Authorize App Service to pull container image from a registry

app_service_acrpull_role_assignment.py

import pulumi
from pulumi_azure_native import authorization, web, containerregistry

# AcrPull Role definition:
# https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#acrpull

def webapp_acrpull_role(
    name: str, web_app: web.WebApp, registry: containerregistry.Registry
) -> authorization.RoleAssignment:
    """Assign AcrPull role to the web app"""
    return authorization.RoleAssignment(
        name,
        principal_id=web_app.identity.principal_id,
        principal_type="ServicePrincipal",
        role_definition_id="/providers/Microsoft.Authorization/roleDefinitions/7f951dda-4ed3-4680-a7ca-43fe172d538d",
        scope=registry.id,
        opts=pulumi.ResourceOptions(parent=web_app, ignore_changes=["principal_id"]),
    )