Azure / Azure/azure-cli

[Feature Request] `az role assignment list/delete`: Make `--scope` a required argument

Open
#30,471 2 comments 0 reactions 1 assignee Claimed by @jiasli View on GitHub
act-identity-squad Auto-Assign Azure CLI Team potential-pruning question RBAC
Dominant language
Python
Stars
4.6k
Forks
3.5k
Avg merge
3d 2h
Merged PRs (30d)
60

Description

https://github.com/Azure/azure-cli/pull/27651 made `--scope` a required argument for `az role assignment create`.

I propose making `--scope` a required argument for `az role assignment list/delete` too, as explained below:

### `az role assignment list`

Even though the output of this command contains no secret, it contains PII - the email address of the assignee:

```
{
"id": "/subscriptions/xxx/providers/Microsoft.Authorization/roleAssignments/xxx",
"principalId": "xxx",
"principalName": xxx#EXT#@xxx.onmicrosoft.com,
"principalType": "User",
...
}
```

Without specifying `--scope`, this command lists all role assignments under the current subscription. The PII can be saved into build logs, such as GitHub Action logs. Therefore, we should ask the user to explicitly specify the scope under which role assignments should be listed to avoid showing PII as much as possible.

### `az role assignment delete`

https://github.com/Azure/azure-cli/issues/13577 made a very nice metaphor: This command is an insane footgun. Without specifying `--scope`, it deletes all role assignment under the current subscription. We should ask the user to explicitly specify the scope under which role assignments should be deleted to avoid expectedly nuking the whole subscription.

Making `--scope` a required argument aligns all `create`, `list` and `delete` commands to have a consistent interface.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.