Azure / Azure/azure-rest-api-specs

Role Assignment: `roleDefinitionId` will change if the role definition is defined in other subscription

Open
#10,939 1 comment 0 reactions 0 assignees View on GitHub
Authorization Service Attention
Dominant language
TypeSpec
Stars
3.1k
Forks
5.9k
Avg merge
2d 22h
Merged PRs (30d)
444

Description

Given a role definition defined in **sub1** (which is assignable to both **sub1** and **sub2**), when assign it to **sub2** (scope) via role assignment by dereferencing the role definition id, where the definition id is constructured using the **sub1** as the subscription component.

```json
PUT https://management.azure.com//subscriptions//providers/Microsoft.Authorization/roleAssignments/?api-version=2018-09-01-preview HTTP/2.0

{
"properties": {
"principalId": "",
"roleDefinitionId": "/subscriptions//providers/Microsoft.Authorization/roleDefinitions/"
}
}
```

Later, when we `GET` the assignment object via API, the response shows the role definition id is constructed using the **sub2** as the subscription component:

```json
GET https://management.azure.com//subscriptions//providers/Microsoft.Authorization/roleAssignments/?api-version=2018-09-01-preview HTTP/2.0

{
...
"properties": {
...
"roleDefinitionId": "/subscriptions//providers/Microsoft.Authorization/roleDefinitions/",
...
}
}
```

Whilst the expected `roleDefinitionId` should be kept the same as in the request.

### Related Issue

- terraform-providers/terraform-provider-azurerm#8558

Contributor guide

Open the contributing guide

Research direction

Start by reviewing the Microsoft.Authorization role assignment API behavior described in the PUT and GET examples, using api-version 2018-09-01-preview. Compare the related terraform-provider-azurerm#8558 report with the API specification to identify the response mapping involved. Done means the returned roleDefinitionId preserves the subscription component supplied in the request.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure
Domain
api, authorization
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.