Creating a service principal for a pipeline, when you're not a subscription owner

[aaronpowell]

I'm contributing some azd work to a a project, including using azd to deploy using GitHub Actions.

The deployment is going into a subscription that I don't have owner or contributor access to, but I do have access to the resource group (so I can view the deployed resources once done).

When I run azd pipeline config it fails as I don't have permissions, so I'd like to give an Azure CLI command to someone else to run so that they can provide the service principal, but I'm not sure the command.

I've tried the az ad sp create-for-rbac as described https://github.com/marketplace/actions/azure-login#configure-a-service-principal-with-a-secret but it doesn't look like it has enough permissions, failing with the following error:

Error: deploying infrastructure: error deploying infrastructure: failed deploying: failed running az deployment sub create: 

Deployment Error Details:
AuthorizationFailed: The client '...' with object id '...' does not have authorization to perform action 'Microsoft.Resources/deployments/validate/action' over scope '/subscriptions/***' or the scope is invalid. If access was recently granted, please refresh your credentials.

What's the "raw" az ad sp create-for-rbac that would need to be run to create the a service principal with the required permissions?

[vhvb1989]

When I run azd pipeline config it fails as I don't have permissions, so I'd like to give an Azure CLI command to someone else to run so that they can provide the service principal, but I'm not sure the command.

For your scenario, you would need two different Service Principal Applications.
The first one SP which you would use to log it the Azure CLI running something like:

#Log in with a service principal using client secret. Use -p=secret if the first character of the
#    password is '-'.
        az login --service-principal -u http://azure-cli-2016-08-05-14-31-15 -p VerySecret --tenant
        contoso.onmicrosoft.com

You will ask a contributor or admin to create this SP and share the SP details for consuming (id + tenant + either a secret or a certificate).
*** This SP should be added as contributor for the Azure Subscripion that you are using. This way, the SP will be able to create another SP and assign roles to it. This can be done from Azure Portal by going to the subscription and to Access Control (IAM):

Then, use the Add button from Role Assigments to grant contributor role to the SP

Once you have this info, run az login --service-principal .... before running azd pipeline config.
azd will use the SP to create a new SP to be used by GitHub actions and set it all up for you.

As soon as yout GitHub action is set up and running, the initial SP can be removed (or the secret for it can be rotated) as you will no longer need it.

You might be wondering now... Can we make azd to take a SP directly (without creating a new one) ??? so we can use the first created SP and skip azd creating the second SP?
The answer is, azd does not currently support this. I will propose it to the team for consideration.