Service principal or Managed Identity

Question

I have a client that can only give me full access to one or two resource groups.

I need to deliver some prescripted terraform resources that contain the need for a service principal.

Can you lock an SP to a resource group? The subscription itself is a production subscription so they want to know if you can tie down using role base access just to that group.

Or should I be create a MI account?

Answer 1

Can you lock an SP to a resource group?

You most certainly can. Azure Role-based access control is very granular and you can apply access control at any level (management group, subscription, resource group or even at individual resource).

Please see this for more details: https://docs.microsoft.com/en-us/azure/role-based-access-control/role-assignments-steps .