Top / Microsoft Azure / Azure Synapse / Role Assignment

Azure Synapse Role Assignment

This page shows how to write Terraform and Azure Resource Manager for Synapse Role Assignment and write them securely.

terraform-logo

Review your .tf file for Azure best practices

Shisho Cloud, our free checker to make sure your Terraform configuration follows best practices, is available (beta).

azurerm_synapse_role_assignment (Terraform)

The Role Assignment in Synapse can be configured in Terraform with the resource name azurerm_synapse_role_assignment. The following sections describe 2 examples of how to use the resource and its parameters.

Example Usage from GitHub

roleassignments.tf#L6
resource "azurerm_synapse_role_assignment" "synapseadmins" {
  synapse_workspace_id = azurerm_synapse_workspace.synapseworkspace.id
  role_name            = "Synapse Administrator"
  principal_id         = var.tf-ado-syn-admins

  depends_on = [azurerm_synapse_firewall_rule.open-fwr]
main.tf#L155
resource "azurerm_synapse_role_assignment" "azurermsynapseroleassignment" {
  synapse_workspace_id = azurerm_synapse_workspace.synworkspace.id
  role_name            = "Synapse SQL Administrator"
  principal_id         = data.azurerm_client_config.current.object_id

  depends_on = [azurerm_synapse_firewall_rule.synapsefirewall]

Review your Terraform file for Azure best practices

Shisho Cloud, our free checker to make sure your Terraform configuration follows best practices, is available (beta).

Parameters

>> from Terraform Registry

Explanation in Terraform Registry

Manages a Synapse Role Assignment.

>> from Terraform Registry

Tips: Best Practices for The Other Azure Synapse Resources

In addition to the azurerm_synapse_workspace, Azure Synapse has the other resources that should be configured for security reasons. Please check some examples of those resources and precautions.

risk-label

azurerm_synapse_workspace

Ensure to enable the managed virtual network

It is better to enable the managed virtual network, which is disabled as the default.

Review your Azure Synapse settings

In addition to the above, there are other security points you should be aware of making sure that your .tf files are protected in Shisho Cloud.

Microsoft.Synapse/workspaces (Azure Resource Manager)

The workspaces in Microsoft.Synapse can be configured in Azure Resource Manager with the resource name Microsoft.Synapse/workspaces. The following sections describe how to use the resource and its parameters.

Example Usage from GitHub

TemplateForWorkspace.json
{
    "$schema": "http://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
    "contentVersion": "1.0.0.0",
    "parameters": {
        "workspaceName": {
ARMTemplateForWorkspace.json
{
    "$schema": "http://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
    "contentVersion": "1.0.0.0",
    "parameters": {
        "workspaceName": {
TemplateForWorkspace.json
{
    "$schema": "http://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
    "contentVersion": "1.0.0.0",
    "parameters": {
        "workspaceName": {
TemplateForWorkspace.json
{
    "$schema": "http://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
    "contentVersion": "1.0.0.0",
    "parameters": {
        "workspaceName": {
TemplateForWorkspace.json
{
    "$schema": "http://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
    "contentVersion": "1.0.0.0",
    "parameters": {
        "workspaceName": {
ARMTemplateForWorkspace.json
{
    "$schema": "http://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
    "contentVersion": "1.0.0.0",
    "parameters": {
        "workspaceName": {
template.json#L20
            "type": "Microsoft.Synapse/workspaces",
            "apiVersion": "2021-06-01",
            "name": "[parameters('workspaces_mgdcworkspace_name')]",
            "location": "westeurope",
            "identity": {
                "type": "SystemAssigned"
template-synapse-workspace.json#L21
            "type": "Microsoft.Synapse/workspaces",
            "apiVersion": "2019-06-01-preview",
            "name": "[parameters('workspaces_saw_name')]",
            "location": "westus2",
            "identity": {
                "principalId": null,
azuredeploy.json#L73
            "type": "Microsoft.Synapse/workspaces",
            "apiVersion": "2021-06-01",
            "name": "[parameters('WorkspaceName')]",
            "location": "westeurope",
            "identity": {
                "type": "SystemAssigned"
Template.json#L24
            "type": "Microsoft.Synapse/workspaces",
            "apiVersion": "2020-12-01",
            "tags": {},
            "location": "[parameters('location')]",
            "properties": {
                "defaultDataLakeStorage": {

Parameters

  • apiVersion required - string
  • identity optional
      • type optional - string

        The type of managed identity for the workspace.

