Azure / Azure/bicep-types-az

Same role can be assigned to key vault using bicep script for multiple environment?

Open
#1,647 1 comment 0 reactions 0 assignees View on GitHub
inaccuracy KeyVault Service Attention
Dominant language
TypeScript
Stars
108
Forks
44
Avg merge
18h 53m
Merged PRs (30d)
29

Description

### Resource Type

key vault

### Api Version

2022-01-01

### Issue Type

Resource fails to deploy

### Other Notes

We are using bicep scripts to deploy SonarQube application in azure resources. We have two environments i.e., stage and production.

We have two resource group one for stage and- another for production environment and we have only one shared resource group containing one shared key vault that is used by both stage and production environment.

First, we did the PROD Deployment, and the deployment gets successful, after this we started the STAGE deployment, and the deployment gets failed, and we are getting the below error:
------------------------------
**ERROR: {"status":"Failed","error":{"code":"DeploymentFailed","message":"At least one resource deployment operation failed. Please list deployment operations for details. Please see https://aka.ms/arm-deployment-operations for usage details.","details":[{"code":"Conflict","message":"{\r\n \"status\": \"Failed\",\r\n \"error\": {\r\n \"code\": \"ResourceDeploymentFailure\",\r\n \"message\": \"The resource write operation failed to complete successfully, because it reached terminal provisioning state 'Failed'.\",\r\n \"details\": [\r\n {\r\n \"code\": \"DeploymentFailed\",\r\n \"target\": \"/subscriptions/9008ef19-8946-40b9-a371-0a324f5121c5/resourceGroups/rg-sonarqube-persistent-weu/providers/Microsoft.Resources/deployments/modulekvidentityroleassignmentonvault\",\r\n \"message\": \"At least one resource deployment operation failed. Please list deployment operations for details. Please see https://aka.ms/arm-deployment-operations for usage details.\",\r\n \"details\":...**
---------------------------------

We are running up in a situation where role assignment is already done once at the time of PROD deployment and we are not able to do once again during the STAGE deployment, since we need this role to fetch the secrets and certificates from the key vault.

We have a module where it assigns certain roles to the key vault that is getting successful during the production deployment but next time when we try to deploy the same for stage it is throwing an error.

Could anyone of you please let us know the same role can be assigned to the key vault when we will be performing the multiple environment deployment and if this is possible let us know the approach.

### Bicep Repro

_No response_

### Confirm

- [X] I have read the troubleshooting guide and looked for duplicates.

Contributor guide

No contributing guide indexed for this repository

Research direction

No Bicep repro, file, or test is provided. Start by inspecting the failed deployment operations for modulekvidentityroleassignmentonvault and the module that assigns roles to the shared key vault. Done means documenting or implementing a deployment approach that supports the shared vault across stage and production without a failed role-assignment deployment.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure
Domain
authorization, cloud
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
20/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.