Azure / Azure/ResourceModules

[Bug Report]: Get-RoleAssignmentList.ps1 wildcard filter is incorrect.

Open
#3,160 1 comment 1 reaction 0 assignees View on GitHub
bug
Dominant language
PowerShell
Stars
737
Forks
436
Avg merge
10d 7h
Merged PRs (30d)
1

Description

### Describe the bug

Unless I'm missing something, the script Get-RoleAssignmentList.ps1 doesn't seem to be returning the correct results for me.
I think the issue is [here](https://github.com/Azure/ResourceModules/blob/3db72e79a984347c6f0020b2678aa0df4a75d6ff/utilities/tools/Get-RoleAssignmentList.ps1#L62C1-L74).
```powershell
if ("$ProviderNamespace/$ResourceType" -eq 'Microsoft.Authorization/RoleAssignments') {
# No filter
$relevantRoles = $roleDefinitions
} else {
# Filter Action based
$relevantRoles += $roleDefinitions | Where-Object {
$_.Actions -like "$ProviderNamespace/$ResourceType/*" -or
$_.Actions -like "$ProviderNamespace/`**" -or
$_.Actions -like '`**'
}

# Filter Data Action based
$relevantRoles += $roleDefinitions | Where-Object {
$_.DataActions -like "$ProviderNamespace/$ResourceType/*" -or
$_.DataActions -like "$ProviderNamespace/`**" -or
$_.DataActions -like '`**'
}
}
```

In PowerShell to match the `*` character with the `-like` operator you need to enclose it in brackets like this: `[*]`.
```powershell
if ("$ProviderNamespace/$ResourceType" -eq 'Microsoft.Authorization/RoleAssignments') {
# No filter
$relevantRoles = $roleDefinitions
} else {
# Filter Action based
$relevantRoles += $roleDefinitions | Where-Object {
$_.Actions -like "$ProviderNamespace/$ResourceType/*" -or
$_.Actions -like "$ProviderNamespace/[*]*" -or
$_.Actions -like '[*]*'
}

# Filter Data Action based
$relevantRoles += $roleDefinitions | Where-Object {
$_.DataActions -like "$ProviderNamespace/$ResourceType/*" -or
$_.DataActions -like "$ProviderNamespace/[*]*" -or
$_.DataActions -like '[*]*'
}
}
```

### To reproduce

```powershell
$ProviderNamespace = "Microsoft.Network"
$ResourceType = "routeTables"

$allRoleDefinitions = Get-AzRoleDefinition

$badRoleList = $allRoleDefinitions | Where-Object {
$_.Actions -like "$ProviderNamespace/$ResourceType/*" -or
$_.Actions -like "$ProviderNamespace/`**" -or
$_.Actions -like '`**'
}

$badRoleList.Count

$goodRoleList = $allRoleDefinitions | Where-Object {
$_.Actions -like "$ProviderNamespace/$ResourceType/*" -or
$_.Actions -like "$ProviderNamespace/[*]*" -or
$_.Actions -like '[*]*'
}

$goodRoleList.Count
```

You can further compare the two lists by doing the following:
`Compare-Object $badRoleList $goodRoleList -PassThru | ft`

As an example. The 'Virtual Machine Administrator Login' appears in the original list but none of the actions are relevant to a route table.
`get-azroledefinition 'Virtual Machine Administrator Login' | Select-Object -ExpandProperty Actions`
```plaintext
Microsoft.Network/publicIPAddresses/read
Microsoft.Network/virtualNetworks/read
Microsoft.Network/loadBalancers/read
Microsoft.Network/networkInterfaces/read
Microsoft.Compute/virtualMachines/*/read
Microsoft.HybridCompute/machines/*/read
Microsoft.HybridConnectivity/endpoints/listCredentials/action
```

### Code snippet

_No response_

### Relevant log output

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.