Azure Source Plugin authentication issues with required write access instead of read access

CloudQuery Plugins
1

Hi Team,

I’m trying to write an Azure Source Plugin and the authentication with the cloud requires a Microsoft.Authorization/roleAssignments/write access. Why isn’t the read access working as we’re only trying to fetch/query the data?

2

Hi! Can you please share the redacted config you are using?

3 
kind: source
spec:
  # Source spec section
  name: "azure"
  path: "cloudquery/azure"
  version: "v9.3.4"
  destinations: ["postgresql"]
  tables: ["*"]
  spec:
  # Optional parameters

Creating a Service Principal

Following this way of authentication demands the write access.

4

Looking at it now, I see it says:

az ad sp create-for-rbac --name cloudquery-sp --scopes /subscriptions/$SUBSCRIPTION_ID --role Reader

So it only required Reader. Where do you see the reference to write access?

5

When I run the command, I get the following output:

MacBook-Pro ~ % az ad sp create-for-rbac --name cloudquery-sp --scopes /subscriptions/$SUBSCRIPTION_ID --role Reader

(AuthorizationFailed) The client '******' with object id '*******' does not have authorization to perform action 'Microsoft.Authorization/roleAssignments/write' over scope '/subscriptions/******/providers/Microsoft.Authorization/roleAssignments/****' or the scope is invalid. If access was recently granted, please refresh your credentials.
Code: AuthorizationFailed
Message: The client '******' with object id '******' does not have authorization to perform action 'Microsoft.Authorization/roleAssignments/write' over scope '/subscriptions/******/providers/Microsoft.Authorization/roleAssignments/******' or the scope is invalid. If access was recently granted, please refresh your credentials.
6

So you need writer access to create a reader role, but then you can use the reader role. Basically, you need to define which you want to use for fetching if it doesn’t already exist.