[AVM Module Issue]: Landing Zone Subscription Vending - avm/ptn/lz/sub-vending

[Dylan-Prins]

Check for previous/existing GitHub issues

• I have checked for previous/existing GitHub issues

Issue Type?

Feature Request

Module Name

avm/ptn/lz/sub-vending

(Optional) Module Version

No response

Description

Hi Jack,

With every landing zone deployment we also deploy a PIM role. is this something we can implement in lz-sub-vending as well?
This makes the roleassignment we deploy with the landing zone a little bit more secure.

ref: assign-azure-privileged-identity-management-roles-using-bicep

(Optional) Correlation Id

No response

[microsoft-github-policy-service]

Important

The "Needs: Triage 🔍" label must be removed once the triage process is complete!

Tip

For additional guidance on how to triage this issue/PR, see the AVM Issue Triage documentation.

[matebarabas]

@Dylan-Prins, thanks for submitting this issue. As this is related to an existing module, I'm converting it to a module issue, and moving it to the BRM repo (where the modules' code reside).

To open an issue specific to an existing module, please submit a module issue (https://aka.ms/AVM/Bicep/ModuleIssue). You can also do this by selecting the Bicep module issue option on the new issues page:

[jtracey93]

Hey @Dylan-Prins,

great ask and one we already had on the backlog pre AVM: Azure/bicep-lz-vending#35

We will indeed get this done as well as constrained delegation for RBAC

[Dylan-Prins]

Nice! Should have checked the other repo first... sorry for that