Azure / Azure/azure-cli

az role definition create --role-definition example fails

Open
#15,370 1 comment 0 reactions 1 assignee Claimed by @jiasli View on GitHub
act-identity-squad feature-request RBAC
Dominant language
Python
Stars
4.6k
Forks
3.5k
Avg merge
3d 2h
Merged PRs (30d)
60

Description

> ### `az feedback` auto-generates most of the information requested below, as of CLI version 2.0.62

**Describe the bug**

When trying to create a new custom role definition using Cloud Shell Azure CLI, my script keeps failing.
I have tried to use the the example from the **az role definition create --role-definition** section in the Docs page, but also get an error here. All other examples I have located, utilize an external JSON file, and I like to use the script with embedded JSON code, for easier management and documentation.

Reference:
**az role definition**
[https://docs.microsoft.com/en-us/cli/azure/role/definition?view=azure-cli-latest#az_role_definition_create](url)

**Example code** (subscription id replaced with id from my tenant):

```
az role definition create --role-definition '{
"Name": "Contoso On-call",
"Description": "Perform VM actions and read storage and network information.",
"Actions": [
"Microsoft.Compute/*/read",
"Microsoft.Compute/virtualMachines/start/action",
"Microsoft.Compute/virtualMachines/restart/action",
"Microsoft.Network/*/read",
"Microsoft.Storage/*/read",
"Microsoft.Authorization/*/read",
"Microsoft.Resources/subscriptions/resourceGroups/read",
"Microsoft.Resources/subscriptions/resourceGroups/resources/read",
"Microsoft.Insights/alertRules/*",
"Microsoft.Support/*"
],
"DataActions": [
"Microsoft.Storage/storageAccounts/blobServices/containers/blobs/*"
],
"NotDataActions": [
"Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write"
],
"AssignableScopes": ["/subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"]
}'
```

The script produces this **error**:

```
ArgumentParseError: unrecognized arguments: On-call,
Description: Perform VM actions and read storage and network information.,
Actions: [
Microsoft.Compute/*/read,
Microsoft.Compute/virtualMachines/start/action,
Microsoft.Compute/virtualMachines/restart/action,
Microsoft.Network/*/read,
Microsoft.Storage/*/read,
Microsoft.Authorization/*/read,
Microsoft.Resources/subscriptions/resourceGroups/read,
Microsoft.Resources/subscriptions/resourceGroups/resources/read,
Microsoft.Insights/alertRules/*,
Microsoft.Support/*
],
DataActions: [
Microsoft.Storage/storageAccounts/blobServices/containers/blobs
...

```

The example in the documentation is expected to be usable in any subscription, just with a custom subscription ID added.
Used environment is the Cloud Shell Azure CLI in PowerShell mode.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.