Bicep error when trying to modify role assignment to a storage account

Viewed 170

I am new wiht Bicep. I need to give a couple of users a role for a storage account.

So i have written a module but it give me an error.

Status Message: The role definition ID | 'Storage Blob Data Contributor' is not valid. (Code:InvalidRoleDefinitionId) Status Message: The role definition ID 'Storage Blob | Data Contributor' is not valid. (Code:InvalidRoleDefinitionId) Status Message: At least one resource deployment operation failed. | Please list deployment operations for details. Please see https://aka.ms/DeployOperations for usage details. (Code: | DeploymentFailed) - { "error": { "code": "InvalidRoleDefinitionId", "message": "The role definition ID 'Storage Blob | Data Contributor' is not valid." } } (Code:BadRequest) - { "error": { "code": "InvalidRoleDefinitionId", "message": | "The role definition ID 'Storage Blob Data Contributor' is not valid." } } (Code:BadRequest)

This is the module code:

param roleDefinitionResourceName string = 'Storage Blob Data Contributor'
param storageAccountName string = 'mysa'

resource sa 'Microsoft.Storage/storageAccounts@2021-09-01' existing = {
  name: storageAccountName
}

resource role 'Microsoft.Authorization/roleDefinitions@2018-01-01-preview' existing = {
  name: roleDefinitionResourceName
}

var roleDefinitionResourceId = role.id // here I collect the role ID

var syIdentity = synapse_workspace.identity //Synapse Managed Identity object ID
var principalId = syIdentity.principalId

resource roleAssignmentsy 'Microsoft.Authorization/roleAssignments@2020-04-01-preview' = {
  scope: sa
  name: guid(sa.id, synapse_workspace.name, roleDefinitionResourceName)
  properties: {
    roleDefinitionId: roleDefinitionResourceId
    principalId: principalId
    principalType: 'ServicePrincipal'
  }
}

the principalId is the managed identity of a synapse workspace but i get the same result using an user account.

Any suggestion?

1 Answers

You need to use the GUID for the roleDefinitionName, unfortunately you can't use the description. So would have to be:

param roleDefinitionResourceName string = 'ba92f5b4-2d11-453d-a403-e96b0029c9fe'

Currently there isn't a way to go from the friendly name to the GUID needed for the resourceId.

Related