Validate scope before creating Azure custom roles (#523)

src/operator/controllers/intents_reconcilers/iam/iampolicyagents/azurepolicyagent/agent.go

@@ -366,6 +366,12 @@ func (a *Agent) ensureCustomRoleForIntent(ctx context.Context, userAssignedIdent
 	actions := intent.Azure.Actions
 	dataActions := intent.Azure.DataActions
 
+	// Validate that the scope exists before creating the custom role
+	err := a.ValidateScope(ctx, scope)
+	if err != nil {
+		return errors.Wrap(err)
+	}
+
 	customRoleName := a.GenerateCustomRoleName(userAssignedIdentity, scope)
 	role, found := a.FindCustomRoleByName(ctx, customRoleName)
 	if found {

src/operator/controllers/intents_reconcilers/iam/iampolicyagents/azurepolicyagent/agent_customroles_test.go

@@ -6,6 +6,7 @@ import (
 	"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/authorization/armauthorization/v2"
 	"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/keyvault/armkeyvault"
 	"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/msi/armmsi"
+	"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/resources/armresources"
 	"github.com/google/uuid"
 	otterizev2alpha1 "github.com/otterize/intents-operator/src/operator/api/v2alpha1"
 	"github.com/otterize/intents-operator/src/shared/azureagent"
@@ -30,6 +31,7 @@ type AzureCustomRoleTestCase struct {
 type AzureAgentPoliciesCustomRolesSuite struct {
 	suite.Suite
 
+	mockResourcesClient                    *mock_azureagent.MockAzureARMResourcesClient
 	mockSubscriptionsClient                *mock_azureagent.MockAzureARMSubscriptionsClient
 	mockResourceGroupsClient               *mock_azureagent.MockAzureARMResourcesResourceGroupsClient
 	mockManagedClustersClient              *mock_azureagent.MockAzureARMContainerServiceManagedClustersClient
@@ -42,6 +44,14 @@ type AzureAgentPoliciesCustomRolesSuite struct {
 	agent *Agent
 }
 
+func (s *AzureAgentPoliciesCustomRolesSuite) expectGetByIDReturnsResource(scope string) {
+	s.mockResourcesClient.EXPECT().GetByID(gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any()).Return(armresources.ClientGetByIDResponse{
+		GenericResource: armresources.GenericResource{
+			ID: &scope,
+		},
+	}, nil)
+}
+
 func (s *AzureAgentPoliciesCustomRolesSuite) expectListRoleDefinitionsReturnsPager(roles []*armauthorization.RoleDefinition) {
 	s.mockRoleDefinitionsClient.EXPECT().NewListPager(gomock.Any(), gomock.Any()).Return(azureagent.NewListPager[armauthorization.RoleDefinitionsClientListResponse](
 		armauthorization.RoleDefinitionsClientListResponse{
@@ -96,6 +106,8 @@ func (s *AzureAgentPoliciesCustomRolesSuite) expectListKeyVaultsReturnsEmpty() {
 
 func (s *AzureAgentPoliciesCustomRolesSuite) SetupTest() {
 	controller := gomock.NewController(s.T())
+
+	s.mockResourcesClient = mock_azureagent.NewMockAzureARMResourcesClient(controller)
 	s.mockSubscriptionsClient = mock_azureagent.NewMockAzureARMSubscriptionsClient(controller)
 	s.mockResourceGroupsClient = mock_azureagent.NewMockAzureARMResourcesResourceGroupsClient(controller)
 	s.mockManagedClustersClient = mock_azureagent.NewMockAzureARMContainerServiceManagedClustersClient(controller)
@@ -116,6 +128,7 @@ func (s *AzureAgentPoliciesCustomRolesSuite) SetupTest() {
 				AKSClusterOIDCIssuerURL: testOIDCIssuerURL,
 			},
 			nil,
+			s.mockResourcesClient,
 			s.mockSubscriptionsClient,
 			s.mockResourceGroupsClient,
 			s.mockManagedClustersClient,
@@ -201,11 +214,13 @@ var azureCustomRoleTestCases = []AzureCustomRoleTestCase{
 
 func (s *AzureAgentPoliciesCustomRolesSuite) TestAddRolePolicyFromIntents_CustomRoles() {
 	for _, testCase := range azureCustomRoleTestCases {
+		targetScope := "/providers/Microsoft.Storage/storageAccounts/test/blobServices/default/containers/container"
+
 		s.Run(testCase.Name, func() {
 			intents := []otterizev2alpha1.Target{
 				{
 					Azure: &otterizev2alpha1.AzureTarget{
-						Scope:       "/providers/Microsoft.Storage/storageAccounts/test/blobServices/default/containers/container",
+						Scope:       targetScope,
 						Roles:       testCase.Roles,
 						Actions:     testCase.Actions,
 						DataActions: testCase.DataActions,
@@ -231,6 +246,7 @@ func (s *AzureAgentPoliciesCustomRolesSuite) TestAddRolePolicyFromIntents_Custom
 			// Make sure the custom role is created
 			var customRoleDefinition armauthorization.RoleDefinition
 			if testCase.UpdateExpected {
+				s.expectGetByIDReturnsResource(targetScope)
 				s.expectCreateOrUpdateRoleDefinitionWriteRoleDefinition(&customRoleDefinition)
 			}
 

src/operator/controllers/intents_reconcilers/iam/iampolicyagents/azurepolicyagent/agent_identities_test.go

