Azure / Azure/azure-rest-api-specs

'Microsoft.Automation/automationAccounts/powershell7Modules/*' does not match any of the actions supported by the providers

Open
#25,873 1 comment 0 reactions 0 assignees View on GitHub
customer-reported question Service Attention
Dominant language
TypeSpec
Stars
3.1k
Forks
5.9k
Avg merge
3d 2h
Merged PRs (30d)
424

Description

Following documentation like: https://github.com/Azure/azure-powershell/issues/16399 to upload PowerShell 7 modules to Azure Automation Account results in errors like below when using a service principal with a custom role to achieve POLP:

```
{"error":{"code":"AuthorizationFailed","message":"The client '3c37*REDACTED*cde5' with object id '3c37*REDACTED*cde5' does not have authorization to perform action 'Microsoft.Automation/automationAccounts/powershell7Modules/write' over scope '/subscriptions/*REDACTED*/resourceGroups/ukasttdevrgr46b32e005/providers/Microsoft.Automation/automationAccounts/*REDACTED* /powershell7Modules/SpeechTranscriptionRecordingMover' or the scope is
invalid. If access was recently granted, please refresh your credentials."}}
```

Attempting to add `Microsoft.Automation/automationAccounts/powershell7Modules/write` to the custom role via the portal (`Microsoft.Authorization/roleDefinitions` API Version `2022-05-01-preview`) results in the error: `Validation error: Invalid action is present in "actions" : Microsoft.Automation/automationAccounts/powershell7Modules/write.` Adding `Microsoft.Automation/automationAccounts/powershell7Modules/*` gets passed the initial validation but then fails when updating the role with the error: `Microsoft.Automation/automationAccounts/powershell7Modules/*' does not match any of the actions supported by the providers.`

https://management.azure.com/providers/Microsoft.Authorization/providerOperations?api-version=2018-01-01-preview&$expand=resourceTypes doesn't return any operation types with powershell7modules in their name.

The workaround is to allow `Microsoft.Automation/automationAccounts/*` in the custom role, but this seems like we're exposing too many permissions to achieve this.

Contributor guide

Open the contributing guide

Research direction

Start with the Azure providerOperations endpoint and the Microsoft.Authorization roleDefinitions API version 2022-05-01-preview described in the issue. Determine how the powershell7Modules write operation should be exposed for custom roles, and verify that a least-privilege role accepts the operation without requiring Microsoft.Automation/automationAccounts/*.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure
Domain
cloud, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.