Use WEBSITE_RUN_FROM_PACKAGE in azure functions for deployment

scripts/Release/service_principals_roles.ps1

@@ -2,7 +2,7 @@
 .SYNOPSIS
     Sets roles to a different azure resources.
 .DESCRIPTION
-    Sets the roles for different service principal for different resources.
+    Sets the roles for different identities for different resources.
 #>
 Param(
     [Parameter(Mandatory=$true)]
@@ -45,23 +45,25 @@ function GetScope {
     {
         return "/subscriptions/$subscriptionId/resourceGroups/$resourceGroup/providers/Microsoft.AppConfiguration/configurationStores/$resourceName"
     }
+    elseif ($resourceType -eq [ResourceType]::Cdn)
+    {
+        return "/subscriptions/$subscriptionId/resourceGroups/$resourceGroup/providers/Microsoft.Cdn/profiles/$resourceName"
+    }
     else
     {
         throw "Not supported"
     }
 }
 
-function AssignRoles {
+function AssignRolesServicePrincipals {
     param (
         [Parameter(Mandatory=$true)]
-        [ResourceType]
-        $resourceType,
+        [PSCustomObject]$resource,
         [Parameter(Mandatory=$true)]
-        [PSCustomObject]$resource
+        [string]
+        $scope
     )
 
-    $private:scope = GetScope $resourceType $($resource.name)
-
     foreach ($sp in $resource.servicePrincipals)
     {
         Write-Host "Configuring $($sp.displayName) in $($resource.name)"
@@ -92,15 +94,30 @@ function AssignRoles {
     }
 }
 
+function AssignResourceRoles {
+    param (
+        [Parameter(Mandatory=$true)]
+        [ResourceType]
+        $resourceType,
+        [Parameter(Mandatory=$true)]
+        [PSCustomObject]$resource
+    )
+
+    $private:scope = GetScope $resourceType $($resource.name)
+    AssignRolesServicePrincipals $resource $scope
+}
+
 Set-AzContext -SubscriptionId $subscriptionId | Out-Null
 $local:data = Get-Content $rolesFile -Raw | ConvertFrom-Json
 
 foreach ($storageAccount in $data.storageAccounts)
 {
-    AssignRoles StorageAccount $storageAccount
+    AssignResourceRoles StorageAccount $storageAccount
 }
 
 foreach ($appConfig in $data.appConfigs)
 {
-    AssignRoles AppConfig $appConfig
+    AssignResourceRoles AppConfig $appConfig
 }
+
+AssignRolesServicePrincipals $data.subscription "/subscriptions/$subscriptionId"

src/WinGet.RestSource.Infrastructure/Parameters/AzureFunction/azurefunction.deployment.json

@@ -0,0 +1,9 @@
+{
+    "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentParameters.json#",
+    "contentVersion": "1.0.0.0",
+    "parameters": {
+        "runFromPackageUrl": {
+            "value": ""
+        }
+    }
+}

src/WinGet.RestSource.Infrastructure/Parameters/AzureFunction/azurefunction.int.centus.json

@@ -20,9 +20,6 @@
     "functionName": {
       "value": "azfun-wgrest-api-centus-int"
     },
-    "storageSecretName": {
-      "value": "stwgrestcentusintConnectionString"
-    },
     "appServiceName": {
       "value": "asp-wgrest-centus-int"
     },

src/WinGet.RestSource.Infrastructure/Parameters/AzureFunction/azurefunction.int.westus.json

@@ -20,9 +20,6 @@
     "functionName": {
       "value": "azfun-wgrest-api-westus-int"
     },
-    "storageSecretName": {
-      "value": "stwgrestwestusintConnectionString"
-    },
     "appServiceName": {
       "value": "asp-wgrest-westus-int"
     },

src/WinGet.RestSource.Infrastructure/Parameters/AzureFunction/azurefunction.pme.centus.json

@@ -20,9 +20,6 @@
     "functionName": {
       "value": "azfun-wgrest-api-centus-pme"
     },
-    "storageSecretName": {
-      "value": "stwgrestcentuspmeConnectionString"
-    },
     "appServiceName": {
       "value": "asp-wgrest-centus-pme"
     },

src/WinGet.RestSource.Infrastructure/Parameters/AzureFunction/azurefunction.pme.westus.json

