Repository navigation
chore(iac): drop deploy-role grants left unused by retiring the cleanup functions #1597
Description
#1591 (#357) removed the GCP cleanup Cloud Function and the Azure cleanup Function App modules. Nothing in this repo now deploys a Cloud Function, Function App or App Service plan, so these CI/CD deploy-role grants look unused:
- GCP:
roles/cloudfunctions.developer - Azure:
Microsoft.Web/serverFarms/*andMicrosoft.Web/sites/*
Work:
- Confirm no remaining module or root needs them (including any root outside this repo that pointed at the deleted module paths).
- Remove the grants from the ci-cd-permissions roots.
This takes effect only when a human applies those roots.
Found in review of #1591. Low priority (least privilege).
Activity
cristim commentedon Nov 5, 2026
Triaged: p3 least-privilege cleanup. The grants are unused since #1591. Removing them takes effect only when a human re-applies the ci-cd-permissions roots, so first confirm no root outside this repo still points at the deleted module paths.
cristim commentedon Nov 10, 2026
Merged in #1877 (4680959). Removed
Microsoft.Web/serverFarms/*andMicrosoft.Web/sites/*from the Azure ci-cd-permissions role androles/cloudfunctions.developerfrom the GCP CI service account. The issue was re-checked against main before the change: no Function, Web App or App Service plan resources exist in terraform/, and the Logic Apps grants (Microsoft.Logic) are untouched. CI on the PR was green (pre-commit, Terraform validate, Azure role parity), and main CI after the merge is green. Not verified: the grants take effect only when a human applies the two ci-cd-permissions roots; nothing was applied.