Azure / Azure/azure-rest-api-specs

resource id issue of role definition

Open
#9,389 1 comment 0 reactions 0 assignees View on GitHub
Authorization Service Attention
Dominant language
TypeSpec
Stars
3.1k
Forks
5.9k
Avg merge
2d 22h
Merged PRs (30d)
444

Description

role definition can have different scope, the id format should be in this format `/{scope}/providers/Microsoft.Authorization/roleDefinitions/{roleDefinitionId}`.
when the scope is `Subscription`, the id format is right.
- Subscription: `/subscriptions/00000000-0000-0000-0000-000000000000/providers/Microsoft.Authorization/roleDefinitions/{roleDefinitionID}`

however, when the scope is `Resource Group`, the expected resource id should be `/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/group1/providers/Microsoft.Authorization/roleDefinitions/{roleDefinitionID}`, but actually, the id is `/subscriptions/00000000-0000-0000-0000-000000000000/providers/Microsoft.Authorization/roleDefinitions/{roleDefinitionID}`

when the scope is `Management Group`, the expected resource id should be `/providers/Microsoft.Management/managementGroups/group1/providers/Microsoft.Authorization/roleDefinitions/{roleDefinitionID}`, but actually, the id is `/providers/Microsoft.Authorization/roleDefinitions/{roleDefinitionID}`

it's not consistent, is it by design or a bug?

https://github.com/terraform-providers/terraform-provider-azurerm/issues/6695
https://github.com/terraform-providers/terraform-provider-azurerm/pull/6787
https://github.com/terraform-providers/terraform-provider-azurerm/issues/8251

Contributor guide

Open the contributing guide

Research direction

Start by reading the linked Terraform issue 6695, pull request 6787, and issue 8251 alongside the role definition specification. Compare the documented resource ID formats for subscription, resource-group, and management-group scopes; done means the specification clearly establishes consistent behavior or records the confirmed design decision.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure
Domain
api, authorization
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.