@@ -17,6 +17,7 @@ import (
 type AzureAgentIdentitiesSuite struct {
 	suite.Suite
 
+	mockResourcesClient                    *mock_azureagent.MockAzureARMResourcesClient
 	mockSubscriptionsClient                *mock_azureagent.MockAzureARMSubscriptionsClient
 	mockResourceGroupsClient               *mock_azureagent.MockAzureARMResourcesResourceGroupsClient
 	mockManagedClustersClient              *mock_azureagent.MockAzureARMContainerServiceManagedClustersClient
@@ -31,6 +32,8 @@ type AzureAgentIdentitiesSuite struct {
 
 func (s *AzureAgentIdentitiesSuite) SetupTest() {
 	controller := gomock.NewController(s.T())
+
+	s.mockResourcesClient = mock_azureagent.NewMockAzureARMResourcesClient(controller)
 	s.mockSubscriptionsClient = mock_azureagent.NewMockAzureARMSubscriptionsClient(controller)
 	s.mockResourceGroupsClient = mock_azureagent.NewMockAzureARMResourcesResourceGroupsClient(controller)
 	s.mockManagedClustersClient = mock_azureagent.NewMockAzureARMContainerServiceManagedClustersClient(controller)
@@ -51,6 +54,7 @@ func (s *AzureAgentIdentitiesSuite) SetupTest() {
 				AKSClusterOIDCIssuerURL: testOIDCIssuerURL,
 			},
 			nil,
+			s.mockResourcesClient,
 			s.mockSubscriptionsClient,
 			s.mockResourceGroupsClient,
 			s.mockManagedClustersClient,

src/operator/controllers/intents_reconcilers/iam/iampolicyagents/azurepolicyagent/agent_keyvault_test.go

@@ -22,6 +22,7 @@ import (
 type AzureAgentPoliciesKeyVaultSuite struct {
 	suite.Suite
 
+	mockResourcesClient                    *mock_azureagent.MockAzureARMResourcesClient
 	mockSubscriptionsClient                *mock_azureagent.MockAzureARMSubscriptionsClient
 	mockResourceGroupsClient               *mock_azureagent.MockAzureARMResourcesResourceGroupsClient
 	mockManagedClustersClient              *mock_azureagent.MockAzureARMContainerServiceManagedClustersClient
@@ -36,6 +37,8 @@ type AzureAgentPoliciesKeyVaultSuite struct {
 
 func (s *AzureAgentPoliciesKeyVaultSuite) SetupTest() {
 	controller := gomock.NewController(s.T())
+
+	s.mockResourcesClient = mock_azureagent.NewMockAzureARMResourcesClient(controller)
 	s.mockSubscriptionsClient = mock_azureagent.NewMockAzureARMSubscriptionsClient(controller)
 	s.mockResourceGroupsClient = mock_azureagent.NewMockAzureARMResourcesResourceGroupsClient(controller)
 	s.mockManagedClustersClient = mock_azureagent.NewMockAzureARMContainerServiceManagedClustersClient(controller)
@@ -56,6 +59,7 @@ func (s *AzureAgentPoliciesKeyVaultSuite) SetupTest() {
 				AKSClusterOIDCIssuerURL: testOIDCIssuerURL,
 			},
 			nil,
+			s.mockResourcesClient,
 			s.mockSubscriptionsClient,
 			s.mockResourceGroupsClient,
 			s.mockManagedClustersClient,

src/shared/azureagent/agent.go

@@ -31,6 +31,7 @@ type Config struct {
 type Agent struct {
 	Conf                               Config
 	credentials                        *azidentity.DefaultAzureCredential
+	resourceClient                     AzureARMResourcesClient
 	subscriptionClient                 AzureARMSubscriptionsClient
 	resourceGroupsClient               AzureARMResourcesResourceGroupsClient
 	managedClustersClient              AzureARMContainerServiceManagedClustersClient
@@ -49,6 +50,11 @@ func NewAzureAgent(ctx context.Context, conf Config) (*Agent, error) {
 		return nil, errors.Wrap(err)
 	}
 
+	armResourcesClientFactory, err := armresources.NewClientFactory(conf.SubscriptionID, credentials, nil)
+	if err != nil {
+		return nil, errors.Wrap(err)
+	}
+
 	armsubscriptionsClientFactory, err := armsubscriptions.NewClientFactory(credentials, nil)
 	if err != nil {
 		return nil, errors.Wrap(err)
@@ -79,6 +85,7 @@ func NewAzureAgent(ctx context.Context, conf Config) (*Agent, error) {
 		return nil, errors.Wrap(err)
 	}
 
