[Bug Report]: Get-RoleAssignmentList.ps1 wildcard filter is incorrect.
- Dominant language
- PowerShell
- Stars
- 737
- Forks
- 436
- Avg merge
- 10d 7h
- Merged PRs (30d)
- 1
Description
### Describe the bug
Unless I'm missing something, the script Get-RoleAssignmentList.ps1 doesn't seem to be returning the correct results for me.
I think the issue is [here](https://github.com/Azure/ResourceModules/blob/3db72e79a984347c6f0020b2678aa0df4a75d6ff/utilities/tools/Get-RoleAssignmentList.ps1#L62C1-L74).
```powershell
if ("$ProviderNamespace/$ResourceType" -eq 'Microsoft.Authorization/RoleAssignments') {
# No filter
$relevantRoles = $roleDefinitions
} else {
# Filter Action based
$relevantRoles += $roleDefinitions | Where-Object {
$_.Actions -like "$ProviderNamespace/$ResourceType/*" -or
$_.Actions -like "$ProviderNamespace/`**" -or
$_.Actions -like '`**'
}
# Filter Data Action based
$relevantRoles += $roleDefinitions | Where-Object {
$_.DataActions -like "$ProviderNamespace/$ResourceType/*" -or
$_.DataActions -like "$ProviderNamespace/`**" -or
$_.DataActions -like '`**'
}
}
```
In PowerShell to match the `*` character with the `-like` operator you need to enclose it in brackets like this: `[*]`.
```powershell
if ("$ProviderNamespace/$ResourceType" -eq 'Microsoft.Authorization/RoleAssignments') {
# No filter
$relevantRoles = $roleDefinitions
} else {
# Filter Action based
$relevantRoles += $roleDefinitions | Where-Object {
$_.Actions -like "$ProviderNamespace/$ResourceType/*" -or
$_.Actions -like "$ProviderNamespace/[*]*" -or
$_.Actions -like '[*]*'
}
# Filter Data Action based
$relevantRoles += $roleDefinitions | Where-Object {
$_.DataActions -like "$ProviderNamespace/$ResourceType/*" -or
$_.DataActions -like "$ProviderNamespace/[*]*" -or
$_.DataActions -like '[*]*'
}
}
```
### To reproduce
```powershell
$ProviderNamespace = "Microsoft.Network"
$ResourceType = "routeTables"
$allRoleDefinitions = Get-AzRoleDefinition
$badRoleList = $allRoleDefinitions | Where-Object {
$_.Actions -like "$ProviderNamespace/$ResourceType/*" -or
$_.Actions -like "$ProviderNamespace/`**" -or
$_.Actions -like '`**'
}
$badRoleList.Count
$goodRoleList = $allRoleDefinitions | Where-Object {
$_.Actions -like "$ProviderNamespace/$ResourceType/*" -or
$_.Actions -like "$ProviderNamespace/[*]*" -or
$_.Actions -like '[*]*'
}
$goodRoleList.Count
```
You can further compare the two lists by doing the following:
`Compare-Object $badRoleList $goodRoleList -PassThru | ft`
As an example. The 'Virtual Machine Administrator Login' appears in the original list but none of the actions are relevant to a route table.
`get-azroledefinition 'Virtual Machine Administrator Login' | Select-Object -ExpandProperty Actions`
```plaintext
Microsoft.Network/publicIPAddresses/read
Microsoft.Network/virtualNetworks/read
Microsoft.Network/loadBalancers/read
Microsoft.Network/networkInterfaces/read
Microsoft.Compute/virtualMachines/*/read
Microsoft.HybridCompute/machines/*/read
Microsoft.HybridConnectivity/endpoints/listCredentials/action
```
### Code snippet
_No response_
### Relevant log output
_No response_
Contributor guide
Assessment
This issue has not been assessed yet.