feat(resource): define Azure IAM resource types (azure-ad-user, azure-ad-group, azure-role-assignment) #2429

Open
opened 2026-04-03 18:02:02 +00:00 by freemo · 0 comments
Owner

Metadata

  • Branch: feat/v360/azure-iam-types
  • Commit Message: feat(resource): define azure-ad-user, azure-ad-group, and azure-role-assignment resource types
  • Milestone: v3.6.0
  • Parent Epic: #1019

Background

Part of the Azure cloud resource hierarchy expansion (Epic #1019). This issue implements the Azure IAM (Identity and Access Management) resource types following the generic cloud-* base layer pattern established by PR #669.

Azure IAM resources are scoped to the subscription level and represent Azure Active Directory (Entra ID) principals and role assignments.

Expected Behavior

  • azure-ad-user inherits from cloud-identity-principal, is auto-discovered as a child of azure-subscription
  • azure-ad-group inherits from cloud-role, is auto-discovered as a child of azure-subscription
  • azure-role-assignment inherits from cloud-policy, is auto-discovered as a child of azure-subscription
  • All types are non-user-addable
  • All types pass ResourceTypeSpec.from_config() validation
  • Inheritance chain depth ≤ 5 levels (ADR-042)

Acceptance Criteria

  • azure-ad-user defined with inherits: cloud-identity-principal, parent azure-subscription, user_addable: false
  • azure-ad-group defined with inherits: cloud-role, parent azure-subscription, user_addable: false
  • azure-role-assignment defined with inherits: cloud-policy, parent azure-subscription, user_addable: false
  • All three types registered in the resource type registry
  • All three types pass ResourceTypeSpec.from_config() validation
  • Inheritance chain ≤ 5 levels deep for all types
  • All nox stages pass
  • Coverage ≥ 97%

Dependencies

  • Blocked by: #2425 (azure-subscription and azure-resource-group must exist first)
  • Blocks: #1019

Subtasks

  • Define azure-ad-user resource type config with inherits: cloud-identity-principal, parent azure-subscription
  • Define azure-ad-group resource type config with inherits: cloud-role, parent azure-subscription
  • Define azure-role-assignment resource type config with inherits: cloud-policy, parent azure-subscription
  • Register all three types in the resource type registry
  • Validate all types pass ResourceTypeSpec.from_config() validation
  • Run nox (all default sessions), fix any errors
  • Verify coverage ≥ 97% via nox -s coverage_report

Definition of Done

  • All subtasks completed and checked off
  • azure-ad-user, azure-ad-group, and azure-role-assignment resource types are defined, registered, and validated
  • A Git commit is created where the first line of the commit message matches the Commit Message in Metadata exactly
  • The commit is pushed to the remote on the branch matching the Branch in Metadata exactly
  • The commit is submitted as a pull request to master, reviewed, and merged before this issue is marked done
  • All nox stages pass
  • Coverage ≥ 97%

Automated by CleverAgents Bot
Supervisor: Unknown | Agent: ca-epic-planner

## Metadata - **Branch**: `feat/v360/azure-iam-types` - **Commit Message**: `feat(resource): define azure-ad-user, azure-ad-group, and azure-role-assignment resource types` - **Milestone**: v3.6.0 - **Parent Epic**: #1019 ## Background Part of the Azure cloud resource hierarchy expansion (Epic #1019). This issue implements the Azure IAM (Identity and Access Management) resource types following the generic `cloud-*` base layer pattern established by PR #669. Azure IAM resources are scoped to the subscription level and represent Azure Active Directory (Entra ID) principals and role assignments. ## Expected Behavior - `azure-ad-user` inherits from `cloud-identity-principal`, is auto-discovered as a child of `azure-subscription` - `azure-ad-group` inherits from `cloud-role`, is auto-discovered as a child of `azure-subscription` - `azure-role-assignment` inherits from `cloud-policy`, is auto-discovered as a child of `azure-subscription` - All types are non-user-addable - All types pass `ResourceTypeSpec.from_config()` validation - Inheritance chain depth ≤ 5 levels (ADR-042) ## Acceptance Criteria - [ ] `azure-ad-user` defined with `inherits: cloud-identity-principal`, parent `azure-subscription`, `user_addable: false` - [ ] `azure-ad-group` defined with `inherits: cloud-role`, parent `azure-subscription`, `user_addable: false` - [ ] `azure-role-assignment` defined with `inherits: cloud-policy`, parent `azure-subscription`, `user_addable: false` - [ ] All three types registered in the resource type registry - [ ] All three types pass `ResourceTypeSpec.from_config()` validation - [ ] Inheritance chain ≤ 5 levels deep for all types - [ ] All nox stages pass - [ ] Coverage ≥ 97% ## Dependencies - Blocked by: #2425 (azure-subscription and azure-resource-group must exist first) - Blocks: #1019 ## Subtasks - [ ] Define `azure-ad-user` resource type config with `inherits: cloud-identity-principal`, parent `azure-subscription` - [ ] Define `azure-ad-group` resource type config with `inherits: cloud-role`, parent `azure-subscription` - [ ] Define `azure-role-assignment` resource type config with `inherits: cloud-policy`, parent `azure-subscription` - [ ] Register all three types in the resource type registry - [ ] Validate all types pass `ResourceTypeSpec.from_config()` validation - [ ] Run `nox` (all default sessions), fix any errors - [ ] Verify coverage ≥ 97% via `nox -s coverage_report` ## Definition of Done - [ ] All subtasks completed and checked off - [ ] `azure-ad-user`, `azure-ad-group`, and `azure-role-assignment` resource types are defined, registered, and validated - [ ] A Git commit is created where the **first line** of the commit message matches the Commit Message in Metadata exactly - [ ] The commit is pushed to the remote on the branch matching the **Branch** in Metadata exactly - [ ] The commit is submitted as a **pull request** to `master`, reviewed, and **merged** before this issue is marked done - [ ] All nox stages pass - [ ] Coverage ≥ 97% --- **Automated by CleverAgents Bot** Supervisor: Unknown | Agent: ca-epic-planner
Sign in to join this conversation.
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Reference
cleveragents/cleveragents-core#2429
No description provided.