Azure / Azure/azure-rest-api-specs
Role Assignments - Create endpoint comes back with 201 before role assignment is actually in place
- Dominant language
- TypeSpec
- Stars
- 3.1k
- Forks
- 5.9k
- Avg merge
- 2d 22h
- Merged PRs (30d)
- 444
Description
## Original reference
https://github.com/terraform-providers/terraform-provider-azurerm/issues/6934
## API endpoint
PUT https://management.azure.com/{scope}/providers/Microsoft.Authorization/roleAssignments/{roleAssignmentName}?api-version=2018-09-01-preview
## Expected behaviour
I can create data lake filesystems in my storage account after I've given my service principal the Storage Blob Data Owner role.
## Current behaviour
The service principal gets HTTP 403 with message `Error: Error creating File System "container3" in Storage Account "repro185u69s": datalakestore.Client#Create: Failure responding to request: StatusCode=403 -- Original Error: autorest/azure: Service returned an error. Status=403 Code="AuthorizationPermissionMismatch" Message="This request is not authorized to perform this operation using this permission."`
## Description
The endpoint often comes back with HTTP 201 Created before the role assignment is actually in place. In the issue mentioned above I create a few storage accounts, then give a service principal the _Storage Blob Data Owner_ role but he still gets _AuthorizationPermissionMismatch_ in the first few seconds after the response comes back when he tries to create a data lake filesystem.
Contributor guide
Research direction
Start with the original reference, issue 6934, and the PUT endpoint using API version 2018-09-01-preview. Investigate the gap between HTTP 201 Created and the later Storage Blob Data Owner authorization, including the reported filesystem-creation failure. Done means the specification or documented behavior clearly addresses when the role assignment is usable after creation.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- azure
- Domain
- api, cloud
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100