Creating an EventGridTopic Subscription fails to correctly associate the User-Assigned Managed Identity
- Dominant language
- TypeScript
- Stars
- 108
- Forks
- 44
- Avg merge
- 18h 53m
- Merged PRs (30d)
- 29
Description
**Bicep version**
Bicep CLI version 0.16.1 (d77dcc750a)
**Describe the bug**
When creating an EventGridTopic Subscription with a destination of "Event Hub" and using a User-Assigned Managed Identity, the operation completes but fails to assign the Managed Identity, causing the following error to be displayed when viewing the newly created subscription:

I have verified that the referenced "User-Assigned Managed Identity" is appropriately assigned to the _parent_ custom EventGridTopic prior to executing the Bicep template which creates the Subscription, and is still present after this template completes.
**To Reproduce**
Following is the trivial module which creates the subscription:
```
/* ************************************************************************************************
var templateSpecName = 'EventGridSubscription'
var version = '0.0.9'
var releaseNotes = 'Template to create an Azure EventGridSubscription resource.'
************************************************************************************************ */
// ============ Create Event Grid Subscription ============
targetScope = 'resourceGroup'
param egtParentName string
param egsName string
param egsProperties object
// Locate the EventGridTopic to which this subscription needs to be bound.
resource eventGridTopic 'Microsoft.EventGrid/topics@2022-06-15' existing = {
name: egtParentName
}
resource newEGS 'Microsoft.EventGrid/topics/eventSubscriptions@2022-06-15' = {
name: egsName
parent: eventGridTopic
properties: egsProperties
}
```
**Additional context**
The `egsProperties` reference above is like the (obfuscated) following:
```
{
"deliveryWithResourceIdentity": {
"identity": {
"type": "UserAssigned",
"userAssignedIdentity": "/subscriptions/********-****-****-****-************/resourcegroups/rg-************-**-******/providers/Microsoft.ManagedIdentity/userAssignedIdentities/id-********-***-*******"
},
"destination": {
"endpointType": "EventHub",
"properties": {
"resourceId": "/subscriptions/********-****-****-****-************/resourceGroups/rg-************-**-******/providers/Microsoft.EventHub/namespaces/evhns-********-**-******/eventhubs/evh-***********"
}
}
}
}
```
The network access for this EventGridTopic is set to `Private endpoints only`, but I reverted that setting, deleted the subscription, and re-ran the template with the exact same results.
Just for giggles, I also created a "System Assigned" managed identity to the EventGridTopic (including the appropriate RBAC assignments) and this also made no difference.
Contributor guide
No contributing guide indexed for this repository
Research direction
Start with the reported Bicep module and its Microsoft.EventGrid/topics/eventSubscriptions@2022-06-15 resource, then reproduce the deployment using the supplied deliveryWithResourceIdentity properties. Compare the resulting subscription identity with the requested UserAssigned identity and confirm completion when the identity is correctly associated and the subscription no longer shows the reported error.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- azure
- Domain
- cloud
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100