fix: address some security concerns (ENG-5229) #11
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
howbazaar
commented
Jul 9, 2025
| source = body["data"]["operationName"].split("/")[0] | ||
|
|
||
| try: | ||
| logging.info("Forwarding event to Stacklet") |
There was a problem hiding this comment.
I originally only changed these quotes to change the hash, but it became clear that the entire file had dos line endings, so fixed that.
howbazaar
changed the title
wgrant
force-pushed
the
thumper/fix/some-security-concerns
branch
from
77c4776 to
07df4ae
Compare
wgrant
added a commit
that referenced
this pull request
Jul 23, 2025
### what Various cleanups and usability improvements made while iterating on #11: * Allow hyphens in the prefix. * Allow customising the resource group name. * Provide a default resource group location. * Allow Terraform to force-delete a non-empty resource group, since Application Insights creates other resources automatically. * Allow configuration of the subscription ID without setting ARM_SUBSCRIPTION_ID. * Create the app role assignment using an actual Terraform resource, not a subprocess call. * Fix Application Insights plan noise. * Fix DOS line endings. Upgrades will need to `terraform import azuread_app_role_assignment.stacklet_app_role_assignment /servicePrincipals/<SERVICE-PRINCIPAL-ID>/appRoleAssignedTo/<APP-ROLE-ASSIGNMENT-ID>`. The service principal ID is the `object_id` field of `azuread_service_principal.stacklet_sp[0]`, and you can find the role assignment ID with `az rest --method GET --uri "https://graph.microsoft.com/v1.0/servicePrincipals/<SERVICE-PRINCIPAL-ID>/appRoleAssignedTo"`. ### why Iterating on changes was annoying. These changes were mostly originally from #11. ### testing On my test deployment. --------- Co-authored-by: Tim Penhey <[email protected]>
wgrant
added a commit
that referenced
this pull request
Jul 24, 2025
[ENG-5440](https://stacklet.atlassian.net/browse/ENG-5440) ### what Upgrade to Python 3.12, and upgrade other Python dependencies. Also build and publish the function code using native Terraform resources instead of execing the Azure CLI. ### why The dependencies were out of date and holey. And the Terraform was ugly and didn't no-op properly. These changes were mostly adapted from #11. ### testing Extensively on my and thumper's sandboxes. [ENG-5440]: https://stacklet.atlassian.net/browse/ENG-5440?atlOrigin=eyJpIjoiNWRkNTljNzYxNjVmNDY3MDlhMDU5Y2ZhYzA5YTRkZjUiLCJwIjoiZ2l0aHViLWNvbS1KU1cifQ --------- Co-authored-by: Tim Penhey <[email protected]>
wgrant
force-pushed
the
thumper/fix/some-security-concerns
branch
from
07df4ae to
199881b
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
ENG-5229
what
Tightens up security access requirements.
Deploys the function directly using a zip file and terraform rather than shelling out.
Upgrades to python 3.12.
why
Why is this change being made?
testing
How was this change tested?
docs
Could this change benefit from a documentation update (either user-facing or internal)? If so, provide link to new docs or ticket to create them.