigning 'Managed Identity Operator' role to 'Azure Update Manager' Managed Identity on Landing Zones management group ..." -ForegroundColor Cyan
Write-Output "`t`tAssigning 'Managed Identity Operator' role to 'Azure Update Manager' Managed Identity on Landing Zones management group ..."
$landingZonesMgAumRoleAssignments | ForEach-Object { New-AzRoleAssignment -Scope $($landingZonesMg.Id) -RoleDefinitionName 'Managed Identity Operator' -ObjectId $_.ObjectId -ErrorAction SilentlyContinue }
}
else {
Write-Host "`t`tNo role assignment found on the Landing Zones management group for the given 'Azure Update Manger' Managed Identities." -ForegroundColor DarkYellow
Write-Output "`t`tNo role assignment found on the Landing Zones management group for the given 'Azure Update Manger' Managed Identities."
}

if ($platformMgAumRoleAssignments) {
# assigning Managed Identity Operator to Azure Update Manager Managed Identity on Platform mg
Write-Host "`t`tAssigning 'Managed Identity Operator' role to 'Azure Update Manager' Managed Identity on Platform management group ..." -ForegroundColor Cyan
Write-Output "`t`tAssigning 'Managed Identity Operator' role to 'Azure Update Manager' Managed Identity on Platform management group ..."
$platformMgAumRoleAssignments | ForEach-Object { New-AzRoleAssignment -Scope $($platformMg.Id) -RoleDefinitionName 'Managed Identity Operator' -ObjectId $_.ObjectId-ErrorAction SilentlyContinue }
}
else {
Write-Host "`t`tNo role assignment found on the Platform management group for the given 'Azure Update Manger' Managed Identity." -ForegroundColor DarkYellow
Write-Output "`t`tNo role assignment found on the Platform management group for the given 'Azure Update Manger' Managed Identity."
}
}
else {
Write-Host "`tOne or more management group of type 'Platform' and 'Landing Zones' was not found. Make sure you have the necessary permissions and/or that the hierachy is Azure Landing Zones aligned." -ForegroundColor Red
Write-Output "`tOne or more management group of type 'Platform' and 'Landing Zones' was not found. Make sure you have the necessary permissions and/or that the hierachy is Azure Landing Zones aligned."
}

Write-Host "Script execution completed." -ForegroundColor Green
Write-Output "Script execution completed."

0 comments on commit 841eb8f

Please sign in to comment.