Azure / Azure/azure-rest-api-specs
Role Assignment: `roleDefinitionId` will change if the role definition is defined in other subscription
- Dominant language
- TypeSpec
- Stars
- 3.1k
- Forks
- 5.9k
- Avg merge
- 2d 22h
- Merged PRs (30d)
- 444
Description
Given a role definition defined in **sub1** (which is assignable to both **sub1** and **sub2**), when assign it to **sub2** (scope) via role assignment by dereferencing the role definition id, where the definition id is constructured using the **sub1** as the subscription component.
```json
PUT https://management.azure.com//subscriptions//providers/Microsoft.Authorization/roleAssignments/?api-version=2018-09-01-preview HTTP/2.0
{
"properties": {
"principalId": "",
"roleDefinitionId": "/subscriptions//providers/Microsoft.Authorization/roleDefinitions/"
}
}
```
Later, when we `GET` the assignment object via API, the response shows the role definition id is constructed using the **sub2** as the subscription component:
```json
GET https://management.azure.com//subscriptions//providers/Microsoft.Authorization/roleAssignments/?api-version=2018-09-01-preview HTTP/2.0
{
...
"properties": {
...
"roleDefinitionId": "/subscriptions//providers/Microsoft.Authorization/roleDefinitions/",
...
}
}
```
Whilst the expected `roleDefinitionId` should be kept the same as in the request.
### Related Issue
- terraform-providers/terraform-provider-azurerm#8558
Contributor guide
Research direction
Start by reviewing the Microsoft.Authorization role assignment API behavior described in the PUT and GET examples, using api-version 2018-09-01-preview. Compare the related terraform-provider-azurerm#8558 report with the API specification to identify the response mapping involved. Done means the returned roleDefinitionId preserves the subscription component supplied in the request.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- azure
- Domain
- api, authorization
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100