@@ -20,9 +20,6 @@
     "functionName": {
       "value": "azfun-wgrest-api-westus-pme"
     },
-    "storageSecretName": {
-      "value": "stwgrestwestuspmeConnectionString"
-    },
     "appServiceName": {
       "value": "asp-wgrest-westus-pme"
     },

src/WinGet.RestSource.Infrastructure/Parameters/AzureFunction/azurefunction.ppe.centus.json

@@ -20,9 +20,6 @@
     "functionName": {
       "value": "azfun-wgrest-api-centus-ppe"
     },
-    "storageSecretName": {
-      "value": "stwgrestcentusppeConnectionString"
-    },
     "appServiceName": {
       "value": "asp-wgrest-centus-ppe"
     },

src/WinGet.RestSource.Infrastructure/Parameters/AzureFunction/azurefunction.ppe.westus.json

@@ -20,9 +20,6 @@
     "functionName": {
       "value": "azfun-wgrest-api-westus-ppe"
     },
-    "storageSecretName": {
-      "value": "stwgrestwestusppeConnectionString"
-    },
     "appServiceName": {
       "value": "asp-wgrest-westus-ppe"
     },

src/WinGet.RestSource.Infrastructure/Parameters/AzureFunction/azurefunction.test.westus.json

@@ -20,9 +20,6 @@
     "functionName": {
       "value": "azfun-wgrest-api-westus-test"
     },
-    "storageSecretName": {
-      "value": "stwgrestwestustestConnectionString"
-    },
     "appServiceName": {
       "value": "asp-wgrest-westus-test"
     },

src/WinGet.RestSource.Infrastructure/Parameters/KeyVault/keyvault.test.json

@@ -31,27 +31,21 @@
         },
         {
           "tenantId": "72f988bf-86f1-41af-91ab-2d7cd011db47",
-          "objectId": "789c9442-e61d-48ea-84e1-02892ef4651f",
+          "objectId": "b403b8bc-5f45-410d-9a87-e71bb4b11f81",
           "permissions": {
             "keys": [
-              "Get",
-              "List"
             ],
             "secrets": [
               "Get",
-              "List",
-              "Set"
+              "List"
             ],
             "certificates": [
-              "Get",
-              "List"
             ],
             "storage": [
-              "Get"
             ]
           },
           "metadata": {
-            "description": "This is the object for winget-cli-restsource Test."
+            "description": "This is the object for mi-wgrest-deployment-test. Used for E2E."
           }
         },
         {

src/WinGet.RestSource.Infrastructure/Parameters/Roles/roles.int.json

@@ -4,6 +4,12 @@
             "description": "This is the storage account for the west azure function",
             "name": "stwgrestwestusint",
             "servicePrincipals": [
+                {
+                    "displayName": "mi-wgrest-deployment-int",
+                    "roles": [
+                        "Storage Blob Data Contributor"
+                    ]
+                },
                 {
                     "displayName": "azfun-wgrest-api-westus-int",
                     "roles": [
@@ -21,6 +27,12 @@
             "description": "This is the storage account for the central us azure function",
             "name": "stwgrestcentusint",
             "servicePrincipals": [
+                {
+                    "displayName": "mi-wgrest-deployment-int",
+                    "roles": [
+                        "Storage Blob Data Contributor"
+                    ]
+                },
                 {
                     "displayName": "azfun-wgrest-api-centus-int",
                     "roles": [
@@ -41,7 +53,7 @@
             "name": "appconfig-wgrest-centus-int",
             "servicePrincipals": [
                 {
-                    "displayName": "winget-cli-restsource Int",
+                    "displayName": "mi-wgrest-deployment-int",
                     "roles": [
                         "App Configuration Data Owner"
                     ]
@@ -65,7 +77,7 @@
             "name": "appconfig-wgrest-westus-int",
             "servicePrincipals": [
                 {
-                    "displayName": "winget-cli-restsource Int",
+                    "displayName": "mi-wgrest-deployment-int",
                     "roles": [
                         "App Configuration Data Owner"
                     ]
@@ -84,5 +96,19 @@
                 }
             ]
         }
+    ],
+    "subscription" : [
+        {
+            "description": "Roles at subscription level",
+            "name": "subscription",
+            "servicePrincipals": [
+                {
+                    "displayName": "mi-wgrest-deployment-int",
+                    "roles": [
+                        "Reader"
+                    ]
+                }
+            ]
+        }
     ]
 }