      • userAssignedIdentities optional - undefined

        The User Assigned Managed Identities.

  • location required - string

    The geo-location where the resource lives

  • name required - string

    The name of the workspace.

  • properties required
      • azureADOnlyAuthentication optional - boolean

        Enable or Disable AzureADOnlyAuthentication on All Workspace subresource

      • connectivityEndpoints optional - string

        Connectivity endpoints

      • cspWorkspaceAdminProperties optional
          • initialWorkspaceAdminObjectId optional - string

            AAD object ID of initial workspace admin

      • defaultDataLakeStorage optional
          • accountUrl optional - string

            Account URL

          • createManagedPrivateEndpoint optional - boolean

            Create managed private endpoint to this storage account or not

          • filesystem optional - string

            Filesystem name

          • resourceId optional - string

            ARM resource Id of this storage account

      • encryption optional
          • cmk optional
              • kekIdentity optional
                  • userAssignedIdentity optional - string

                    User assigned identity resource Id

                  • useSystemAssignedIdentity optional - object

                    Boolean specifying whether to use system assigned identity or not

              • key optional
                  • keyVaultUrl optional - string

                    Workspace Key sub-resource key vault url

                  • name optional - string

                    Workspace Key sub-resource name

      • managedResourceGroupName optional - string

        Workspace managed resource group. The resource group name uniquely identifies the resource group within the user subscriptionId. The resource group name must be no longer than 90 characters long, and must be alphanumeric characters (Char.IsLetterOrDigit()) and '-', '_', '(', ')' and'.'. Note that the name cannot end with '.'

      • managedVirtualNetwork optional - string

        Setting this to 'default' will ensure that all compute for this workspace is in a virtual network managed on behalf of the user.

      • managedVirtualNetworkSettings optional
          • allowedAadTenantIdsForLinking optional - array

            Allowed Aad Tenant Ids For Linking

          • linkedAccessCheckOnTargetResource optional - boolean

            Linked Access Check On Target Resource

          • preventDataExfiltration optional - boolean

            Prevent Data Exfiltration

      • privateEndpointConnections optional array
          • properties optional
              • privateEndpoint optional
                • privateLinkServiceConnectionState optional
                    • description optional - string

                      The private link service connection description.

                    • status optional - string

                      The private link service connection status.

        • publicNetworkAccess optional - string

          Enable or Disable public network access to workspace.

        • purviewConfiguration optional
            • purviewResourceId optional - string

              Purview Resource ID

        • sqlAdministratorLogin optional - string

          Login for workspace SQL active directory administrator

        • sqlAdministratorLoginPassword optional - string

          SQL administrator login password

        • virtualNetworkProfile optional
            • computeSubnetId optional - string

              Subnet ID used for computes in workspace

        • workspaceRepositoryConfiguration optional
            • accountName optional - string

              Account name

            • collaborationBranch optional - string

              Collaboration branch

            • hostName optional - string

              GitHub Enterprise host name. For example: https://github.mydomain.com

            • lastCommitId optional - string

              The last commit ID

            • projectName optional - string

              VSTS project name

            • repositoryName optional - string

              Repository name

            • rootFolder optional - string

              Root folder to use in the repository

            • tenantId optional - string

              The VSTS tenant ID

            • type optional - string

              Type of workspace repositoryID configuration. Example WorkspaceVSTSConfiguration, WorkspaceGitHubConfiguration

    • tags optional - string

      Resource tags.

    • type required - string

    >> from Azure Resource Manager Documentation

    The Other Related Azure Synapse Resources

    Frequently asked questions

    What is Azure Synapse Role Assignment?

    Azure Synapse Role Assignment is a resource for Synapse of Microsoft Azure. Settings can be wrote in Terraform.

    Where can I find the example code for the Azure Synapse Role Assignment?

    For Terraform, the joe-plumb/mdw-azure-terraform and sugeshsuseelan/terraform-repo source code examples are useful. See the Terraform Example section for further details.

    For Azure Resource Manager, the lordozb/github-4, nisinha/cicd and batorfi/synapsews source code examples are useful. See the Azure Resource Manager Example section for further details.

    security-icon

    Automate config file reviews on your commits

    Fix issues in your infrastructure as code with auto-generated patches.

    Table of Contents