+	resourceClient := armResourcesClientFactory.NewClient()
 	subscriptionClient := armsubscriptionsClientFactory.NewClient()
 	userAssignedIdentitiesClient := armmsiClientFactory.NewUserAssignedIdentitiesClient()
 	federatedIdentityCredentialsClient := armmsiClientFactory.NewFederatedIdentityCredentialsClient()
@@ -87,7 +94,19 @@ func NewAzureAgent(ctx context.Context, conf Config) (*Agent, error) {
 	managedClustersClient := armcontainerserviceClientFactory.NewManagedClustersClient()
 	vaultsClient := armkeyvaultClientFactory.NewVaultsClient()
 
-	agent := NewAzureAgentFromClients(conf, credentials, subscriptionClient, resourceGroupsClient, managedClustersClient, userAssignedIdentitiesClient, federatedIdentityCredentialsClient, roleDefinitionsClient, roleAssignmentsClient, vaultsClient)
+	agent := NewAzureAgentFromClients(
+		conf,
+		credentials,
+		resourceClient,
+		subscriptionClient,
+		resourceGroupsClient,
+		managedClustersClient,
+		userAssignedIdentitiesClient,
+		federatedIdentityCredentialsClient,
+		roleDefinitionsClient,
+		roleAssignmentsClient,
+		vaultsClient,
+	)
 
 	if err := agent.loadConfDefaults(ctx); err != nil {
 		return nil, errors.Wrap(err)
@@ -96,10 +115,11 @@ func NewAzureAgent(ctx context.Context, conf Config) (*Agent, error) {
 	return agent, nil
 }
 
-func NewAzureAgentFromClients(conf Config, credentials *azidentity.DefaultAzureCredential, subscriptionClient AzureARMSubscriptionsClient, resourceGroupsClient AzureARMResourcesResourceGroupsClient, managedClustersClient AzureARMContainerServiceManagedClustersClient, userAssignedIdentitiesClient AzureARMMSIUserAssignedIdentitiesClient, federatedIdentityCredentialsClient AzureARMMSIFederatedIdentityCredentialsClient, roleDefinitionsClient AzureARMAuthorizationRoleDefinitionsClient, roleAssignmentsClient AzureARMAuthorizationRoleAssignmentsClient, vaultsClient AzureARMKeyVaultVaultsClient) *Agent {
+func NewAzureAgentFromClients(conf Config, credentials *azidentity.DefaultAzureCredential, resourceClient AzureARMResourcesClient, subscriptionClient AzureARMSubscriptionsClient, resourceGroupsClient AzureARMResourcesResourceGroupsClient, managedClustersClient AzureARMContainerServiceManagedClustersClient, userAssignedIdentitiesClient AzureARMMSIUserAssignedIdentitiesClient, federatedIdentityCredentialsClient AzureARMMSIFederatedIdentityCredentialsClient, roleDefinitionsClient AzureARMAuthorizationRoleDefinitionsClient, roleAssignmentsClient AzureARMAuthorizationRoleAssignmentsClient, vaultsClient AzureARMKeyVaultVaultsClient) *Agent {
 	return &Agent{
 		Conf:                               conf,
 		credentials:                        credentials,
+		resourceClient:                     resourceClient,
 		subscriptionClient:                 subscriptionClient,
 		resourceGroupsClient:               resourceGroupsClient,
 		managedClustersClient:              managedClustersClient,

src/shared/azureagent/azureclients.go

@@ -11,6 +11,10 @@ import (
 	"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/resources/armsubscriptions"
 )
 
+type AzureARMResourcesClient interface {
+	GetByID(ctx context.Context, resourceID string, apiVersion string, options *armresources.ClientGetByIDOptions) (armresources.ClientGetByIDResponse, error)
+}
+
 type AzureARMSubscriptionsClient interface {
 	Get(ctx context.Context, subscriptionID string, options *armsubscriptions.ClientGetOptions) (armsubscriptions.ClientGetResponse, error)
 }

src/shared/azureagent/customroles.go

@@ -31,6 +31,17 @@ func (a *Agent) GenerateCustomRoleName(uai armmsi.Identity, scope string) string
 	return agentutils.TruncateHashName(fullName, maxRoleNameLength)
 }
 
+func (a *Agent) ValidateScope(ctx context.Context, scope string) error {
+	res, err := a.resourceClient.GetByID(ctx, scope, "2022-09-01", nil)
+	if err != nil {
+		return err
+	}
+	if res.GenericResource.ID == nil {
+		return errors.Errorf("scope %s not found", scope)
+	}
+	return nil
+}
+
 func (a *Agent) CreateCustomRole(ctx context.Context, scope string, uai armmsi.Identity, actions []v2alpha1.AzureAction, dataActions []v2alpha1.AzureDataAction) (*armauthorization.RoleDefinition, error) {
 	roleScope := a.getCustomRoleScope()