Azure / Azure/azure-rest-api-specs

Role Assignments - Create endpoint comes back with 201 before role assignment is actually in place

Open
#9,467 1 comment 1 reaction 0 assignees View on GitHub
Authorization customer-reported needs-team-attention question Service Attention
Dominant language
TypeSpec
Stars
3.1k
Forks
5.9k
Avg merge
2d 22h
Merged PRs (30d)
444

Description

## Original reference

https://github.com/terraform-providers/terraform-provider-azurerm/issues/6934

## API endpoint

PUT https://management.azure.com/{scope}/providers/Microsoft.Authorization/roleAssignments/{roleAssignmentName}?api-version=2018-09-01-preview

## Expected behaviour

I can create data lake filesystems in my storage account after I've given my service principal the Storage Blob Data Owner role.

## Current behaviour

The service principal gets HTTP 403 with message `Error: Error creating File System "container3" in Storage Account "repro185u69s": datalakestore.Client#Create: Failure responding to request: StatusCode=403 -- Original Error: autorest/azure: Service returned an error. Status=403 Code="AuthorizationPermissionMismatch" Message="This request is not authorized to perform this operation using this permission."`

## Description

The endpoint often comes back with HTTP 201 Created before the role assignment is actually in place. In the issue mentioned above I create a few storage accounts, then give a service principal the _Storage Blob Data Owner_ role but he still gets _AuthorizationPermissionMismatch_ in the first few seconds after the response comes back when he tries to create a data lake filesystem.

Contributor guide

Open the contributing guide

Research direction

Start with the original reference, issue 6934, and the PUT endpoint using API version 2018-09-01-preview. Investigate the gap between HTTP 201 Created and the later Storage Blob Data Owner authorization, including the reported filesystem-creation failure. Done means the specification or documented behavior clearly addresses when the role assignment is usable after creation.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure
Domain
api, cloud
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.