limit scope for service principal?

[ltalirz]

The current setup instructions require the creation of a service principal that is "Contributor" on the subscription.

These are very far-reaching rights, which is likely not going to be admissible in many enterprise subscriptions.

In previous use cases of terraform on Azure it was enough to provide the service principal / system managed identity with

• "Contributor" rights on a specific resource group (where the aiidalab resources will live)
• "Reader" rights on the subscription (I suspect this will be necessary, to check)

This may be possible here as well (to investigate)