src/WinGet.RestSource.Infrastructure/Parameters/Roles/roles.pme.json

@@ -4,6 +4,12 @@
             "description": "This is the storage account for the west azure function",
             "name": "stwgrestwestuspme",
             "servicePrincipals": [
+                {
+                    "displayName": "mi-wgrest-deployment-pme",
+                    "roles": [
+                        "Storage Blob Data Contributor"
+                    ]
+                },
                 {
                     "displayName": "azfun-wgrest-api-westus-pme",
                     "roles": [
@@ -21,6 +27,12 @@
             "description": "This is the storage account for the central us azure function",
             "name": "stwgrestcentuspme",
             "servicePrincipals": [
+                {
+                    "displayName": "mi-wgrest-deployment-pme",
+                    "roles": [
+                        "Storage Blob Data Contributor"
+                    ]
+                },
                 {
                     "displayName": "azfun-wgrest-api-centus-pme",
                     "roles": [
@@ -41,7 +53,7 @@
             "name": "appconfig-wgrest-centus-pme",
             "servicePrincipals": [
                 {
-                    "displayName": "WDX-APT-WPMService (winget-cli-restsource)",
+                    "displayName": "mi-wgrest-deployment-pme",
                     "roles": [
                         "App Configuration Data Owner"
                     ]
@@ -65,7 +77,7 @@
             "name": "appconfig-wgrest-westus-pme",
             "servicePrincipals": [
                 {
-                    "displayName": "WDX-APT-WPMService (winget-cli-restsource)",
+                    "displayName": "mi-wgrest-deployment-pme",
                     "roles": [
                         "App Configuration Data Owner"
                     ]
@@ -84,5 +96,19 @@
                 }
             ]
         }
+    ],
+    "subscription" : [
+        {
+            "description": "Roles at subscription level",
+            "name": "subscription",
+            "servicePrincipals": [
+                {
+                    "displayName": "mi-wgrest-deployment-pme",
+                    "roles": [
+                        "Reader"
+                    ]
+                }
+            ]
+        }
     ]
 }

src/WinGet.RestSource.Infrastructure/Parameters/Roles/roles.ppe.json

@@ -4,6 +4,12 @@
             "description": "This is the storage account for the west azure function",
             "name": "stwgrestwestusppe",
             "servicePrincipals": [
+                {
+                    "displayName": "mi-wgrest-deployment-ppe",
+                    "roles": [
+                        "Storage Blob Data Contributor"
+                    ]
+                },
                 {
                     "displayName": "azfun-wgrest-api-westus-ppe",
                     "roles": [
@@ -21,6 +27,12 @@
             "description": "This is the storage account for the central us azure function",
             "name": "stwgrestcentusppe",
             "servicePrincipals": [
+                {
+                    "displayName": "mi-wgrest-deployment-ppe",
+                    "roles": [
+                        "Storage Blob Data Contributor"
+                    ]
+                },
                 {
                     "displayName": "azfun-wgrest-api-centus-ppe",
                     "roles": [
@@ -41,7 +53,7 @@
             "name": "appconfig-wgrest-centus-ppe",
             "servicePrincipals": [
                 {
-                    "displayName": "winget-cli-restsource PPE",
+                    "displayName": "mi-wgrest-deployment-ppe",
                     "roles": [
                         "App Configuration Data Owner"
                     ]
@@ -65,7 +77,7 @@
             "name": "appconfig-wgrest-westus-ppe",
             "servicePrincipals": [
                 {
-                    "displayName": "winget-cli-restsource PPE",
+                    "displayName": "mi-wgrest-deployment-ppe",
                     "roles": [
                         "App Configuration Data Owner"
                     ]
@@ -84,5 +96,19 @@
                 }
             ]
         }
+    ],
+    "subscription" : [
+        {
+            "description": "Roles at subscription level",
+            "name": "subscription",
+            "servicePrincipals": [
+                {
+                    "displayName": "mi-wgrest-deployment-ppe",
+                    "roles": [
+                        "Reader"
+                    ]
+                }
+            ]
+        }
     ]
 }