From 6e57c68308a8c438b33786a883402960306999cc Mon Sep 17 00:00:00 2001 From: Cristian Magherusan-Stanciu Date: Mon, 9 Nov 2026 18:07:54 +0100 Subject: [PATCH] chore(iac): drop deploy-role grants left unused by retiring the cleanup functions Remove roles/cloudfunctions.developer (GCP) and Microsoft.Web/serverFarms/* and Microsoft.Web/sites/* (Azure) from the ci-cd-permissions roots. No module deploys a Cloud Function, Function App or App Service plan since #1591; the Azure Logic Apps use Microsoft.Logic, which is untouched. Takes effect only when a human applies those roots. Closes #1597 Co-Authored-By: Claude Sonnet 5.5 --- .../environments/azure/ci-cd-permissions/locals_compute.tf | 2 -- terraform/environments/gcp/ci-cd-permissions/service_account.tf | 1 - 2 files changed, 3 deletions(-) diff --git a/terraform/environments/azure/ci-cd-permissions/locals_compute.tf b/terraform/environments/azure/ci-cd-permissions/locals_compute.tf index c697ba848..218f7668c 100644 --- a/terraform/environments/azure/ci-cd-permissions/locals_compute.tf +++ b/terraform/environments/azure/ci-cd-permissions/locals_compute.tf @@ -6,8 +6,6 @@ locals { "Microsoft.ContainerRegistry/registries/*", "Microsoft.ContainerRegistry/registries/tasks/*", "Microsoft.ContainerService/managedClusters/*", - "Microsoft.Web/serverFarms/*", - "Microsoft.Web/sites/*", "Microsoft.Logic/workflows/*", "Microsoft.Logic/locations/*", "Microsoft.Cdn/profiles/*", diff --git a/terraform/environments/gcp/ci-cd-permissions/service_account.tf b/terraform/environments/gcp/ci-cd-permissions/service_account.tf index 62eb22e1b..731ce3e07 100644 --- a/terraform/environments/gcp/ci-cd-permissions/service_account.tf +++ b/terraform/environments/gcp/ci-cd-permissions/service_account.tf @@ -15,7 +15,6 @@ locals { "roles/logging.admin", "roles/monitoring.admin", "roles/vpcaccess.admin", - "roles/cloudfunctions.developer", "roles/servicenetworking.networksAdmin", "roles/pubsub.admin", "roles/container.admin",