Automating JIT access request approval with Azure Logic Apps

Question

Pulumi · Accepted Answer

To automate Just-In-Time (JIT) access request approval with Azure Logic Apps, you would typically use a variety of Azure services in combination with Logic Apps to create a workflow that triggers on a JIT access request, evaluates the request, and if approved, grants the necessary access.

A common scenario might involve the following steps:

A developer generates a JIT access request.
A Logic App is triggered, perhaps by the creation of a request item in an Azure Service Bus Queue.
The Logic App executes a workflow that checks for approval criteria (this could be based on a set of rules or an approval from a designated authority).
If approved, the Logic App uses Azure's Role-Based Access Control (RBAC) to grant the necessary access to the developer.
Once the access period has expired, another process revokes the access.

Let's write a program in TypeScript using Pulumi for creating such an automated workflow. We'll use the azure-native.logic.Workflow resource for creating the Logic App, along with the azure-native.servicebus.Queue, which can be used to receive JIT access requests.

import * as pulumi from "@pulumi/pulumi";
import * as azure from "@pulumi/azure-native";

// Create an Azure Resource Group
const resourceGroup = new azure.resources.ResourceGroup("my-resource-group");

// Create a Service Bus namespace
const namespace = new azure.servicebus.Namespace("my-namespace", {
    resourceGroupName: resourceGroup.name,
    sku: {
        name: "Standard",
    },
});

// Create a Service Bus queue to receive JIT access requests
const queue = new azure.servicebus.Queue("my-queue", {
    resourceGroupName: resourceGroup.name,
    namespaceName: namespace.name,
    enablePartitioning: true, // For better scalability and availability
});

// Define a Logic App workflow that automates JIT access approvals
const workflow = new azure.logic.Workflow("my-workflow", {
    resourceGroupName: resourceGroup.name,
    definition: {
        $schema: "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#",
        // Define the workflow using the Logic Apps Workflow Definition Language.
        // This includes triggers and actions that perform the approval process
        // and manipulate Azure RBAC to grant access. Since defining an entire
        // Logic Apps definition is beyond the scope of this example, please
        // replace the below content with your actual workflow definition.
        actions: {},
        triggers: {
            When_a_message_is_received_in_the_queue: {
                // Define the Service Bus Queue trigger
                type: "ServiceBusQueue",
                connection: {
                    name: "/subscriptions/<subscription-id>/providers/Microsoft.Web/connections/servicebus",
                    // You must create a connection resource that allows the Logic App to connect to Service Bus
                },
                inputs: {
                    host: {
                        connection: {
                            name: "servicebus",
                        },
                    },
                    method: "get",
                    path: "/@{encodeURIComponent('<service-bus-queue-name>')}/messages/@{encodeURIComponent('<message-id>')}",
                    queues: [
                        {
                            id: "/subscriptions/<subscription-id>/resourceGroups/<resource-group-name>/providers/Microsoft.ServiceBus/namespaces/<namespace-name>/queues/<queue-name>",
                            name: "<queue-name>",
                        },
                    ],
                },
            },
        },
    },
    // Additional workflow properties like parameters, state, and integration accounts would be set here.
    location: resourceGroup.location,
});

// Export relevant resources
export const resourceGroupName = resourceGroup.name;
export const serviceBusNamespaceName = namespace.name;
export const serviceBusQueueName = queue.name;
export const logicAppName = workflow.name;

This Pulumi program:

Initializes a new Azure Resource Group that will contain all our resources.
Creates a Service Bus namespace and a queue within that namespace. This queue is where JIT access requests will get posted.
Defines a new Logic App workflow with a Service Bus Queue trigger. When a new message (representing a JIT request) is posted to the queue, it will trigger the Logic App.

Note that the Logic App definition (definition) in the program above needs to be defined according to your specific workflow, including the triggers, actions, connections, and other settings that match your application's requirements. The Azure Logic Apps Workflow Definition Language is used to set up triggers and actions for the Logic App.

The exact implementation details of the workflow will depend on your organization's approval process for JIT access, which may include additional steps for verification, logging, custom logic, integration with other services, or notifications.

You would need to replace placeholders (like <subscription-id>, <resource-group-name>, <namespace-name>, and <queue-name>) with actual values from your Azure subscription and intended resources setup.

Please ensure that you have the necessary permissions and that your Pulumi stack is configured for the Azure environment. This program assumes that you have already set up the Azure provider with the appropriate credentials and subscription details.